{
  "id": "bundle--775cb3ae-0404-4c66-81c2-2395ea12ed38",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--nadsec-dionaea-enricher",
      "created": "2026-03-31T23:56:39Z",
      "modified": "2026-03-31T23:56:39Z",
      "name": "NadSec Dionaea STIX Enricher",
      "identity_class": "system",
      "description": "Automated enrichment from T-Pot Dionaea honeypot Elasticsearch data"
    },
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--nadsec-tlp-green",
      "created": "2025-01-01T00:00:00.000Z",
      "definition_type": "tlp",
      "definition": {
        "tlp": "green"
      },
      "name": "TLP:GREEN"
    },
    {
      "created": "2026-03-01T00:05:04.986Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "Rolling monthly view of attacker IPv4 addresses observed by Dionaea honeypots on a T-Pot instance (SMB, MSSQL, HTTP, FTP, etc). Each run looks back the last 1h and appends newly seen IPs for this month. Location: Australia.",
      "id": "report--775cb3ae-0404-4c66-81c2-2395ea12ed38",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-03-31T23:05:03.023Z",
      "name": "Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--3f02a9cb-99d3-4701-a574-5dfd7b4abe5d",
        "indicator--c2d3f517-be3d-480d-8ddf-44f258fa1d41",
        "indicator--825f334a-48d5-4ce9-9f15-51fbd5e7e321",
        "indicator--07dd7737-5879-437f-9736-e24c5caac902",
        "indicator--40ffbed1-dae9-414a-a471-d57130c9e9cc",
        "indicator--97e29ba7-a3a9-4d63-9ecd-e7492c76578a",
        "indicator--f172eb50-8707-4088-a4be-d4b99c0e2971",
        "indicator--1004736e-7686-47da-922c-5bf6c1369d53",
        "indicator--d30c9e93-d52b-4c3f-8fe5-d9f8e65f0cc0",
        "indicator--8497153e-fc07-46ac-8e15-89475a49d568",
        "indicator--ff1e8e4c-c895-4abc-9887-63c15984f509",
        "indicator--c94eeb8d-b3eb-4cda-8fa3-cdf061fb917b",
        "indicator--818f51e6-fbda-46b3-b3bf-4f2a0676b85a",
        "indicator--2966965a-d84b-4a3d-9f4a-a4b29f080902",
        "indicator--fba797f0-8312-47ca-b6ad-0f566d6414a9",
        "indicator--c775ace9-9cce-48ea-b66e-43bda44f1d8a",
        "indicator--ffbfa2f8-2323-4832-97ac-9d65556f4711",
        "indicator--1f350faf-9072-4ff6-95d8-96446d03208a",
        "indicator--e0775727-f3e8-4df0-b338-4776a8724ad5",
        "indicator--2a616519-9ba4-485a-829d-73e2ed258d2a",
        "indicator--92b2037b-f091-4a8b-9ded-cba3642036ea",
        "indicator--59ba6205-4dfa-4873-a6fa-399c576b880b",
        "indicator--d6582bef-8ded-40c2-b71c-0cbc767face8",
        "indicator--c250564d-85cf-4391-af57-4e66a4d269e6",
        "indicator--0e2eae7a-2d68-4101-82d7-0fe645f9366a",
        "indicator--bf0130cd-efcc-4bd0-b8b9-cc0706d627bc",
        "indicator--b3f336f5-2e2b-4382-84ec-9fac3c7fed33",
        "indicator--b71bcc29-165e-417c-a766-99ed757e2fbf",
        "indicator--f0162491-9e40-44ea-92c5-fb3dd800d8c3",
        "indicator--3a6daaa6-0538-43a3-a4f4-f210cfbd3af0",
        "indicator--aac9b5dc-6116-4490-aa38-adbcf39b625a",
        "indicator--365e732f-7cb4-46d8-8fe9-d81e24fb2ee8",
        "indicator--3e074dcc-8266-4629-abae-971754e58a66",
        "indicator--c935bc0e-0229-4610-9368-1621c880c6b8",
        "indicator--7ae2278a-bc67-4594-916d-b79f6cacedb2",
        "indicator--e8100b01-1729-4e9b-be4d-f8f298ca5144",
        "indicator--d1142a12-1764-41d1-b6a9-86072f5a5f17",
        "indicator--17f0557e-2305-4677-929d-05b8df41024a",
        "indicator--a21792a6-17d1-4263-817c-052c41be43fe",
        "indicator--a2e00293-2f57-47fc-b075-5cfe3e474bc8",
        "indicator--8f299832-355b-4186-bbb8-ac3aba1d4d8c",
        "indicator--9238d821-84f1-449d-819c-2a92f9bcd30b",
        "indicator--86d4e82a-acc5-43fa-9ee5-f18680d100b7",
        "indicator--b2e61067-bf24-47ef-a48f-cbca8fe5f361",
        "indicator--4c7024d7-ae1a-46ac-8166-2894933aa412",
        "indicator--f7bc0596-cd50-4999-a55d-eaa36696fb86",
        "indicator--4a09cb11-3cdf-4e86-a166-0e81ff4623bf",
        "indicator--e3255b2f-07a5-4e8c-b408-df6b33fdfcb2",
        "indicator--b06f0617-5a3d-4491-bc4d-10d2099df8d5",
        "indicator--8d8c35f4-1d38-4a20-b54b-e8a0e108033d",
        "indicator--0b97d61c-7a6e-4729-a86d-7780a345ce5e",
        "indicator--2312cb91-5803-4ad8-b071-e5cad66220ef",
        "indicator--ccf97dda-b162-4103-b712-960cfc8b535c",
        "indicator--d4dd377e-b2da-4b08-ac3d-21b30ecb29a1",
        "indicator--24bb00bd-4a08-4168-975f-a1fcbf39acf4",
        "indicator--15106a00-a838-41a2-83e9-2b2e9285c099",
        "indicator--f44c9bf0-a72d-4c53-a7b0-73ba4e8afc50",
        "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
        "indicator--dc1b535c-1e53-4302-8c1c-eff8be1287f1",
        "indicator--4d2c0a9b-6cfb-4e44-82e1-880ca15ee12c",
        "indicator--9b790997-e19a-4cc0-84cb-2ccebe8abff5",
        "indicator--daac0fe1-c1f2-4ae4-be62-8b0e0fd92b04",
        "indicator--9f24a41c-a86f-4421-9188-fec5419f3950",
        "indicator--44845173-d870-4013-b200-6937c16e512b",
        "indicator--6a4cf02f-4f5c-42a7-a890-cbec26368e05",
        "indicator--1e1a5ff3-2901-452f-a6b1-038da4068cb8",
        "indicator--be7008f7-b30a-4728-b546-7089ac909da6",
        "indicator--432f05e1-b61e-4bbd-982e-65688017740f",
        "indicator--9dd857f8-d5b2-41b5-bb00-53018042bc89",
        "indicator--8ae84811-c5ac-4a4e-be59-9f4ff9d8d65c",
        "indicator--3a0bd794-dae0-4484-9044-863e91b687a8",
        "indicator--74374f80-c747-455c-947b-c9b362a4c292",
        "indicator--b8d7ada2-c262-4ba2-9e49-31006a22cdc0",
        "indicator--aa08b597-1a22-470c-add8-a70c9da75b7c",
        "indicator--9b1ea3a9-e5e2-474b-bac7-950ded1724e4",
        "indicator--66a809e0-1839-4a77-8eb3-f27dec2baee5",
        "indicator--727022d2-6faf-4261-bbc8-b67252e5189a",
        "indicator--390af12e-0655-4b73-abb9-3a11795a2815",
        "indicator--f504626c-4031-4b79-b556-1574307bf3e6",
        "indicator--51d079ce-5b4a-4813-882e-ddef604967ed",
        "indicator--e5168cf9-5429-451e-9d9c-1b13c43e6371",
        "indicator--0e68b301-2d62-4ce2-b087-92ff68d0c18f",
        "indicator--7599169c-2808-4cd5-9681-135a824763a3",
        "indicator--9453105b-d637-4216-a77b-ae5035565172",
        "indicator--4102683d-e796-4fd6-8375-9eb99651ecf5",
        "indicator--7e9e4bd7-0420-4bda-8f0b-b69032e77a42",
        "indicator--5caa3a00-cf66-4d08-bc67-14cc157a4073",
        "indicator--6019ec92-cdf8-42e8-bf31-2a24c21601ed",
        "indicator--5607362d-1a85-4dde-a180-9407fa276198",
        "indicator--452385b4-1786-4952-8a4f-91d60e3462be",
        "indicator--fe665edc-a5b4-4f91-b386-214aa354bf5e",
        "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
        "indicator--8565e079-940a-4ccf-8a9e-010aca9326b6",
        "indicator--56f2c538-acb3-46ec-9183-fdbe6afbb31d",
        "indicator--8cbe76d0-2b5d-4034-b4d2-7b021a9e2aac",
        "indicator--776807b6-aac6-44ee-a6a1-34c69d3ed8b2",
        "indicator--bed93cb0-c458-406e-abdd-5f4b8691be70",
        "indicator--b9a9b498-8651-42c4-8d6e-22483ad8c0ce",
        "indicator--1754b6aa-be17-4946-a05e-0ed33e6726a7",
        "indicator--b668bb4a-289e-43fc-8d24-a79e50026eb5",
        "indicator--3517c695-3a7c-452e-a618-f4d943ff0a3c",
        "indicator--af033483-d491-4a52-9edc-5973d5d50b71",
        "indicator--31e8aac4-aec0-4e65-9790-3b5ebbcbd54f",
        "indicator--b0962fde-d631-421a-907d-ea952bacef6d",
        "indicator--aa4d6a75-cf96-4bdb-bf43-2c29eace8059",
        "indicator--d64a6aa1-7251-497f-8148-71b4d4e937aa",
        "indicator--b79f2bc3-1cd2-43a9-a025-f0d6da7b27f7",
        "indicator--d11578f8-dc37-4e7c-bf13-41662a7c2447",
        "indicator--dcebd298-cc8e-496f-baf7-6d6324b0fa46",
        "indicator--c5820a3b-b70f-4a82-a594-ae97ce0aabb9",
        "indicator--22b7c063-1c4a-4e37-94be-71f9902d2ef8",
        "indicator--81ba3903-063f-4705-aa12-e77d9d542fdb",
        "indicator--c107c1fd-6a8d-47de-bd8e-94e99f1d4b3a",
        "indicator--8f8c24f5-7122-4e02-ac46-ac323b867fde",
        "indicator--adc1f1dd-a700-4a52-8085-b6a6fbc2e5a3",
        "indicator--5b5b4372-98e7-4bc4-88c6-cf15c2fd6624",
        "indicator--78b5dde1-9ade-45f5-8e36-688cef9eb8e2",
        "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
        "indicator--fc6a62d4-3621-4c46-880e-6dafe987491c",
        "indicator--94bd3a79-e150-4a67-8714-1bfad56e6721",
        "indicator--d2dded84-0afa-41d9-9b2a-faf0b35b34c8",
        "indicator--7238d5db-41d4-4d5f-beba-76a62cd3098d",
        "indicator--0ee4c896-6167-4e9d-8217-71f068b38751",
        "indicator--24425d4d-518e-41e1-b93a-ace90ecaa229",
        "indicator--5db02f6d-dd08-43c8-badb-ce889c8c4847",
        "indicator--fbf40437-fc36-4023-b823-807f6e3dce7d",
        "indicator--06ba4c14-d353-4b6c-826e-80fce4fbd27b",
        "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
        "indicator--6db49d8c-94b7-4925-96ff-116599121978",
        "indicator--7797c1b3-70a3-4729-b458-2ecad409e178",
        "indicator--3a4444c3-b356-45e7-99fd-89aa86ccc295",
        "indicator--fb763fbb-1e0a-42d0-9ca7-982cd2e23a6c",
        "indicator--c492e768-325f-4a50-82e6-43f529f54051",
        "indicator--35e85297-fbf3-4d8b-8ee1-836c5db8edbe",
        "indicator--521a0a9c-22f0-496d-999c-02a885a80324",
        "indicator--b21fd1b0-8ac3-4c72-b228-d52c7e8d58e9",
        "indicator--e7bda2a7-cef8-45e2-9bb0-d639f46cd142",
        "indicator--a7606301-112a-4e64-b2db-ca8f17df6a8a",
        "indicator--57ecbd00-8c32-4d1b-993e-e90fbf0b8b5f",
        "indicator--27c7b285-20c4-4738-9b60-6b5c4f638c8d",
        "indicator--6fe99a61-e033-4f1f-889c-b5250d94a28f",
        "indicator--4cfbed3f-9213-4ff2-8772-f4306cb1f465",
        "indicator--83f68770-47ba-445c-bf64-2e72258c74ae",
        "indicator--15b797fa-0a04-4d44-b6a9-0a4596968fc8",
        "indicator--9758775f-0df4-424b-b038-26bfc6b9a5ac",
        "indicator--f20936a7-8646-4d43-be90-ba552d4f8e9d",
        "indicator--f5a37c75-8cde-4507-afb7-2f2e53770137",
        "indicator--b71c1d3e-c63b-49a3-968f-eecceb352859",
        "indicator--d7d5433c-f24b-44e7-9f25-dc8a04ded954",
        "indicator--e30990f4-7daa-4c85-a944-4264d37404be",
        "indicator--46a26322-ea99-43f9-ae21-3cbae08e990a",
        "indicator--077052b5-b7b8-44a8-a15a-85153cf11193",
        "indicator--9e00d84f-f583-40a0-a761-ef17d982ef62",
        "indicator--e0201f34-1fc9-4fa0-be1f-11e8566dc1e9",
        "indicator--7f54530f-12c1-45e4-89a8-fd7dc2fcf146",
        "indicator--d49f0bc9-23dd-402f-b579-8bcc3247d90c",
        "indicator--ec6c87ad-652c-453f-badc-1dcc15e37fab",
        "indicator--4fe10e10-158a-4ddf-8747-912996a5deac",
        "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
        "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
        "indicator--cc3a9061-e763-49c4-b841-41116c75a409",
        "indicator--1b693759-2ed0-4245-94cf-1783e3538f57",
        "indicator--7c627d8b-054d-40ae-956c-843a8e92ed5a",
        "indicator--d5b30679-0fa1-445a-9285-d1fb308b002f",
        "indicator--3a75971c-fd5f-48a5-88c1-e384f74c1e20",
        "indicator--cb51a6b7-37d3-4a31-914d-9f8aaff67644",
        "indicator--aaba4acc-4ff8-4b7a-8316-102ef21fdba9",
        "indicator--9680d567-2b3d-4c7e-a94f-e15eb8f4f636",
        "indicator--53228730-f81c-448e-8585-caa8a62b072c",
        "indicator--7ab66f43-6eb8-41b9-b009-6f7e0f52397e",
        "indicator--d06459ad-d77f-4574-950c-b993b87d9d20",
        "indicator--be6d430f-d03e-427e-86f4-e990aeb6c581",
        "indicator--f69509ee-0f3c-4e14-bf1f-43dd1f4160fe",
        "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
        "indicator--192477f9-56e9-4e8b-a2c1-f79a4cec0730",
        "indicator--30b43fe2-ee1b-4799-b868-cf7be8d237a6",
        "indicator--765b38ad-94b5-4830-9fac-521eb1055c40",
        "indicator--a11502b5-83fd-436e-9e27-9602ad27ed23",
        "indicator--db21abdf-efaa-419f-8cf3-7e4d63243d43",
        "indicator--82340bd0-b4bf-4d26-b6c7-1e202e9e75bb",
        "indicator--dcc0c787-3972-496f-99be-8a90d75bb601",
        "indicator--29c865ec-dee9-4f50-a77a-efbc247ee7a5",
        "indicator--e7165df4-de32-491d-bd33-b66a17373e9f",
        "indicator--e48f610e-7978-49b3-90ae-9f6a8d4f2f2d",
        "indicator--e87370b5-a40c-4dda-b7a3-79eb8c13519a",
        "indicator--db6e29cf-f35b-40c6-bab7-c5c801aba30d",
        "indicator--c77b8275-22d2-405b-9f48-7ad84ad26c34",
        "indicator--f61183ff-76ed-4adf-8cba-df8a704965fa",
        "indicator--f86e1fa7-9bed-4e1a-9159-d16c50bf708c",
        "indicator--f8d55015-14c6-46ff-88c7-0be5dc4f9f68",
        "indicator--5a55d2d7-a47e-489d-bfbb-00efff55689b",
        "indicator--074b427f-b506-4f50-abde-94ccbbe1b04f",
        "indicator--981b882c-7459-42f5-ad19-82dceff29b5e",
        "indicator--74b7d640-29b1-49bd-8b43-b01938278611",
        "indicator--fd220648-dc12-42c6-8b76-40cb516614aa",
        "indicator--40557a71-43db-4ad3-97e2-fa8502686c50",
        "indicator--188a8f9d-9545-43f6-9f7b-27cc89bf9945",
        "indicator--4963dfad-010a-4bf8-8cec-63ee3d3ecf7e",
        "indicator--644f511c-ad18-41de-a645-5310b8d3d4b0",
        "indicator--1c5cea85-14de-48c0-a1d7-47b51bc53a5c",
        "indicator--1be9df20-8223-4441-8556-476b70cdeccc",
        "indicator--715faa72-56ac-40a5-b3fa-48b4b8c57368",
        "indicator--e60d171f-b434-4285-b81a-a922d39a1b48",
        "indicator--29df78dc-5d9c-403a-bd85-2e105be52f3f",
        "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
        "indicator--8a26bfd0-f704-4ccd-883a-7c71ae84955c",
        "indicator--5eb66a91-d2e2-4875-ab7e-02eb06af0937",
        "indicator--f8fefba1-ba0d-4ecf-bf99-3e644bdf261e",
        "indicator--e5ef70ba-2836-4a5a-8693-5b75fa1c2d37",
        "indicator--0d30ac1f-3e0d-49c8-8800-47927babd0b8",
        "indicator--6a0515c6-bcb8-488f-996b-064229668a64",
        "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
        "indicator--7db03c63-4bbf-4a57-a8a9-d5ad9498bc41",
        "indicator--214a98ec-597d-4b9b-9015-c66afefdf554",
        "indicator--3131330e-470b-4e1a-87c5-9df2d3181696",
        "indicator--bb02889d-b738-4484-9ece-93e3bac03341",
        "indicator--36d28d72-5089-4e17-bbf2-00b0b2c41064",
        "indicator--88ac21b1-a688-43bc-8e17-940d2cbe806c",
        "indicator--8866f397-3e12-45cd-a2a3-dc1c11711822",
        "indicator--16e93605-5d1a-40fb-b2f5-4937a32113f4",
        "indicator--154ce8af-eedd-4ea5-ae2b-e46003bed7c8",
        "indicator--32c1eed6-1671-418c-afde-ac764fb49c2c",
        "indicator--77726002-5bbb-4d0f-9e1c-dfbaa28953b8",
        "indicator--303ae204-7771-4a1a-bec0-1d30f1d4f8e7",
        "indicator--e9ab10c0-a3c5-4e64-bd9e-7cbaf071ea44",
        "indicator--42d30a3b-b02c-436b-a749-748175d847d9",
        "indicator--e9518c9f-6bf5-4a3d-94e5-abd9d19dad3d",
        "indicator--12007d0d-19d8-4dfc-aa1f-a195d51aa695",
        "indicator--bb33dde6-fd49-4a7b-a7fa-8f604e8554d3",
        "indicator--3c867ec4-efd1-4fc2-a39e-0f88e156a837",
        "indicator--096a68c3-1166-477e-ba08-71caec8379f1",
        "indicator--1b7192e2-9a5a-471b-8268-6caad35c1775",
        "indicator--8d830343-a857-48f4-bc55-e25ffe9a8b5f",
        "indicator--82eec08a-9ef1-46b8-a985-58ab3286bfee",
        "indicator--28ada440-35f1-4f0a-9faf-de12062b1e9c",
        "indicator--4a974092-b5ea-4cae-b967-a8181f88943d",
        "indicator--b29a927b-2784-4846-b670-903fc8073dae",
        "indicator--7bf855b2-2c0f-4087-9891-5b8464f4f553",
        "indicator--68d8c79f-a659-493e-a429-3b27b3fcbe01",
        "indicator--04785ae2-e123-454b-a7ce-da22c8140d1f",
        "indicator--ac3de06c-8570-4fb4-9db9-5c73ad9816ad",
        "indicator--f0062450-8d01-4199-8eb7-74149f2947c9",
        "indicator--d60e67a8-7dba-4ed8-b24f-a57beaa2110f",
        "indicator--daf5b0f4-7a53-4fb4-8ec6-2e1fcbb86f54",
        "indicator--d9f4858c-dbe3-4bb0-ac7e-047c349cedd7",
        "indicator--73a2a6a1-4fcd-4d77-bdfc-5f79f8bbeb86",
        "indicator--97715341-a483-48b7-9f98-0f52f837c8d5",
        "indicator--12fd6bbf-1ea1-465c-92e7-160fc0917f9d",
        "indicator--5aaf7ab0-dcbb-4ef9-a7e3-dceab64c4625",
        "indicator--77177e22-b234-4e4e-8b50-7c4c41b7046a",
        "indicator--8bb609af-94fa-4d3d-8b92-ab6a90a25162",
        "indicator--7ee0d5fe-701f-4271-a4e3-37c6ee991a0c",
        "indicator--ffe14870-2840-4ecb-b1cd-8da2eb284b87",
        "indicator--98431d82-ceae-4138-80b7-8e32268fd4d7",
        "indicator--f6fe224e-4058-4e5b-a348-382b975bec22",
        "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
        "indicator--ee4e11a4-f1d3-4603-a5d1-c4330a27ee31",
        "indicator--b686bd45-4c56-40df-87d5-1a1e93a9f885",
        "indicator--5e7d0281-0b59-4a48-94db-e0da3d5c6655",
        "indicator--471a591b-6009-4681-9690-33abfdb890d4",
        "indicator--5e8758c1-ab15-4fdb-a2d9-d3d63e35a076",
        "indicator--ba7e8dc5-466a-484c-917b-25b24a23746d",
        "indicator--f16670f4-383b-4f81-a962-da677a69c725",
        "indicator--cacc9598-d4d9-4fe3-9e69-450503f2ed05",
        "indicator--a50b49e3-230c-4260-bb56-8a5d6d28025c",
        "indicator--32c563d4-c064-4610-8707-6cc1fd0420bf",
        "indicator--6835e72c-6bea-49c4-9430-50478c37af8e",
        "indicator--e3e89b99-4ebc-4d8c-b005-83abc3198a18",
        "indicator--9d1c4599-4941-4da6-b6e7-49d848aefed4",
        "indicator--5007945c-2d5d-4316-8f0a-de2326ad9cfd",
        "indicator--b7a2d52c-0e97-45fe-8c57-8a310efc2901",
        "indicator--da6e1353-743a-4139-97e6-f17712ed432a",
        "indicator--f3ca1f7d-eeff-4e77-b99c-217415f10a6f",
        "indicator--f7637ddf-d1a1-4081-9d15-d976d62659c9",
        "indicator--a443f2ce-5f7d-4e8d-a1f6-0799c5e88f32",
        "indicator--df6e6259-97aa-4bad-90d6-d86eb52678a3",
        "indicator--f805a635-fb27-4be9-bfee-4ebbbaa82a6b",
        "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
        "indicator--7d48f31b-5844-4af5-9106-1f462de06165",
        "indicator--5bffd8f4-3de8-4f12-b756-3ed805fb829a",
        "indicator--a5a7426c-b5f7-4635-8ada-a2cd72c3d628",
        "indicator--042ae63a-bcb1-4e7b-916a-e25a5581e02f",
        "indicator--890e5c03-7be4-45df-b393-9cbd8921678c",
        "indicator--c721a23b-0c1d-432f-b266-c3bc2f7e1192",
        "indicator--ecd2fcd7-ca9f-4012-aa77-788cc29774f9",
        "indicator--b8d54a55-70e2-4943-9fa6-5180eb42524f",
        "indicator--546b9b72-8bd9-4c03-8fde-8c5ceda6ec9a",
        "indicator--cc5369e6-8a50-4629-b503-19316eda0d05",
        "indicator--def82622-114f-46c4-b519-0806b49c4da9",
        "indicator--89241ed8-cccd-4ffb-a808-a25fb7767283",
        "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
        "indicator--9c822a0a-3bc4-42ce-83fd-887b73999867",
        "indicator--20db9219-0b27-4f94-91c9-aca69598ebdb",
        "indicator--c72afa90-b856-465d-96ef-403962dd02c8",
        "indicator--af03c3f5-8570-4e75-806f-089ad664f2a4",
        "indicator--54ed3b00-91fb-4dbf-9fb3-d151ec3216b2",
        "indicator--56b71829-88b7-45b5-9a9f-73df8fa25734",
        "indicator--3fb2ac11-a56f-4fda-b36a-9840e8f8fe14",
        "indicator--afcfe3a6-7fc8-4539-97e1-0680402dfc27",
        "indicator--93fef48c-0559-4f8c-b846-6531c5f79f30",
        "indicator--56fb010a-38e1-4927-b5cd-cc6384555213",
        "indicator--7b8f6607-3c89-4240-b4b9-8fbf68c915b6",
        "indicator--ecb1fd0f-9066-4bbf-82ad-ef8ecff244ac",
        "indicator--81fb6f8f-4f92-4eff-b819-a6b6371aaa6b",
        "indicator--4d50633d-3af9-4da7-ae7f-0729b971a27f",
        "indicator--58787ca8-e734-4bf6-b533-5b2aaa06b62f",
        "indicator--f8296f25-ca91-4003-8ed6-12b3f3b1444b",
        "indicator--2cd98388-4daf-4db9-9dc4-2c929dfacdd9",
        "indicator--b27bbbbd-7f54-44d8-98df-d22c84a3c0c3",
        "indicator--19beff39-c32e-4ecb-86f1-ac51e3772916",
        "indicator--7bfa793b-6552-486d-bbe5-6c7bd57ada29",
        "indicator--ec4191ae-39e9-4d05-90e0-a89045947d0f",
        "indicator--f6a151cd-b000-479d-b7d4-95ad20815b5a",
        "indicator--7def5365-76ce-42a4-a268-b55c6f461078",
        "indicator--47034d4f-94de-4414-93f7-9f8de54c47f9",
        "indicator--18ba644f-a79f-429d-b9c5-ab4337551421",
        "indicator--8951b63d-09fc-4566-aec1-3e0f85978d4c",
        "indicator--5dbd0747-b985-4dcf-b5f3-62b2e92e2204",
        "indicator--c5faa1fb-8e4b-4c64-9180-a4bef32898ef",
        "indicator--745ce08a-7d4b-4836-b5a3-087a5c72ff0d",
        "indicator--8012b978-c08d-4c9c-bf86-97017a078085",
        "indicator--4ebc9e48-374f-4d60-987a-4ab81ae7602e",
        "indicator--588f11ad-1b74-41a1-a33e-ad9499a086d6",
        "indicator--533156ae-aedd-4211-af56-54c9a87b1ad6",
        "indicator--04e3c0ee-384e-4483-965b-dc182158d469",
        "indicator--0f2d7181-b8da-4288-97fb-c7761abfd54c",
        "indicator--c19ff7de-d3fd-40f4-a3c3-a0b3beb3d3bc",
        "indicator--59187425-6bd5-4a85-9f6b-458c4fb2ac96",
        "indicator--ada764b1-6e43-47ce-8f30-0ada282ced84",
        "indicator--7950ab0f-5fbf-4ea2-a9e9-1017baa2c4fb",
        "indicator--04834c98-151f-4964-992c-f8a8eacef831",
        "indicator--db7d927a-4b0e-48fc-91c2-3c9f9a3a4d05",
        "indicator--b249a21e-7900-4126-af39-8320b9552250",
        "indicator--8e84396c-3f5f-4ff6-b0a1-f4000bbe5674",
        "indicator--ed0843e2-e31b-499b-b2d8-8772ac64e1e4",
        "indicator--279360c8-3447-4a19-97b0-e585768ee7a8",
        "indicator--e272d506-6f87-4836-8f84-9b3729ba5688",
        "indicator--7843eedf-9be0-4427-9cab-8746bd594515",
        "indicator--d3dd15f5-7b12-41c3-916f-aa299618a167",
        "indicator--e93e98a5-4dbd-4944-a88f-fdd4cb7d24d4",
        "indicator--ba7cd4c5-c861-42e4-8158-39c738e54ce9",
        "indicator--2c061c74-c3f7-49c1-9e45-e2bc4ba0d3f4",
        "indicator--1ac86c51-69bd-49f6-929a-a23157b900f5",
        "indicator--912885f1-1efd-4fb9-a4d0-bc81e7abf7a6",
        "indicator--2c71adcb-ce2b-42c2-a628-2b466477d49e",
        "indicator--7a146bf6-c6e9-4c0d-991a-070c1bf4edf6",
        "indicator--f26f2a61-65ad-4211-a0d7-2dead85d50c9",
        "indicator--fb6efe7c-3bb2-4543-8b99-8439069bd722",
        "indicator--375bd23d-3768-4520-946d-29735eb65dd8",
        "indicator--8d3d0b09-9b82-4026-8ebb-d7eb4800ab83",
        "indicator--0d8a798c-a31a-412d-917d-a0ba7502d6c0",
        "indicator--0a5d39e7-d799-4db2-bde1-a4cc73c57cd6",
        "indicator--0545311a-433f-4f18-a21d-b37347440129",
        "indicator--0bac8c68-ff38-4926-b1a8-48173fff2512",
        "indicator--615cba90-b5cc-4837-bb8c-2feb9627d252",
        "indicator--340e38de-7af8-4ed3-ab39-7921c3a67b53",
        "indicator--811359b6-ae27-4843-9545-88d9a92dcb29",
        "indicator--ed6125eb-4bb6-459f-8cd0-9f68ceadf58a",
        "indicator--f6d3ff96-feec-40f7-b58e-c724cc00bac5",
        "indicator--a50cb7da-c2f6-44a9-8177-249a813ae855",
        "indicator--1d8379ca-9138-4774-bcf2-3f13e4c3f693",
        "indicator--d6b9e7c5-e401-4561-88b7-b0aeb56a8bfd",
        "indicator--d7b6dfad-beb0-4e52-a973-f34c920a56b1",
        "indicator--d22cc502-28d5-46fc-a474-5efb47f444ae",
        "indicator--aa1d4c25-44e5-4a27-9c24-6555651e88ba",
        "indicator--4ecfbd8e-8758-41ca-83f7-e81ff9e28f34",
        "indicator--7bf32665-7b3d-4349-a886-aaa77c59cc42",
        "indicator--3b023841-1ae5-47dc-a1c0-4da828115c81",
        "indicator--5c21e092-2290-4e94-b4e0-e60478dc792b",
        "indicator--08b1415a-9b43-448a-b793-9f2998843b87",
        "indicator--06275e4f-e0a4-4f60-b542-5816589cceb2",
        "indicator--ed4a5147-f66c-4a96-871c-54beee9d5c34",
        "indicator--b4b1bc13-d544-467e-8676-a954336d5edd",
        "indicator--ba09cd7b-36e0-4d6a-a538-b49c91e3392f",
        "indicator--c7ba80e4-43f4-4dbd-babf-ee1fe4052878",
        "indicator--e715863f-9733-495e-9b4e-cd91563c47e7",
        "indicator--f8450206-7cc4-4008-81d7-91077407de2e",
        "indicator--be590e96-ecb1-4f5e-b386-30d359ae9e3d",
        "indicator--72d4f91c-850f-468a-97e8-69ceee26db43",
        "indicator--cff03fcb-b399-430e-908f-ec7b3b7d4087",
        "indicator--dc93b1fd-9e55-49c3-a32d-1cbe5d6a138b",
        "indicator--b317d5e5-88a7-4952-a1bc-2db7eebfd5cf",
        "indicator--de9b0b4a-e2da-44a3-913b-5b69584dfe52",
        "indicator--719a76f2-d512-4bfb-b095-cca9e883e58d",
        "indicator--2797d98a-c8c9-449a-9f93-822c7b406002",
        "indicator--ee5a39b9-fc56-4f95-bd5a-10711c95a858",
        "indicator--9d28318c-d8e0-4ea4-a03b-c350589d2c95",
        "indicator--31bd3854-904e-4049-b356-088cf420ce62",
        "indicator--3a4d3791-94f8-4336-a281-ddffb65a66e1",
        "indicator--43485d9e-f723-4db1-bcc9-54bc00a16d12",
        "indicator--3231a295-d22d-4121-a1c3-c5f1a813a440",
        "indicator--65093dc1-0b8f-4993-9f41-f4c6ff1c9676",
        "indicator--76583976-535d-482c-bb3e-6bedca55fc99",
        "indicator--51bec361-75ae-419a-b4ac-8dabe13576e4",
        "indicator--3fe85188-f3d9-47c5-b41f-bc233bceabb8",
        "indicator--131bd4f3-b04b-4087-b1d7-9273aacb1985",
        "indicator--a50d5574-7976-4d32-b2b1-d475320b029a",
        "indicator--3cff8424-42c3-4206-b03e-be07300c7b51",
        "indicator--448b3e29-c3ba-4040-84fc-b1203fc9bdb6",
        "indicator--a51b2d3e-bcd7-43e9-ab29-8929f9c744fa",
        "indicator--b47509bb-0cb5-456f-b443-460bbc1b8236",
        "indicator--2a5a6eda-73a0-48a9-a0ed-22985d82618f",
        "indicator--9397e362-5e84-480d-93b2-3e1c27737374",
        "indicator--8e81bd6a-1482-422b-ab41-ba9649bef2e9",
        "indicator--41eff508-cf9f-46cb-9dc7-999c952d0089",
        "indicator--006608f4-e97a-4dc0-9c8a-eda31bdc919a",
        "indicator--f2d831a5-f851-4d41-8ad9-0969ca027381",
        "indicator--95e132dc-a777-46da-bfb1-662341a5408b",
        "indicator--cbc136c9-7c6f-4b4d-ba70-12610a0c7842",
        "indicator--4b3004cf-a643-4a2e-8f90-cfd3bff87b03",
        "indicator--06bc9590-6b54-499e-9b61-c6e3dae84ae2",
        "indicator--6ef3201a-3da9-41f9-971a-80d566f2d703",
        "indicator--5dcd177b-53e6-49ea-bd64-ec24f60a130d",
        "indicator--137d87b6-9a7c-40e5-b8db-88c1996a3f3c",
        "indicator--d88149b1-1a55-4d08-9dbb-7875fc7293db",
        "indicator--fecdf817-39f9-4828-889e-b471c180eb0c",
        "indicator--64700655-fe95-4d36-b89e-efef64a4010a",
        "indicator--b851d7da-feb9-4b15-a7b5-ac5a51c302ed",
        "indicator--0a7182ce-b50f-4531-939e-293f5ea76fc8",
        "indicator--7e7dff22-a425-45f3-bc18-704da0a04d3c",
        "indicator--ab7be803-016c-496f-9470-66d924f0d5c7",
        "indicator--098a35e3-6be4-4b52-b7ad-6974e1ce1f06",
        "indicator--c034f0c4-9940-4b51-a32e-5227992ca1ef",
        "indicator--83c5e94b-865e-4c72-b51c-5003a2b97836",
        "indicator--3062bce4-4e21-4683-a3a8-62e12c88c89d",
        "indicator--9ea07729-1de0-4193-b0b4-26f4b0919e7a",
        "indicator--f7caeb67-5117-402d-a9a8-990ddb7595d5",
        "indicator--8a4e10ca-f3e8-41f7-a366-db276eda9ed4",
        "indicator--9f9c0022-fe80-4b6a-9953-db9aea065334",
        "indicator--ff4ed4fd-fd58-4967-b45e-cf86b33aeff0",
        "indicator--1a0dc291-ea8a-41cf-beea-953ef46f6ae2",
        "indicator--6f214f42-137e-4ba8-9787-bf8fe2b8e7de",
        "indicator--ef0c1e4c-0c86-459b-9fba-9b16471c50c8",
        "indicator--1506341e-8966-4f57-bcba-33ae939df226",
        "indicator--a7f36cd3-d06e-44a0-9ff4-d8626163aae2",
        "indicator--8f6cb2eb-dcc9-4e11-8ad8-ceab7b9b8c59",
        "indicator--8a4d0218-6f8b-460b-88bc-3ccd87cf41f2",
        "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
        "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
        "indicator--5d5c932f-0f08-4b60-a9b7-4d0c5a2750a7",
        "indicator--83f7babf-80e0-43d4-b7ee-f90bf13ac249",
        "indicator--ce40dbc0-6bc0-4198-8e28-a1b9df010984",
        "indicator--822f99d8-d123-4c5c-9e2b-4c7ee2135f4e",
        "indicator--82f99516-6b76-4473-9d32-1081e5f3fe0a",
        "indicator--1b07bc7d-22e0-4157-9f46-839f59dacc6e",
        "indicator--f6d4a6b7-b41c-444a-b9a3-2bacf320caa6",
        "indicator--3f5955a4-67ec-431c-9474-b1e527227b9a",
        "indicator--3a1ec5a1-3a0e-4059-b48b-1cd31dc32bcd",
        "indicator--37a80f06-59f2-4a2b-b4f7-5384d0006976",
        "indicator--55e9a76a-1ca8-4dd1-9438-8bd149421167",
        "indicator--9edb283c-792b-4f7f-9453-88d1e7d0fdba",
        "indicator--c185f73f-694f-45b4-a937-cda405f8ce5f",
        "indicator--137b29b5-e297-43ce-a988-6dca1b0e2c7d",
        "indicator--b6257d93-2eec-465e-b3cd-a89ab18bf84c",
        "indicator--6017679d-e560-4f6f-a821-6bd7b6b15563",
        "indicator--5f3068e6-512a-4e38-905d-a499a4f59c98",
        "indicator--a6d6fc8f-793a-4757-99c9-c711eb20889c",
        "indicator--0b096aa8-1190-4350-8c43-0517aa566e19",
        "indicator--05ff7547-9bbc-4459-9d4b-05a30ba1f0b2",
        "indicator--edbd9482-cb65-4aec-b991-2da546d7a440",
        "indicator--fe695f2d-a143-4d53-9ff5-cda847ef5901",
        "indicator--334b5454-ce08-4646-ab7a-c4cebf9a3c4a",
        "indicator--f4bda97f-6811-49c4-a842-c5add4a59220",
        "indicator--a16622b7-d164-4424-adcd-aceb8e427af4",
        "indicator--0e125127-67f7-486c-95df-70e5258c9ad4",
        "indicator--a29c4320-2527-4791-b623-6b17127b4a65",
        "indicator--7d462411-05eb-4edb-ab81-6b7cab89850b",
        "indicator--775d5014-4ef4-467c-917b-486faf1085ea",
        "indicator--bc33eeff-d081-407b-bb4c-488107cff129",
        "indicator--bfcbd46f-e09a-4913-bfa5-c59263568ca6",
        "indicator--50f4e7c3-0528-4ae2-9bc7-39b7e5e9b637",
        "indicator--e9233c2f-c96f-4b03-81d9-8a0c68574f47",
        "indicator--4d467214-4b1b-459d-bdc7-21b528c0c28a",
        "indicator--64395c5c-df5f-4eeb-a8b9-407d74ca53dc",
        "indicator--7829dfb7-c2d6-4741-830a-5882ac8ee255",
        "indicator--4e1bc778-5150-4d96-92af-adef1406d916",
        "indicator--9de9deb8-ea6e-4d93-ae61-ef5179bf02e9",
        "indicator--78399b29-ba81-470b-ba88-d7435977d823",
        "indicator--c9eb1295-096b-42ee-b724-6775b376a377",
        "indicator--5a7be381-7aae-42d6-b9d5-87719aefb0dc",
        "indicator--6aace095-95ee-4617-8ce3-7d9ac2409c7e",
        "indicator--cbd7c854-71a4-4f8a-9208-74c06a1a4958",
        "indicator--0cfe1d7c-9f0f-415d-b7f7-bc6b9e68e07d",
        "indicator--71295360-f00a-44f7-bf23-e67c0e83339d",
        "indicator--4a9041e0-3a44-476a-8370-2a323523bea3",
        "indicator--25c2e7e7-40ee-431d-9ac4-fb8c0ccf2a78",
        "indicator--634a9326-49db-4f67-bacc-d2345eedff56",
        "indicator--3b48d475-cbc8-4971-a586-acb2b4ae0cd6",
        "indicator--929060f2-3392-4a6f-b2d6-e982da1a5e71",
        "indicator--278e258c-926e-4654-8e2b-0012d03ec97b",
        "indicator--562aabdf-6d0c-4843-867a-35fca7f60d92",
        "indicator--ca6b8840-594f-4f09-8bbf-3629c0d4081a",
        "indicator--789d61f0-5a85-4887-8a0c-e42267eb7122",
        "indicator--5d8bbebd-b3f9-4380-8921-9c82603a21cf",
        "indicator--0c600559-d225-4a85-9a74-d00a2a38ab5a",
        "indicator--2e88ba6a-ef25-40cb-9f63-9a1942dcee95",
        "indicator--a3695ba9-e100-4a1d-86ee-f7d293c958b9",
        "indicator--867c1d28-8ba1-4b7e-824f-3673cdecba41",
        "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
        "indicator--10746048-2b09-43db-bdd6-8e422290ba77",
        "indicator--ccb3f248-d815-492d-8b3f-09af3293d091",
        "indicator--fed3a61e-8415-4737-a73c-0d7fd1f0d60b",
        "indicator--91e20441-7491-4f05-afea-f2ddc2e821d0",
        "indicator--68b5e9b0-4d62-4700-9486-06699cef1c5e",
        "indicator--62df14a8-e1b8-44d8-a1ff-15b9d6445b47",
        "indicator--e6f87c3e-0066-4329-8c36-831ab6025c7d",
        "indicator--fc52f6a3-d4c9-4d74-8b7e-7968c719bc8a",
        "indicator--44f7ff70-2b27-48e5-b15d-3420627b2d85",
        "indicator--e13b8ded-e8ad-4254-bbb0-1a43fc72387f",
        "indicator--975b0631-c579-4c05-812e-4aa462d69f90",
        "indicator--b115c661-dfb5-43da-a2e5-cc35e1ca4d7e",
        "indicator--53b4e067-c28c-4e0d-a1f1-005d01181b2d",
        "indicator--6526808d-423d-4ff9-a190-3fdc47d16afa",
        "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
        "indicator--10b950d9-c7ff-4858-9e0c-8d490e246ae4",
        "indicator--29cdae77-90f2-4107-abe3-01cf8d69ae14",
        "indicator--1936dc0d-bce0-4176-8f43-1746fcf0d1e6",
        "indicator--e911ecb1-291b-4d12-b8f7-fb678d1826b6",
        "indicator--019e465b-6221-4882-9bec-a08dd19313b9",
        "indicator--3889a982-cebe-4e6a-8cab-b4bb79954e3c",
        "indicator--353e9c2e-dd40-403d-bee2-1bdef4260121",
        "indicator--83d73e45-aca7-4b05-98e5-9ec89032a548",
        "indicator--bf86e7d9-9a76-4630-99cf-3e33626e11fa",
        "indicator--21610cdd-2b73-4c4d-baa0-96c23e092993",
        "indicator--3fd6a4e8-fac6-4ff8-a495-34fe50c42363",
        "indicator--742ef046-24ec-452c-87ad-250d3e6d4ab5",
        "indicator--489ca25a-cd83-4a4f-b52c-ab86766e5eb1",
        "indicator--ce788332-ce8f-4a51-bb14-9e2dcdd8b9d5",
        "indicator--5fd0b8cf-9cdf-4bfa-ac34-820a647c9b74",
        "indicator--aaa8db2a-2624-46f0-9df1-e640adf899fe",
        "indicator--5f32278d-5ca3-428a-a633-00e54b75e96c",
        "indicator--4e7261cb-e797-4219-9662-43e3828b5ba7",
        "indicator--29fdbfe3-54a7-45a3-8621-54d8db8ae35c",
        "indicator--37fbc6aa-a135-493e-99e0-cd54fdd5b756",
        "indicator--d821c922-f232-4d64-8303-b5664388a2b2",
        "indicator--55b597b6-d231-4a9f-9f88-281f3663cc2f",
        "indicator--5ebf6f51-ecea-491d-80af-0f5fe386b613",
        "indicator--363d8add-3821-4a8a-8b30-57d3c4146a05",
        "indicator--9da7a684-e294-4ef2-8cd8-b6baebf3139b",
        "indicator--f58f264a-b513-4cf0-86b9-0e5069424887",
        "indicator--d9e91bcc-04ca-4fcd-b5d8-0d0dcd9ea897",
        "indicator--5c76e314-e63a-4c07-9134-3fa490b22210",
        "indicator--77e88233-718f-4595-8839-cb9739c20ca5",
        "indicator--fb545b67-056e-4e72-b696-3491ccbf8ff8",
        "indicator--1a3c6d6e-c3a5-458a-9e2e-9d9faa8f9e50",
        "indicator--b9737d11-fd80-426d-ade7-d907c7a4b5e7",
        "indicator--b11e9fab-d74e-4edf-8457-5cad490370d8",
        "indicator--3343c7da-7a5a-450c-bd00-2fe8af64f172",
        "indicator--23e4b73a-d513-4059-9b31-db90c6765c4d",
        "indicator--8e4a7ddb-dcd0-4432-8b57-73bee5498905",
        "indicator--dd666dd6-e9f1-49fd-bf54-21f7e5df951e",
        "indicator--33025a4a-a3b7-4f58-906c-15369c0802df",
        "indicator--1531a4ac-d29b-406a-924f-21adc6ed979e",
        "indicator--e78f4124-c3f6-442a-8976-cce7dca5edb8",
        "indicator--9c5f07fa-0d51-46a0-b64c-28c147fcbd0e",
        "indicator--704e575c-1ced-4ebd-86e8-b4786c8c1de6",
        "indicator--18a9635f-a52b-4d3a-81d3-4c33c36a158d",
        "indicator--39e668b8-2270-4b4e-a0b4-726d73ac27e1",
        "indicator--1d36807e-2d4f-482d-a6e2-6eb357639169",
        "indicator--6c0f6e20-6f4d-455b-a9d0-8532c2a84abd",
        "indicator--0e779e73-9071-4794-b3bb-737b97b7ab83",
        "indicator--6c50f4cc-e9e9-4e69-a934-dff55685d946",
        "indicator--5621206f-ee74-4851-8c2b-77e2c3af8bc9",
        "indicator--e4df7863-5ef0-4c12-836e-59e0501c03ae",
        "indicator--df20b504-f7e1-418e-af02-6e6bb8e8d00b",
        "indicator--2c8fd0fa-9329-4886-a69e-10b2e172da68",
        "indicator--7ab4e304-3243-484d-8f9d-fa4bdfc73a40",
        "indicator--c1973a3b-7949-464e-95fb-725e8331d474",
        "indicator--0fbe0f4f-b845-476b-97cd-adf292ee1303",
        "indicator--496f9dab-99b8-4cf0-9954-0110da278cae",
        "indicator--f036ad83-09a4-40ca-a8e3-3b8dffdfb876",
        "indicator--15d786a1-b30c-44d0-8db6-b0517ef1da37",
        "indicator--287d6eb0-b396-419d-946a-275eb7b5aea3",
        "indicator--66c933be-e3fe-4b42-b31c-99f351c85ec7",
        "indicator--39b86dc8-cc86-4e2a-9294-80f44cc6905c",
        "indicator--6792b1a2-1cbe-40ba-ba35-6c15d5ab3d5e",
        "indicator--f6fd302f-85ed-46d0-848f-5cb273c84d25",
        "indicator--4edfd0ea-da74-452a-a1cf-aa960d0b573c",
        "indicator--94d8ee80-d985-46ea-ad6f-56bbd0b98a1b",
        "indicator--b733cfe5-134d-4f4d-bfdc-836e4a675548",
        "indicator--2ffa6b6a-b879-4427-ada4-75182bb84ed5",
        "indicator--2830d2cf-5453-4499-b2f6-9b6d1e497d4a",
        "indicator--28c2482b-e196-4a06-9310-dce70ab66014",
        "indicator--e2491c28-4350-4415-abad-cbcb1142b131",
        "indicator--ef2d0d8f-4595-4b5e-98ac-457f49d7cfb7",
        "indicator--5f8a4cf5-bb43-4d2b-8cfd-a51480db18d6",
        "indicator--781996f2-a795-4c05-ac7f-52a74626247f",
        "indicator--81992fa7-991b-455f-b168-683d8b2b96b4",
        "indicator--bf4baf86-3a28-4af6-a03b-7932738146a8",
        "indicator--924bdbae-1d7d-494a-aa17-8344a23a21a4",
        "indicator--35b80c59-b077-4354-9baa-0d608233dddc",
        "indicator--de41a027-9ede-4877-9c35-a4914c5cdeb1",
        "indicator--81f3a886-8550-4404-80ed-8081b4ca71ff",
        "indicator--d7be791d-aad0-4e7d-b639-c7f7c71df278",
        "indicator--a0dd5227-ad79-4266-9513-26fa962d1fe4",
        "indicator--c542a5a9-a3d4-4f11-8eb3-b271cb4bb69b",
        "indicator--34344c3b-1cb6-432e-b47b-3500cadb7322",
        "indicator--1ec1440c-f659-47bc-bcd6-061f35597b34",
        "indicator--8ab43a85-2717-4eef-beeb-b50e570cd0dd",
        "indicator--807ce508-98da-4f29-9dee-aead1c4e0882",
        "indicator--979f09ef-b5c9-4f08-89a7-0dd82f2daa7f",
        "indicator--a3189e32-2e71-459c-a7cb-dc2feccd308e",
        "indicator--4092b0ff-fc96-42d8-a706-18942756e247",
        "indicator--a1527cd0-6984-464f-8d4f-f06e265f7331",
        "indicator--18a3c21a-c249-442a-a497-e371d9968806",
        "indicator--cd111716-4156-4972-8690-68976e2d0d6c",
        "indicator--1a295a5c-b0c6-4131-ab6a-c6d458ca3e86",
        "indicator--33cbc6e7-f0b8-45ef-ab03-7564bf2d561c",
        "indicator--fa02b2be-1d29-4bf4-93c1-cd4284257a5f",
        "indicator--4ed46ae9-791e-44df-805a-5dcdcf20b52d",
        "indicator--88b8fdd6-65a2-446b-bbb8-4125975ee65d",
        "indicator--4181b13f-1891-4e73-af79-8124cab50444",
        "indicator--a0b9100f-4e80-4d78-b891-4fc6a31389a9",
        "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
        "indicator--b86ed45c-3c34-4b25-aaa7-b36487656de8",
        "indicator--1e523be2-2101-4e0c-9fa8-f1ff4499a987",
        "indicator--0eb266de-382a-43d9-9bac-43996a2a762a",
        "indicator--b60a0106-243a-4070-8212-bf8aebe6c8a6",
        "indicator--5af46e79-f5b5-496e-b0eb-ccaabe9cad83",
        "indicator--e862f2b5-07ae-4f69-baa8-14e79cad5241",
        "indicator--fe58d46a-1e64-4590-a8cf-2e74703b2a31",
        "indicator--a5ce5611-2e4f-484c-b827-eaee38171778",
        "indicator--ea6fa25f-39c7-40c1-9de6-ef3cde78eed2",
        "indicator--607cb5bb-c562-413a-8fa5-79e965543ebb",
        "indicator--8bff1358-e938-447e-af38-c1b765ccb112",
        "indicator--1d701c47-2758-4d80-8351-20b1182ca412",
        "indicator--9026443b-94c7-4028-a161-15c7554f8593",
        "indicator--f9bb2cc8-122c-46a2-a3f8-b734530336d4",
        "indicator--b9224bc3-6b84-4e2f-b023-232253ca0e5c",
        "indicator--6624b2fe-fb0c-4128-86db-da823d710776",
        "indicator--6c166492-8271-4b04-816d-4587efbc9e3b",
        "indicator--84743f9f-f90a-4e32-847b-2eb08ede8c4b",
        "indicator--b87b5d8a-d65c-4c5f-ad6c-1cc8db7c8662",
        "indicator--e609a38b-17c2-458b-96ea-7ce2f9fffb17",
        "indicator--e7f2cdfc-0d5f-4d97-99cc-5a78b0d094fc",
        "indicator--9bd738f4-f00e-4b7d-b617-7f6f314c14ff",
        "indicator--f03cf453-2a8d-4bca-972f-6bf4e4e06531",
        "indicator--d3b16763-e574-45c6-957d-105400f017dd",
        "indicator--d832d8ce-9102-485d-be77-0b58ed3418ab",
        "indicator--2ed6ec3b-8f1d-40c4-8ed0-c0f1354a2c0c",
        "indicator--aa477a97-f019-4b55-97bd-f57e6a938336",
        "indicator--6f2a46dd-39b7-4b5d-92b0-21157be46d66",
        "indicator--79e79fea-d77f-4bb3-84b6-1319ad1371a2",
        "indicator--17101048-9001-4e7b-b83c-f4cfb5b141b7",
        "indicator--feaa5bb7-aa1f-4949-983a-e385c787732a",
        "indicator--7efee158-d366-40e4-af01-a3aa73139016",
        "indicator--89ffc0fc-c47d-42f0-9c18-6b8f8a1cf1c9",
        "indicator--00794190-d05c-4f37-8bb2-5882aa30cf2d",
        "indicator--4e0dd959-c443-4dbb-a27c-bd4262758c2f",
        "indicator--b49141f3-d7e7-4f7b-b1ee-f1ef1d3904ce",
        "indicator--45ea9514-8e4a-4fa3-a239-0f5b87a009c2",
        "indicator--65df4e03-92f9-4e39-a2cb-7807d45497c8",
        "indicator--ac5081d5-5c5a-41c8-a125-d51451c2fc31",
        "indicator--59a60683-4fb2-4d40-8033-a0359d209080",
        "indicator--8fe89976-6884-44ab-acea-0fc04b1594d1",
        "indicator--b9a7e811-9c0d-4e9d-8356-d8ddaf3119c5",
        "indicator--c60b737a-5c34-4f28-8c6d-1d2f4e136e90",
        "indicator--8a0e131f-0052-47ff-953b-a8e58f4826d6",
        "indicator--a17d1400-7222-49eb-a603-efba6b84876b",
        "indicator--d452a010-0f9d-4819-9d27-65467bd3faa1",
        "indicator--7df1ceae-25cf-49d3-87c7-75cb6f69f258",
        "indicator--4f97f50e-4c6f-432b-a0f7-9090aff1d10a",
        "indicator--a0fa153b-cc88-4a45-a7b0-3c606588b96a",
        "indicator--cd25bff6-f29d-4dfd-b0f6-d7cf4ad2e16e",
        "indicator--9f9a1586-1dab-4c84-9980-86b0897e986a",
        "indicator--0f224ef0-aa40-4c39-9c36-1253c5c63ad8",
        "indicator--5bb8df17-f464-4485-950d-10a17de8ddcb",
        "indicator--0e00f9da-ae75-4869-8c52-eff9e6416a59",
        "indicator--d3e6338e-f0be-4b91-b21e-3e348c498769",
        "indicator--f391fa3a-2b38-4475-9852-040440e84b82",
        "indicator--247df011-3986-49cc-9e3c-adcdebd2dd8e",
        "indicator--ba09c7e2-3980-4a1c-86c5-45511c312e89",
        "indicator--d3b79e12-3e88-4cf9-bdc4-119c28865e35",
        "indicator--6c24df71-77a1-44be-a05e-49cffb7d5afa",
        "indicator--82c6706c-0c54-4538-99ab-bca4d9e48b72",
        "indicator--da3108b5-1dc1-40f6-9416-9e2613c0deef",
        "indicator--c0ae0dec-bdd8-4578-8249-a21609b58a57",
        "indicator--79709fac-e78c-4e50-9139-33438351117d",
        "indicator--ffb7076b-32d8-431b-9f3c-638dacbf358e",
        "indicator--a75b4a07-2db7-4627-9288-5cdc45d7dda6",
        "indicator--687b52bc-9bed-4268-bce9-1aadf94fddac",
        "indicator--a502c5ee-e751-46d6-ac52-714527dd8a11",
        "indicator--bbdb3e0b-fbd4-49f4-b82c-cf3fba7ebb80",
        "indicator--3aace403-afe2-4ef4-843b-06a28915620e",
        "indicator--77bc1a11-9161-4920-bf00-e3c3f0cec8a2",
        "indicator--412bd647-8932-4879-a00d-874db55e539f",
        "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
        "indicator--d70dc23d-e9cf-4371-9011-d845b767f58c",
        "indicator--be80cae7-6ae8-4fb7-b2a0-809f203f4b97",
        "indicator--10b0ae1d-9a20-433f-ad36-c247b2822257",
        "indicator--37bfcffe-4ee5-4b57-8d52-acfd8524968d",
        "indicator--abf68990-e42c-4f23-83a4-b8c8e8504797",
        "indicator--9f83be76-66a0-4527-b7a5-42db074d1b35",
        "indicator--691a87fa-6c8d-443d-9354-4bfc0b69398e",
        "indicator--56859250-6687-4494-b143-744a5753c60f",
        "indicator--0daf1a46-a413-452d-8029-bdba033aa0ae",
        "indicator--3c75293e-c0a4-4863-a06e-3ce21b12ea7d",
        "indicator--77202c5d-0d71-44db-ac55-a02629d2992a",
        "indicator--9dac09f0-300b-4111-aff8-9eecd2f9ed8a",
        "indicator--4367f8cc-845d-498e-a552-ceca80cf8725",
        "indicator--8a512f1a-b7cd-4f2b-9d67-f27027bc99d2",
        "indicator--83481cc2-4700-4b29-a1eb-9e661916d5b5",
        "indicator--0a0b345f-46bf-4905-89d1-f57a172d7d98",
        "indicator--d53ea49f-fd66-4390-aa7b-9d84856b861f",
        "indicator--e564d18d-9313-4c7f-98d5-036e968f84a5",
        "indicator--e12c2c48-a1ce-43f2-a5bd-ee4cd0fc6cef",
        "indicator--f817a2f4-11f4-4711-a1cd-03a23d7d4a81",
        "indicator--0d202aa1-0284-4440-a2ba-c3c831985982",
        "indicator--40317f30-ef03-4ac7-aa37-3088379794f6",
        "indicator--80633887-0ef6-46c7-acbd-b3337b80a45e",
        "indicator--71fa9a05-b14e-4624-bbd6-17cd74b2bd1d",
        "indicator--2496c921-a981-4eec-abda-75d6dc441403",
        "indicator--917e97e9-fe8f-47db-b5bc-d4843b539a9d",
        "indicator--2c779985-a517-4858-aa48-9363ccfb939a",
        "indicator--d318c61a-b9dc-4d1c-ae29-7e83a70b589d",
        "indicator--892b9cd9-9519-45b3-a58b-b908b44a9a1e",
        "indicator--dc0ff5d4-ea60-4603-9784-80d8d18efe1a",
        "indicator--5f5766af-7946-41e4-b2dc-fc4bdb625259",
        "indicator--06599d2f-34fa-48dc-9a4b-fa1ddc9b9b41",
        "indicator--8ae441bf-b6c4-48d4-9a8f-35c110b1bc6b",
        "indicator--6b57b974-65ce-40c1-9b01-0b33ce04a03d",
        "indicator--05ea3889-8242-4a27-9662-09bcdee13265",
        "indicator--56c4bc92-1d82-43a3-909b-2312d76ca4d6",
        "indicator--4e7b9bd8-576b-4a8b-bc9b-0305b56e18a9",
        "indicator--f2425490-8f27-446c-972f-2ef9642685de",
        "indicator--f71493b9-6ad9-4172-823f-c848093a56aa",
        "indicator--fc4c5a81-42d8-42e9-a448-46ace9d9a0e1",
        "indicator--8ac2642c-ed00-408c-9fd8-e4b55db4e8e3",
        "indicator--e1eee194-08b0-4dc9-af56-166941c394a5",
        "indicator--546f3214-3cdb-4c1a-ae79-7256e5965758",
        "indicator--90293941-b72f-42d3-ba1b-b3688657e173",
        "indicator--23a8aaa0-6652-4228-a9a9-7da79856ee06",
        "indicator--28d65b6d-52b8-4d3e-b92e-f01f5cac77d2",
        "indicator--1e9989a0-40b4-4968-a520-7db9c70ee99f",
        "indicator--5aa3e11a-8164-453e-b008-90414cbac928",
        "indicator--0411850e-ac1d-4701-ae00-7ab0205445bd",
        "indicator--9f68e0d0-d947-4150-88e0-a70649467e3b",
        "indicator--d75a13f5-f242-49be-a237-d0553a2d0d80",
        "indicator--3313db43-ae0f-4e1f-9f48-b34e46be2411",
        "indicator--53ffec28-d4e2-49db-817e-af88c4650150",
        "indicator--79b94aa4-f50e-44f1-9731-11aca4d75734",
        "indicator--2bffc05f-5ca9-4bcc-ac2a-f830e2d0ee32",
        "indicator--0a70c5b6-4efb-4f65-b9c1-baea0615176a",
        "indicator--c72b69f4-f2cc-4f65-98d2-d25e6b6f2e5f",
        "indicator--549bb524-14a1-4310-9596-580b931dbae7",
        "indicator--e476c3c2-33c9-4876-962a-e9061b4f2afc",
        "indicator--d0f5fe60-d525-4059-8a51-84cc8d16ba82",
        "indicator--b83c4bc2-ac81-4979-bd43-385c942d8e2c",
        "indicator--2cad1e8e-d6c1-4405-87f0-fefd0c342dcc",
        "indicator--20d7e53f-f2f9-4179-b98a-a435fda573e6",
        "indicator--dc6bae7f-e2fc-4218-a40c-3494decdb990",
        "indicator--1b60a3ae-2989-4199-8832-934c0d72a6aa",
        "indicator--786aa87b-4dbb-4d2c-b48d-6a57895dc29b",
        "indicator--52ff7a91-3eb8-42e1-9d9c-18e1efd2e52a",
        "indicator--1d97ad79-ca6b-4ca2-87f7-784f98db5cfe",
        "indicator--81328fbc-5c1b-4aed-969e-a01f5601be22",
        "indicator--7c7b40be-80ac-45ce-95ef-e282428e41e6",
        "indicator--ed4b3f8b-9e41-4ff4-942a-52b369402d21",
        "indicator--469214dc-f310-473f-863f-b6482ad5d688",
        "indicator--f6f4fb69-e71e-4828-8ede-0412d1a56d9a",
        "indicator--9726c8f5-1a13-40ed-986d-fed588a0d099",
        "indicator--442bbc9f-f730-4bf3-a78f-633bb70593ca",
        "indicator--52977cb2-7839-404f-a8f5-4b733194305f",
        "indicator--16b884a3-d3bc-4c88-abc9-66d36c714b6c",
        "indicator--59596866-caba-4832-ae80-7ca9fb429254",
        "indicator--09e030a5-6888-4301-8171-2a5f7199c6c5",
        "indicator--dd361783-959a-4618-9b54-98871cbb828a",
        "indicator--c1b4eb44-6f6f-446b-ab7b-aee02ba971e9",
        "indicator--895b3627-7970-4d76-a017-8ddbd4da8fe0",
        "indicator--faccec54-c492-44f1-abfe-43ac813b5af4",
        "indicator--6d86b696-c9b7-4a66-a49d-8a0b55317e87",
        "indicator--8dae792e-d457-4222-96f7-c2896cb5d4f6",
        "indicator--02165f82-453f-4a9f-a5cc-1409ab0c8a4a",
        "indicator--220f8733-c351-4c77-bb55-22c538fc85e3",
        "indicator--559227d6-7891-4ac8-a346-2824bad38fef",
        "indicator--9885c9b1-9f27-4a41-9c8f-38272be5852f",
        "indicator--11df5009-dcde-4205-8536-3bd75db34eca",
        "indicator--90b9c24d-6fce-484d-b622-287e5a792688",
        "indicator--7229f2bd-6ff9-4a8d-9c3c-b0f3c20953a7",
        "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
        "indicator--b8c31255-eca5-45ff-955a-26034e9f02d5",
        "indicator--27941a85-e92c-4cb0-946d-2ed351286054",
        "indicator--6b3ccc9f-b0b7-4352-a725-84d4458b898b",
        "indicator--7aaf61c5-c4f5-454d-bab7-6cf5c152c621",
        "indicator--8728196c-7a69-437a-8976-460063c903dd",
        "indicator--8dfee77e-4063-4ab7-9a72-097c4a1fdb8f",
        "indicator--a3c395ac-db85-4b3a-9e7d-52cf20536227",
        "indicator--99a13c9f-e64f-4302-a151-21a6fc8361c6",
        "indicator--f728a434-77b5-445c-b165-6aefc4129f89",
        "indicator--39f5860b-1363-4c6e-9c3c-463604d82a9d",
        "indicator--4870cdc2-2f56-4f49-8587-125d92e428f8",
        "indicator--e16e7c44-0adf-4345-987c-b16fb2ec014d",
        "indicator--6912e978-60e6-43a4-9ca0-a5d778b48cc9",
        "indicator--e712b1ae-a0d2-4043-9672-2e0aab0a41c9",
        "indicator--865aa813-c684-4227-8145-b6c53472478d",
        "indicator--9863086f-7765-4c64-a98e-41310d2e1982",
        "indicator--908c080b-fa15-4609-901c-a0d67b8e769f",
        "indicator--cc709ada-12b9-4c72-805e-56867cb5fed7",
        "indicator--d4f54fd0-49b1-4392-a6b6-19f925cd9f58",
        "indicator--18d5b803-a3fa-422b-b6c1-530c19c10436",
        "indicator--788e1e14-6fe0-4aae-9c18-86cbb7f2474b",
        "indicator--cf2a72b5-c232-46d1-8c29-e9679830df33",
        "indicator--40afe9d5-1a1c-45db-b090-3d662f2e9578",
        "indicator--e43f50ba-18ac-47c9-a339-7ceb18fdd8bf",
        "indicator--e044d4e1-bec8-4a3e-9081-925087295410",
        "indicator--4243b226-464a-453a-b139-04104fd9b50a",
        "indicator--b8339c72-f64c-49fb-a141-301a9a6770b7",
        "indicator--23612ece-de51-47c0-93f7-5aaf3d5f97d0",
        "indicator--526182cd-09d2-4b56-8a5f-cfc18b4329a4",
        "indicator--0b1f330f-5f83-46b3-8f03-d524d7bc3f1f",
        "indicator--d0bec879-9da1-408a-bdde-9ec9e0b89f28",
        "indicator--13714d57-791f-47a1-89cd-55e14b371818",
        "indicator--7d225213-bdcb-4e2c-9f61-bd9fd063126a",
        "indicator--c6877959-f461-4748-bc7f-004bc68f8a76",
        "indicator--6cb46c0b-266b-40a5-a47a-6b0063060198",
        "indicator--fa383c44-4722-446c-9f09-295ceda0486b",
        "indicator--6388b17c-e9af-426b-9ad5-327b5021b6b5",
        "indicator--22051bd6-75d3-4aa5-a522-0b491386e66a",
        "indicator--45cf0bf6-9ea1-4e57-a9cc-077a22a73722",
        "indicator--b0a88399-2294-488d-9d6a-a90b556c9b29",
        "indicator--6a2ad340-a226-4286-a82f-51ca31012993",
        "indicator--41b18ad1-9a42-4237-a000-abfe417fdeb1",
        "indicator--bb62b251-67cf-482f-be76-475d777ca0fb",
        "indicator--39bfb757-c089-4cc9-a42a-b90eeb5c3cc1",
        "indicator--d3077520-7af0-4ecd-bb7f-56045b78fc90",
        "indicator--20733a24-f560-445c-8a05-cb85be93a9c7",
        "indicator--be976e5c-7f61-4ed2-a6c0-110130d4cb95",
        "indicator--cfab599e-ed24-4d3e-b944-f9d7d8172b84",
        "indicator--85436ae5-20b2-4863-9aee-3ef82b4955c4",
        "indicator--b48bff72-45e4-460b-b663-744c0dcab0a6",
        "indicator--7ac3e886-c209-476c-bd17-4f18786e99a4",
        "indicator--e1ef4e6f-891c-4cb0-904e-b981d91f2439",
        "indicator--24609302-afd6-4ec2-983c-460d2e561599",
        "indicator--85edcc56-17ca-40ad-9c28-63e1e23da451",
        "indicator--98fbd9ae-67d2-4adc-9869-7cfc93a5acc2",
        "indicator--2505a098-300b-4d24-920a-048ca2c1439a",
        "indicator--10b7b6d7-7797-4fbb-8697-96c0c086c23e",
        "indicator--6f572be5-6d33-4ab2-842d-522095f3975e",
        "indicator--c4a70e8f-d027-4c40-ad9f-45ecc7ba8f03",
        "indicator--94ec991b-24db-48bc-8a11-348d95a73f2b",
        "indicator--b7602daf-b3f5-4565-8686-c6ce7e9ca68d",
        "indicator--1ae6ba84-f458-46ba-a55e-6644c3474c9b",
        "indicator--7778318d-9605-473d-a37d-0d8aa916f2c2",
        "indicator--9e8d7a25-8d5d-4179-8bd2-4c8ab9c27082",
        "indicator--e5d2739a-8111-4d53-bfd3-8d8978d54a5c",
        "indicator--8fe26c43-3c3f-4218-946e-4a30c8aef002",
        "indicator--8e1cfcd5-7ae1-4fd6-8700-4c444a099855",
        "indicator--d0211642-c6cd-4565-8f1e-c62224662245",
        "indicator--7bd474ad-605f-48d8-a536-7d8c7fe2a861",
        "indicator--170a13e6-9053-4572-b2e9-a96c08a3ffb2",
        "indicator--b8864b0a-2e7b-4cb2-963c-5e5d219d7fb2",
        "indicator--1d8ae1e0-01fe-46fe-8f5d-43173c06f16a",
        "indicator--ff23ddcf-86de-42bf-99f8-a0000f4fbf54",
        "indicator--61141ba2-ce23-4802-852f-e026b312f911",
        "indicator--b4bf01d0-acc8-4a9e-84e3-ac7a709ad8f1",
        "indicator--a3a2c154-7168-4b76-b650-c630ba4f8cfc",
        "indicator--a660f61f-b8d4-4ce9-a1f8-16deb3114a36",
        "indicator--17582faf-9af7-4b65-984b-b1cd6e18ae65",
        "indicator--d14e47c2-9203-4b88-99b9-210cfe5ae7a1",
        "indicator--e338e350-3f7f-49d5-bd16-2cfec2ea8c8a",
        "indicator--142d4952-27e4-4641-b045-d19b8a1e5313",
        "indicator--e4952f61-f6b3-4052-a7c3-6b2596230f90",
        "indicator--b0dd12b6-ee30-448e-a8b0-2814879121ad",
        "indicator--0db0a101-b408-4699-a799-8305fb23e7dd",
        "indicator--8b88b331-3b45-4e0e-91fd-41713ac6831d",
        "indicator--4224ba3c-00a2-4022-9735-869694f3fbd1",
        "indicator--9a56e364-d232-4b73-affb-356916e00eca",
        "indicator--acba6f87-3a1f-4137-b859-9e05df4f6924",
        "indicator--cb592ed9-640a-4f5a-b4ee-f5a8925bef9e",
        "indicator--3b0741da-748a-439a-bcdd-38e1660e51de",
        "indicator--d6d09943-961e-4c6a-86d6-6e9698d988d7",
        "indicator--0c10f81c-470b-43a1-853e-6ab780b2e20c",
        "indicator--06f165f0-69c4-48b9-a07e-ddfc32d112c3",
        "indicator--dacf72af-39d5-4d1b-ba90-2adadd490217",
        "indicator--65eea94f-ef4e-4413-a009-ef0606d8721e",
        "indicator--6e87ce75-b466-429e-8b07-12f04391d996",
        "indicator--79252f26-81ac-4796-8be9-0cc86ed19d53",
        "indicator--553cc2da-e52a-4c8f-b855-a222b2ed0eb4",
        "indicator--67c9a5f8-b347-4d52-8f6d-b43e59f1fd82",
        "indicator--bd579c42-2e22-4d01-9baf-46ff83f8530a",
        "indicator--9621ff4d-2b89-4e5f-9a79-7d9b2fc8a287",
        "indicator--83e8a9f6-80d3-4e4b-84af-e03bf5ffe3a0",
        "indicator--aa5a0c8f-e8db-4089-a003-1bb514452c0b",
        "indicator--c676dfb8-c399-497d-8330-a215b9664d37",
        "indicator--36f2e2da-37c0-4ae5-a06d-68e2d1254e96",
        "indicator--37e67c93-4350-4962-adf9-e96957a0c68f",
        "indicator--d1d5f81e-9e17-4208-8b8a-9c307819e48e",
        "indicator--3a563456-4155-430f-82b3-15c3866e1aad",
        "indicator--bf6cb5d9-87e8-4541-8f03-64f490a9294a",
        "indicator--21214d56-f488-479d-bd4f-5104d5fc8289",
        "indicator--ca18463d-d5b9-4d2f-82b2-bede3b0429eb",
        "indicator--45050564-9fa7-41c0-8045-ed960b9056f1",
        "indicator--632b18c7-a1b7-42ce-9144-b3d3c8d8b79a",
        "indicator--fbc6f133-1d4e-46f1-8989-4b247d558641",
        "indicator--db10d25c-509f-4b14-85cb-bc415c0b6217",
        "indicator--06146909-4fbc-446d-8527-ff74c7c59977",
        "indicator--820a9062-554a-43c7-921c-d289fe84c356",
        "indicator--a9b79176-8859-42de-aea3-b3afe98f9245",
        "indicator--a46faf9c-1f1a-44bf-a609-5974d35b454c",
        "indicator--d898b5a4-e90a-4019-9e54-46781252e9ad",
        "indicator--55ef1665-28dd-422c-aa98-7cddf52f31f2",
        "indicator--30d1c40c-a3be-42ce-808b-f7fd506db4bf",
        "indicator--3ffa42cb-536b-4968-92fc-250839c07eb7",
        "indicator--ce76b180-cdf3-489f-b4cf-4c7f199f57b0",
        "indicator--53f6c7d4-9cd4-4111-b468-70ee0dc20dd6",
        "indicator--fac62ffe-5ce5-48ce-90c1-888cd87a9845",
        "indicator--37f5edae-2fbf-4c87-baae-5bb06012c5ba",
        "indicator--e6ee1dbf-dfde-4437-86d4-8bcf22b4b68a",
        "indicator--1c983802-58ad-415b-a6ca-2d2e7548fd3e",
        "indicator--8beb7599-ba7e-465b-925e-e18d694c8e1b",
        "indicator--c5c4f6c8-c988-487f-982f-b16b90cfcb5b",
        "indicator--0ae7faeb-8737-46b6-aa5f-ee4544e33652",
        "indicator--0b2b50f9-f48d-4ad0-a834-8e43f2e490b3",
        "indicator--8e204c17-e91a-4f35-8ba2-8dcb731c59a6",
        "indicator--9ea370a7-88b2-44f7-b4c7-c2e26a434450",
        "indicator--8ef1ac3a-34ba-48eb-acbc-44fa293a2de1",
        "indicator--77362598-031c-4b92-878a-042151cfbd48",
        "indicator--aa777e3e-2d3c-4812-a8d0-4a222ba6b456",
        "indicator--d02f7028-e9b4-491d-9aa8-ed2987a326f7",
        "indicator--e062c7cb-e32e-4604-8f3e-f1f5a73cb2bc",
        "indicator--6592ab0d-aeed-4d7c-9242-36d68c936f87",
        "indicator--ade54173-077c-4741-8f4c-3ee512b20fff",
        "indicator--199e1d95-c02e-48ea-b3be-b4525a964eec",
        "indicator--131e7782-8ef3-47d2-b00a-f3b8bc8e018d",
        "indicator--78f9aaa7-4e98-4086-a159-f171659e7135",
        "indicator--c55bc643-818b-4fa7-a9c7-92b56c88c212",
        "indicator--270ba5bb-25a9-4ceb-974e-22764faf8b30",
        "indicator--970f53c2-7b3e-4637-8a73-48ed05d4cabb",
        "indicator--43030a83-ab1c-4499-805e-f61a45c0c4d5",
        "indicator--fd891d94-55bf-45d5-b2d4-ebd0fdf30973",
        "indicator--71472ab1-19da-41c6-a10f-f331f3b8c6cc",
        "indicator--c09f6f5b-d6f2-4324-b7e8-0fe99055bb99",
        "indicator--d1b69e28-e0fd-443e-9643-d536cb5cc75f",
        "indicator--766028ae-a34f-4543-9fbf-ed6517a18987",
        "indicator--0793acd2-c4e4-4047-a9e3-358238a4766a",
        "indicator--d80ea41d-7391-4f22-acdf-3eba7a0cd3fc",
        "indicator--fe8fb1aa-d686-414a-9cd4-3b087800d764",
        "indicator--eb70823d-a094-4ff0-8b0b-6804811efbf1",
        "indicator--88bf42ca-f625-4011-8864-ae36de70fdfb",
        "indicator--0ffee85a-ee26-477a-aa79-e9e64ce920c9",
        "indicator--2f15c0b2-1ca7-43d5-bc4f-0a996c78310e",
        "indicator--deec83ab-fc6c-4b2f-af7d-7aaa6a179bee",
        "indicator--a4246ecf-bdc0-4109-bc55-02e0b46459e5",
        "indicator--29345f21-d527-4aca-bcbc-ff797a4f7ae7",
        "indicator--da7bdcd2-f5ed-46a3-8bca-1a1691c13082",
        "indicator--d439117a-be11-445f-ae74-f0787df13bc8",
        "indicator--dcc2c3b3-49f7-4404-91a5-8ebd2b0869c6",
        "indicator--29620663-efab-4f66-8170-45c6002b21ae",
        "indicator--2c95d3a5-7224-4dc5-b4cb-99b9c7f79caa",
        "indicator--96afcd90-2090-4ff0-9a3b-207a55075e50",
        "indicator--168cf1eb-f736-4a0e-b1c7-a8650383f172",
        "indicator--6408d2fe-59a7-43cf-80dc-241398150576",
        "indicator--b4889467-5f9d-4eb8-9cbd-4083bce3b516",
        "indicator--b18579c3-eb08-42db-bae2-55d5bdec871a",
        "indicator--d6a8a2da-344f-4a4c-bc57-783c99bbca73",
        "indicator--84ae8ca8-ff8c-4561-9593-20dd230dac1c",
        "indicator--e0b812a2-03cc-42b6-85d5-21f2238ad41a",
        "indicator--e7a66f59-7564-4b15-b818-2f78c61a5747",
        "indicator--efaa75a6-9aad-4354-90ed-64f50f5774e0",
        "indicator--38e1a339-0488-4053-9421-850483ff1e1e",
        "indicator--227a9145-2471-42bf-a6d0-be0ae5a7c82b",
        "indicator--12f366f5-3a5f-40af-8c66-3fcadbcc9e6e",
        "indicator--f6968214-4086-42a0-b1d2-6d27957c3d07",
        "indicator--1a053b2c-81cd-4010-b9f9-c9dad1967385",
        "indicator--00753a6c-26b3-403e-a9bd-3ee94ae53c53",
        "indicator--da587325-269f-4116-8f7b-75281b560267",
        "indicator--09a86d2f-f399-4db7-b14c-4883e5f577a4",
        "indicator--4e21a029-7603-403a-9bf2-a4b79d65eaf5",
        "indicator--4b49196e-7b4e-4c74-bc4e-52448b804f8c",
        "indicator--1691ba26-a255-4d87-9b32-f25363186abd",
        "indicator--9ff87776-4108-420a-a821-4ec539b52289",
        "indicator--a956a6f7-ea2a-417e-b59d-d038c02e05fa",
        "indicator--9a5dbb15-92fc-43de-b5e4-4662abda4939",
        "indicator--a7b13c8e-2af9-41ae-ab62-6b18e5608fab",
        "indicator--4549dd28-f3c4-425b-b4f7-21e308309440",
        "indicator--6b159607-f629-4c32-aa4e-1ba968a950ea",
        "indicator--5e31d29f-5355-4000-9f4d-87c6191c9d35",
        "indicator--90bbff36-ea0c-4b16-a8df-73d4461231a4",
        "indicator--594bea72-c99f-4692-a249-4ba42bba6d32",
        "indicator--85368a59-4d63-48d9-a1e3-b65b7cb76bd0",
        "indicator--e2d502bb-1fb9-4410-ae9b-62c62781c986",
        "indicator--7d9aeb4d-2377-4b95-a996-d02d2dd83c38",
        "indicator--f640bf6c-b12c-46bd-a500-4d1cbf62d9b1",
        "indicator--e4632b74-77f2-4db9-beca-10a91441603f",
        "indicator--f79441e6-873d-4448-b141-6162a152b56c",
        "indicator--ccd16eec-41f5-4de5-adca-2fc0b25ce8ad",
        "indicator--56968bf8-e3a2-4a9d-bf7a-476f4db45f21",
        "indicator--77765037-2a3e-4e6f-ba25-9d0ec843b107",
        "indicator--13b4fda0-522a-46aa-875f-d38173d12119",
        "indicator--581bc00a-1a5d-4421-86a8-23eb17898f1c",
        "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
        "indicator--a5cc8906-0702-4edc-89f8-0c84ed2ca7eb",
        "indicator--7bb558a1-b9a9-4f84-ba46-34daa3cb0cb7",
        "indicator--df33fe35-6941-4863-809f-2aa2072127bb",
        "indicator--3844d00c-d879-4171-89af-92a10129c144",
        "indicator--e62da9a7-40d0-454d-a6b2-2c37805d27b1",
        "indicator--4a329022-3943-4b13-a2d8-56ca7829920a",
        "indicator--bbe08ae0-e6fd-47d2-992c-a0304d2aa188",
        "indicator--3233008b-e615-49f9-a913-a851c8e045d0",
        "indicator--21423ac1-e0e6-4081-9d97-bab8d7953f67",
        "indicator--377658de-75ab-4bfb-a4c8-b001f1344fb6",
        "indicator--5d5657c6-d75b-4cd4-bb08-71aa6a5e33e9",
        "indicator--25533590-6b86-41dd-8ea8-27daf890ddde",
        "indicator--b960f8d4-d26b-4348-8f10-305395dfd531",
        "indicator--e48ad00b-087f-47fd-a0d5-6ba6856f4bfc",
        "indicator--96404cf8-4a3b-4772-9539-fcebc848c9b8",
        "indicator--50878037-694c-4728-bdca-f49bc6a7d507",
        "indicator--ff490523-79b0-48c9-9b69-e5c1129e308a",
        "indicator--de1cb447-5945-4ddd-94c6-6170bf0a4226",
        "indicator--adf65fec-35f0-40e3-80c0-8d9a354f761f",
        "indicator--edd95a2b-2840-4ed9-a343-8d889f76643a",
        "indicator--d390289b-0993-4ff9-b36f-215aa3cba74a",
        "indicator--506fda16-4386-444b-87a1-32533aee0f29",
        "indicator--13c7dbe2-ddab-4eb0-8058-3f7d9651aa8f",
        "indicator--37c8446e-4b37-492c-95de-5c21a8c16f72",
        "indicator--17c286e1-c7d0-4dca-bed2-01db6b741f1d",
        "indicator--bb3d7c6b-3e19-4867-8071-521f675003cc",
        "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
        "indicator--505c024b-5378-47c7-8893-7bb14b16faeb",
        "indicator--8d6218e5-814d-4bad-b6a5-f6b8d178475c",
        "indicator--40bd01e0-afa7-42de-ad06-fdc26292a817",
        "indicator--99709ffd-100d-45e3-becb-170aef59b4eb",
        "indicator--82dda49b-5aa1-4120-bf24-052458ac1169",
        "indicator--fdf6e9a6-d421-4573-ab6a-7ace63137a23",
        "indicator--19c79e24-29d7-4cc7-8ee5-e0bee4541319",
        "indicator--de7d7774-addf-4748-ac71-eac57fba962b",
        "indicator--e3d0cb46-d34f-4a26-9d3b-08fcf22b4c8d",
        "indicator--bb4ff5bf-f781-4e5c-9d78-0236b13b586b",
        "indicator--600be6a4-4c0c-4213-a532-8494abc4c099",
        "indicator--19c19658-3848-4f2b-a598-9ea1d355ea0f",
        "indicator--d12455f3-4034-45a7-8754-218e065bbe12",
        "indicator--8cac8842-3f04-41ba-9d44-7d1fa99539d8",
        "indicator--fc99becc-59f9-426e-80c0-2de8311be3fe",
        "indicator--d6c74618-9aa2-42cf-b4b0-bd6629278bb3",
        "indicator--f3d24905-4623-4a8e-bf50-f9b402db272b",
        "indicator--7916ac8e-cf57-4d13-8afa-8e5da361bcc8",
        "indicator--eba188c9-2c5c-4880-83cc-56239497a9fc",
        "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
        "indicator--88dd206c-0548-43e5-979a-970f730a4c72",
        "indicator--4bc0c806-5d8b-406a-ab6e-68a45b8ce76f",
        "indicator--a02d1d24-1633-4a31-acbd-0244b8897f1f",
        "indicator--5755ed62-f456-4229-b998-8c83e2ef0e5f",
        "indicator--88272d00-ffbe-40cb-ba36-9db511b27461",
        "indicator--9de347db-9131-4d73-b6ea-2a8c762e9254",
        "indicator--57bfcdb2-c12b-4591-ae6f-978422d67588",
        "indicator--7bea7f73-7a20-4984-a820-3f7377458f38",
        "indicator--d3a874f8-de09-4ff5-b414-e68512bc398d",
        "indicator--9956f8dd-40ef-4352-bacf-b891c5ff3fe9",
        "indicator--bbd09e98-f551-4024-8ecc-0f210d705cbf",
        "indicator--bc72ffe8-b04c-47d0-a2ae-b0701d8334d4",
        "indicator--bcb01a81-9266-4a55-8bd6-cab3404bbbc9",
        "indicator--5da17bf9-2f26-4a3e-bf68-b39445398bdc",
        "indicator--7fb01dc8-4023-4d2d-a4ce-ed1d78338402",
        "indicator--320307c7-cbc9-4ad9-9be0-c16d8926544b",
        "indicator--4f5b00c3-dcc4-442b-8354-178a0e99d384",
        "indicator--916a0893-8cdb-4596-aa40-155a376efcbe",
        "indicator--b8b2e9d8-ac57-41c9-a308-b89afaccf79d",
        "indicator--253828da-5683-40bc-987d-da6523df9684",
        "indicator--29b21615-c78e-43ec-8395-d07dff93e75b",
        "indicator--68ebda31-294a-4189-a0e4-4a32f4e72040",
        "indicator--90d641f6-ba6d-4499-8ae1-5413036fc060",
        "indicator--fc81e133-4cf8-4141-a5cb-b5664a15df0b",
        "indicator--196ab323-794b-4d1f-b357-e71ddd31b9f1",
        "indicator--9f5619ee-66be-4923-8e2d-6716bca34431",
        "indicator--dae3c871-b39f-45e7-9477-3535292d1cc1",
        "indicator--1fceb5d5-2c22-4f8b-99c3-766b27eb464c",
        "indicator--9e6d12ba-42fa-4d89-9a13-9e7518af845a",
        "indicator--d2d9c6b2-f26d-4430-a232-83fea541a5a5",
        "indicator--63bba9b8-41a4-4013-92d0-65fc6142ef00",
        "indicator--5d2bdef6-2e62-4183-b734-f5ddd08b0482",
        "indicator--a9c6725c-a5cc-494a-ba8b-36ad3e5d7355",
        "indicator--c89002b7-0fbe-4b4d-9ace-91e6f8d6e3f5",
        "indicator--fb2f12ea-6a76-4bde-ad8d-e0287b03e3a5",
        "indicator--f05308ba-132e-4bd3-8822-28e4e6512c5a",
        "indicator--a65312aa-fe42-4a91-a7cd-4a4e5e661b42",
        "indicator--cf9d5ab7-7309-4349-bf65-9d548a598296",
        "indicator--9e6677d0-be36-4e8e-9389-932fae7b5832",
        "indicator--4007b76c-590a-4777-9c3b-d9012b55e451",
        "indicator--c331bbdd-4338-4b6d-8368-d25f94a1d316",
        "indicator--88187d56-0e33-45d7-989d-bd12aa874547",
        "indicator--43076200-cf54-4af6-9739-58e14037cc6a",
        "indicator--f8f3e1b7-88a1-4adf-a1af-224027e479b2",
        "indicator--58503fd2-ccc0-4d81-a01d-4ceb48eaee09",
        "indicator--6adb11bb-ff88-4a9c-a46a-4752fc84d77b",
        "indicator--222dd31c-2066-490d-9bc9-8e893247e03d",
        "indicator--f48c83aa-6b1c-4a25-988e-b2f24415c1fd",
        "indicator--0d03c96f-8737-4428-9d58-d7b04d14819a",
        "indicator--095397e1-982a-44a6-8a24-d908a9112742",
        "indicator--c0991963-9053-4313-83b4-c2fff060d14f",
        "indicator--15ebedc5-67bf-483a-b9fe-b132d32f7ebe",
        "indicator--6499bdf2-6092-44d0-a1e2-01c397e05235",
        "indicator--9a394da5-de57-4993-8e88-c0456aadf089",
        "indicator--9aeaff7f-bfa8-4b0d-be17-3de96fc707b9",
        "indicator--0349638d-26d3-4efc-844c-30ab40b0002c",
        "indicator--fea857de-7472-4959-b811-b85473dc70c3",
        "indicator--a5a8a12e-6a83-48b4-b17a-3bb28e99882a",
        "indicator--178aa0ac-7c49-4033-97fa-ebc5113bc407",
        "indicator--f492fed1-5f1d-4938-8a6d-737b7c9d2c4f",
        "indicator--b2afd44d-89ec-4abb-b345-bf2a686c8c63",
        "indicator--f3fbde17-376f-4d6c-9a93-da2417e14e17",
        "indicator--12e0c679-7f5d-4b14-88ef-d5649c01ee21",
        "indicator--8ee6a75d-23d1-41b1-ad36-f9d83380f202",
        "indicator--2b5f87eb-10df-4157-aa18-f09f5f6e8584",
        "indicator--e46ff6eb-f186-4679-9b80-016d998931fe",
        "indicator--da976dfc-2dde-4143-baf2-b777e3fb5197",
        "indicator--bd097c0c-13d9-4e89-a993-4c7425871690",
        "indicator--89b61e60-60f3-4001-892c-0a49c9f24278",
        "indicator--f576342c-9a40-4adf-b306-6bb1532c641a",
        "indicator--82a0ec13-c874-4549-8024-3e14f40975f7",
        "indicator--32d00821-8f68-4173-a775-740ebedda8b6",
        "indicator--1c75a434-7397-4925-8a99-975a64d308cb",
        "indicator--1a4b71d9-8d8b-4fe6-aa7b-5d06959684a8",
        "indicator--7084af97-f8e7-4d3b-92e9-3e88170e18ff",
        "indicator--03b19e66-1dff-4fd0-b65f-adc4ac20ad10",
        "indicator--81bd6631-6d15-48e5-a8d3-7800f6199752",
        "indicator--7236d211-5b63-431a-b088-79f02ad4e7eb",
        "indicator--008e660c-7260-4723-8365-f13b0ba5426a",
        "indicator--95301305-ea18-4d33-9af8-ff0656222a07",
        "indicator--a467a08e-c709-4b20-8684-c4a7fb531227",
        "indicator--d3bbd81b-8093-46bc-9212-8a0de5d0db01",
        "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
        "indicator--3a450a7d-21ad-4bde-920a-6ea273feb5cd",
        "indicator--4652cee6-9741-40bf-8960-fa13a3355347",
        "indicator--958f359f-3fb2-4ba2-a742-ab314ccb4e47",
        "indicator--1932d63a-25d1-4dcc-9e45-9d514cd0be4a",
        "indicator--38451dea-989a-4149-ba74-9d1335796921",
        "indicator--164127fb-a74d-4933-a84b-6bfda8914636",
        "indicator--854bb137-23f9-43fd-9005-ba406e7b4be2",
        "indicator--33a68fa6-e9de-4e25-971b-48e547f32d57",
        "indicator--3111aa2b-0134-440d-9544-99023276fc68",
        "indicator--d2e86bda-510e-4e01-bbd3-50f05af1660d",
        "indicator--7c3bf6e6-2c85-4273-a13a-cc49db5a19cb",
        "indicator--4065b070-26d2-404e-a4c4-7d99fdb28342",
        "indicator--54ea3de1-bb06-4b55-b1af-bc215e825194",
        "indicator--5280637d-f44d-425e-a7a8-7a1a53451cc6",
        "indicator--4843d525-fcaf-43ec-a271-0f20ffb0c42f",
        "indicator--8067bf73-c7d0-4a7b-ab16-836a20eb3902",
        "indicator--b1158292-5590-4205-bfaf-5c123c090da2",
        "indicator--128923a3-0435-4cad-acba-52954a3f7c61",
        "indicator--78a974a1-84fd-4a91-bef2-cbbe63544c23",
        "indicator--a67d44cc-cde4-49ed-9c10-24301ceaab0a",
        "indicator--949d3df9-0dac-4085-b87a-fea898e403f0",
        "indicator--53449598-c98c-4301-a106-d8ae08a877b5",
        "indicator--1c49fbae-e91d-4161-974d-8fa650395dcd",
        "indicator--ee828333-c1c3-4212-9b6a-cb05249fa823",
        "indicator--e5739a89-e847-40f2-b08d-f1363f614038",
        "indicator--8dc7106b-6fc7-4635-b5b4-a86c41d0e32f",
        "indicator--7688fcaa-e97c-4d80-87bf-c5be53d7e1af",
        "indicator--737c298e-b791-4da6-b1bc-494a23a45b76",
        "indicator--19cc3782-2e09-4660-ae62-6f70698b922f",
        "indicator--1fffff24-40b0-4707-ac3a-b619faeb94f8",
        "indicator--12e87400-30ac-4984-81cf-df2f66913043",
        "indicator--aad757f3-9f2f-485a-b6e4-8d91c34fac0c",
        "indicator--5765fedc-e381-420c-b997-792cc870b2e0",
        "indicator--ab162248-41f8-4759-aeaf-c016087a8d26",
        "indicator--e7deabfe-869c-4e41-ab7c-ddecfc5bf6ff",
        "indicator--0933ac42-0a52-445e-826a-925ac6ac7d32",
        "indicator--6a230c3f-5a5f-40af-b01c-3ba8641faa23",
        "indicator--4f5f2eb2-22ff-43f8-82c6-ed3c45df5b22",
        "indicator--ca34ab5b-b319-4d9a-8364-8e60202de21c",
        "indicator--54474002-cd9c-4166-a63c-be379e16e22c",
        "indicator--8db3e9c9-2bea-4f9a-b168-c213daa66222",
        "indicator--7dd6d80f-c28c-44fd-ae51-24a89748ff7a",
        "indicator--9e1aeace-1ad7-4f78-830e-298bf455d4b2",
        "indicator--84af225d-9ef8-4b82-bb41-676ce463141b",
        "indicator--237e1bc9-bb03-4680-9717-c55ac98b8354",
        "indicator--cbe6e605-06ac-4fe6-b4c8-caa8d04496f8",
        "indicator--46f8e88e-9cb1-4c7f-a227-cc8a6d646ca5",
        "indicator--cd524bf6-4f52-428e-b863-7f7bb048a559",
        "indicator--c13da072-6565-4ead-9d69-e44ad91e1854",
        "indicator--b8de0a91-3a7e-4dfe-b646-769de1aeb66b",
        "indicator--f1c73bf6-310f-4985-ae58-144547d91578",
        "indicator--2c191e3d-05f8-4a70-b178-4ca3cc6c71c9",
        "indicator--b3925b46-bfbe-4a49-a661-3fa3a393bc93",
        "indicator--f2e1c297-7fb5-466c-a994-4ac4ee7178bd",
        "indicator--e4255cdc-bd7d-4c28-bb1d-af4cf127d6ef",
        "indicator--398366fd-2bf1-4b93-aed7-767e22c1d733",
        "indicator--43ce367b-f678-468c-a5b9-499c26a8157c",
        "indicator--2e2cd62e-3d3b-4c70-a8b0-b08999c30d0a",
        "indicator--536366f5-533f-48e3-9696-da5e6170c275",
        "indicator--f01b48ad-32a1-4a77-ab41-d7055c4d015a",
        "indicator--60818349-d469-4c5f-98b2-7465db58f20c",
        "indicator--46627576-84cd-4786-9c32-daab59e8e57d",
        "indicator--94b91253-23d2-48bd-a05f-f9651e2cc163",
        "indicator--9d487fca-d9ee-435d-ace6-f6d3c27ea88e",
        "indicator--68016460-722c-44e2-84b2-a8f2b9844860",
        "indicator--2bd04e6d-33e7-43bb-a069-b4437743e0a8",
        "indicator--fd6d3eac-e257-4ae3-9eb4-3b38f3e73dbe",
        "indicator--d720fe87-37b8-40bd-a5f0-58f51ef0110d",
        "indicator--adcce9ed-1de2-46da-b0a7-d743dd8ba430",
        "indicator--aff37510-7dad-4687-9eb0-a9d0987a432f",
        "indicator--5a36ac55-41e7-475c-a731-9e383478d466",
        "indicator--f90c23b4-e47a-4a2e-b9fa-48a7396d3e1c",
        "indicator--b08291ec-2cba-43e8-9301-9bd1b414f2c8",
        "indicator--4cfa0d95-35c1-4254-bbe6-73f40f911ea2",
        "indicator--a6a170ee-9931-46f2-95a4-40c0382b36e3",
        "indicator--13198fbb-432a-4378-bfc7-29405c24cb6a",
        "indicator--53b35bf6-11cd-4285-93e2-144dcf803672",
        "indicator--ac59adf1-9a48-4e61-8946-be96ad55166e",
        "indicator--b3b507c9-65c2-4f35-9721-5cf4094d5905",
        "indicator--7febe249-832a-4a5b-b171-9f5aaf673097",
        "indicator--91ae114b-8ca1-4a7c-85b3-3bb9e1e0efc0",
        "indicator--74884359-f99c-417f-8079-2c6950255370",
        "indicator--4ab0f263-0fef-4155-932a-1632ba2dcf97",
        "indicator--45f18fea-60e6-4248-9aea-b584b4816319",
        "indicator--fc50d238-ea43-436e-94b2-18482c726358",
        "indicator--7ffc6e27-83c1-465a-9e0e-42f07a43f877",
        "indicator--4ec03525-9c49-4e11-a521-73de539dcced",
        "indicator--7620aa2b-b280-47cb-a687-39404bd2f48c",
        "indicator--8f623826-33da-48eb-be51-b1edc1dff8f8",
        "indicator--1134b6ec-9982-40d7-b463-29e74bfecd04",
        "indicator--066e8bdd-c4f1-4982-bc88-b0dadcf576d6",
        "indicator--09bb9485-e859-4b6a-9aac-4020465b7bf4",
        "indicator--b5068743-f98c-4bb0-ba40-c6aae7e6ba42",
        "indicator--436d91cf-1320-47bc-86c0-bc9b00b90ef8",
        "indicator--c1261704-0009-4127-92a5-a9bfc9c5ef1b",
        "indicator--e721ad00-303e-4943-abe1-a9b9211cd089",
        "indicator--bbe9e1a0-ae0e-4835-8311-56a1f5f2e588",
        "indicator--e1b31de5-e9d0-4d8d-9741-4f175950d88c",
        "indicator--aa6cb11e-ab33-4f0c-8fc2-a4ff42741ac8",
        "indicator--2ca75fb2-e7d5-4537-8237-aeb149981d9e",
        "indicator--2ca0206d-852a-4ddb-b316-d197fa8e40cf",
        "indicator--11588082-e885-480c-92cd-5826ce52871b",
        "indicator--110c1e7a-9038-4878-ae64-f75795493fdd",
        "indicator--d1b8f976-4c10-45ff-a65e-fe1351b5298a",
        "indicator--f365d29b-da72-4f19-99ac-a51b9bcdcf37",
        "indicator--803668c3-f5aa-4b6e-9d9b-4ce8351e6bcb",
        "indicator--c2edf3b5-a58a-445c-b156-4ee7eaa444b1",
        "indicator--b1c39a75-97bb-404d-88ad-d794975f4039",
        "indicator--e4087f08-ead8-4634-8435-c48ff97e01fb",
        "indicator--dfb606d6-d339-44a8-86d4-75b541017dbf",
        "indicator--1396fcf5-a3b4-45ef-9a69-51e880e994e1",
        "indicator--7bb64dc1-f758-4006-9477-73ba2153cd17",
        "indicator--5fae13dd-05ff-4ad4-9eca-4018783b72bb",
        "indicator--51ddb591-92e7-427a-acc0-a989b56c957b",
        "indicator--41251f73-c685-4030-91a0-9b31a99485b9",
        "indicator--9c9fd80c-2193-4ebf-bd19-37726961653b",
        "indicator--3bc25380-ea6f-4564-813c-e6bbca973c36",
        "indicator--731bdb5c-9b99-4fa8-a378-73d7cd721c84",
        "indicator--8edd2aac-4b91-4b02-b081-9b7ded94d7e7",
        "indicator--5e78ed2e-8ae4-4be1-b275-097fc3dd5b9c",
        "indicator--109dbac5-dbe0-4e55-845a-da24ed8422ec",
        "indicator--19a174a7-f5c4-48a4-a78e-89558f36519d",
        "indicator--74b70563-02cd-41c4-ab24-7c957bbac0ef",
        "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
        "indicator--8eab59b0-51aa-4d07-ae8a-be1ce3e09da8",
        "indicator--e0bf7e6c-01b7-4f0f-b931-b4867263d071",
        "indicator--0381d58a-c5ef-486d-a139-cc1c9f53ba93",
        "indicator--1e037645-95f7-4372-b89b-2ae7bd6e8af3",
        "indicator--a84c70d3-d520-4290-848a-ee3e0bb0f8c7",
        "indicator--e535b379-e62c-4c77-a1b6-0531fb529087",
        "indicator--5593d710-3abf-40d1-b5b0-227568c08c84",
        "indicator--5c561027-df47-4220-baaa-3f6a3b8de87f",
        "indicator--33e74a66-7223-4fdb-9e70-86a7a5b87796",
        "indicator--4238a030-9902-44e1-9b20-ab8f852243b7",
        "indicator--2a709429-711d-41c3-aeb4-88d85b2336cd",
        "indicator--d524de20-e8b8-4043-b1a9-fa6397867db4",
        "indicator--52853767-0579-4c34-ab00-1ad7d9afed84",
        "indicator--b0835c56-efa1-474a-b106-583d1e078fb1",
        "indicator--e94f1be8-c0fd-4313-9643-f5e131e75042",
        "indicator--6106cd1c-44e1-432e-a039-398dd3592073",
        "indicator--9b75d0b9-5229-4200-bd16-0deb2a202316",
        "indicator--a6389bb2-88b0-48f7-83f1-f8362b5b3d07",
        "indicator--5e5db6aa-0012-4fc6-9fca-758ab155d7fb",
        "indicator--60fa3c33-100d-47e8-a520-7e6aa7a4b007",
        "indicator--8693a98e-6c65-4a82-a86a-0f4a40fb146f",
        "indicator--15013f2c-9781-44f2-9d58-5beece3d36ef",
        "indicator--dc079bd3-847e-4b5c-a981-fc5b9cbdd94c",
        "indicator--6f786cb9-70a4-47eb-a3a4-0d6a761c6fe2",
        "indicator--db1329b7-2e14-4a8e-a68a-c60ba5107d00",
        "indicator--c9dcbb07-79f1-453d-8248-8d35904f64ad",
        "indicator--4c4c683a-518f-4dc2-99a6-e63b4617f343",
        "indicator--31467423-0728-447a-9d95-41757719f4d6",
        "indicator--640ebcde-ad1b-4654-96e6-141cd9d43d8f",
        "indicator--c12addf9-5a60-4ae0-b8e8-347be4262fd2",
        "indicator--617459d2-6f08-4614-9180-7dc5f727160f",
        "indicator--29560c19-d88f-4408-8291-f544f87d09a3",
        "indicator--3e1ea4cd-1a34-4f78-948e-c2fd8b24eb69",
        "indicator--cecffea4-91c6-4cea-a2c1-8c5416ace3ca",
        "indicator--a69132ed-4c88-4b36-bf47-43738cdfd00b",
        "indicator--644e3797-b71f-46c0-9b2b-669634a9ec9f",
        "indicator--3c2ae1dd-552e-40c9-8580-06054092b120",
        "indicator--c88b5002-0b7b-4d0d-b5f2-3319a5a0906f",
        "indicator--67a7682e-4093-4d2c-a7eb-e0300df34962",
        "indicator--7e0b2fd4-aa26-43b0-bf93-8d1396e9dfe1",
        "indicator--0fb05c68-0f49-4b51-a701-4c41e9bb3351",
        "indicator--ee9138be-47c3-4189-92e6-557e40855691",
        "indicator--15f20a79-1225-4330-ab36-8ec6b82f24d1",
        "indicator--f0e1988f-2902-4cd7-af5b-cd64e3efd2e4",
        "indicator--c715ccda-ee88-48f1-a000-9f2f96794c74",
        "indicator--04fea1e9-03de-4f8a-b35c-85e0903a7296",
        "indicator--4f743586-e7a1-4c70-a5f4-83b17fb3c7a9",
        "indicator--d5812f57-fa1f-4724-89ca-889d0a27cb58",
        "indicator--b7585de6-b86f-46db-ac4a-a04312f614ae",
        "indicator--61d314e1-2539-4de0-9250-10aeb3067170",
        "indicator--9bcb2f05-0c4d-4bc1-96d5-5d191d4dc5b2",
        "indicator--00920327-b599-428c-a027-56ed02955d99",
        "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
        "indicator--cd34d225-1e6a-4d1c-95be-4e4d596541ea",
        "indicator--457db42a-0424-4907-b039-46ebacdaebc2",
        "indicator--eef76060-ad83-4b20-93e4-3c27ff2c090c",
        "indicator--a902d64a-faac-4ffe-b152-d201b4f56b43",
        "indicator--4c590774-1287-49d7-a9e6-111714545876",
        "indicator--2686ae04-abe8-4e9a-b1e4-f717c1530aef",
        "indicator--116cd9c2-43ef-4ad9-abcf-ba0bc11dff70",
        "indicator--99b3ae11-e348-4a3b-a85f-3e8963a024df",
        "indicator--95ff4f15-9ef3-4454-834e-67f309826ceb",
        "indicator--9899701d-5591-4db8-97de-7523a3b54096",
        "indicator--4b6b9cd0-7cc0-4cd5-aedb-0902a76cef58",
        "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
        "indicator--76bb19c0-3352-4f15-b7be-223a8e2f57f9",
        "indicator--22a12a9d-0080-4e1a-909c-9db9b001c526",
        "indicator--95025079-06a8-4dcb-bb8f-0958e45f4737",
        "indicator--4695ab49-ae4f-4dcc-819f-50a2db823fe6",
        "indicator--fe4d56ce-8abd-4ba5-9149-8a28c02c4e05",
        "indicator--f4b9d443-8238-4f8a-bb24-9bdd9cd08188",
        "indicator--46716047-d6b8-4b44-9f5f-9b6441776a53",
        "indicator--b31fc539-340a-4f50-86ea-e8d6025df4de",
        "indicator--f4dfe12b-affc-4b32-b38c-07f4944feb5f",
        "indicator--8ab9b58f-d723-45ff-ba66-3faf2d6b6e54",
        "indicator--b9e063ed-f427-4f54-85b1-46f6f632f5b8",
        "indicator--d326ad50-b15d-44b6-ac38-009061f54392",
        "indicator--9e2165c3-6c74-4801-8dd6-fe2138f8e20f",
        "indicator--e277d942-4bcd-4d32-9075-372073042b2d",
        "indicator--4514c081-6ed2-4ea1-8d82-24ce481cfef7",
        "indicator--54e024fc-5f8a-4c26-81c4-1bff306ab8ba",
        "indicator--1901706e-f61a-46cf-8693-687a1203bafc",
        "indicator--94ee430a-8bfa-4259-b838-2aa048d801c2",
        "indicator--d44611ed-e469-4c1a-8178-f6ffe830b310",
        "indicator--6b5a6e57-fad1-4c90-aa6d-4074fc79c667",
        "indicator--b866de1c-e041-479b-a7da-20e7ed82d218",
        "indicator--9199cb60-9b1d-462d-924e-76a69181ecb2",
        "indicator--6de8fa16-e81e-4609-b96f-41b0d495a992",
        "indicator--613ba6ec-3a3d-4519-ad1f-d48720a3348c",
        "indicator--57d11827-03f4-4273-98b8-b9a51aca24d9",
        "indicator--a7319f0b-2d96-4313-be65-71ef67793a4b",
        "indicator--83cf0401-2069-4004-b084-764a3e58a429",
        "indicator--41497bfb-f484-42b8-8133-cca0a21ad78d",
        "indicator--544a8398-86cf-44ac-a669-f9cb956425d2",
        "indicator--dee900c7-cbd4-4dee-99dd-9eeae3a2be54",
        "indicator--d9e5b71f-6be2-4d28-a4df-f58cd78328dc",
        "indicator--1352d49c-9922-4802-924b-d13a0c67eb0e",
        "indicator--60da2ccf-5ef2-4d2c-bf88-a40d19ac1fad",
        "indicator--ac5d87fd-047b-4fba-9ef6-c607846187c7",
        "indicator--5c253683-43cc-482c-a16c-28a388923470",
        "indicator--748c7b79-5130-4d7b-bbfc-a726bab49f03",
        "indicator--08c8b472-d3c0-465b-8af9-fe0fe9d83330",
        "indicator--424e6334-0fc5-44d2-9d10-298c50c154fa",
        "indicator--9c46a9c6-8bf3-4fc9-bb31-297777e05f8f",
        "indicator--ec6fb90d-ec91-43b0-9143-b816fc7b95e9",
        "indicator--d28d98f3-08ae-45ad-9146-12facd8a1ada",
        "indicator--ad74f6f4-1568-4950-a274-1e71aad07c22",
        "indicator--5d576bb1-008c-41a4-a864-50adce1d277e",
        "indicator--b9e5c178-fa88-4bfc-8370-96af9025a5a3",
        "indicator--71445c6c-730f-414c-875f-20e5e4cd3044",
        "indicator--056fc689-6f38-4467-ab49-5140ea6d5626",
        "indicator--5ffd31f7-8afd-4dbe-a721-bd22b7475a58",
        "indicator--a07ad855-77e8-478c-8a8b-e05c58169c41",
        "indicator--43f7820e-ac19-4360-8bd5-bb3d2d6e2a4a",
        "indicator--c9dec768-54fe-4627-828d-785930ef029a",
        "indicator--bd73115f-95f3-4589-a08c-3fcd33c3f0e5",
        "indicator--f96a4e81-2e42-4328-844a-d81d8c690b7b",
        "indicator--5d5295de-0990-4f61-9781-4d857887468a",
        "indicator--afd7825b-7761-482a-9761-53072f04b5d8",
        "indicator--d5772af8-bae1-4f82-9ccd-0e5476d49734",
        "indicator--46035386-a1d3-4cc6-b20c-5eee2261543c",
        "indicator--f7e0de80-04f7-45b2-b37e-2c32346b2c6f",
        "indicator--107d2b11-fbb9-475b-84e8-3dab6cdf8efa",
        "indicator--a2791d6b-38e5-40dc-9a12-298012bbecc6",
        "indicator--2079b724-e8e5-4010-9e92-9b40fcef05fe",
        "indicator--fa440400-61a2-4e41-8cef-85182a431eaa",
        "indicator--24951fd2-d712-4048-bcd0-7203cfa1a46a",
        "indicator--cee95515-8be5-41a3-a4e2-c17d506aec45",
        "indicator--90b84d7b-3d15-4462-959d-10d25c77f0a9",
        "indicator--d3998ade-1797-4942-b91c-c4fb66dd8a6c",
        "indicator--fe9826cb-3f2a-4a6b-9974-596ea8867b49",
        "indicator--aab783ee-ba73-4566-9e3e-7a4a197f3536",
        "indicator--131164af-24fc-47f2-a68e-b4eb0b01821f",
        "indicator--b7de0452-5245-4ced-9a73-47f3fbebd88f",
        "indicator--88e18fde-dd13-4ce4-a330-2ebed0d7143c",
        "indicator--06c4fe06-3693-4486-9b1a-da22c13cd0b9",
        "indicator--3d4aaf52-8b48-4323-aa06-a39a926a6d21",
        "indicator--e31327a3-9333-492f-ada9-c867077f5dc8",
        "indicator--10afebf2-e76c-47ae-b3fe-689bc99c9c36",
        "indicator--86ad2ec9-35c1-4aa7-901d-98e783ee582c",
        "indicator--f0b0e540-ba05-4b2b-a22a-cddebe1f204d",
        "indicator--47f90aee-b7c8-4164-88b3-71e58a55317a",
        "indicator--5520664c-4c13-4a72-bd31-2ab416f31367",
        "indicator--2f21cb9a-d20d-4099-9924-79cd5ffb0708",
        "indicator--a089d1be-1808-4d9b-ab98-20e4692720ca",
        "indicator--ca41739e-600d-43a0-bf39-1b3a39287346",
        "indicator--7476c8a5-00f1-4cba-94b7-3c8338e8e9d3",
        "indicator--5062a79b-b85f-4d42-8cd8-ed3b120753ef",
        "indicator--c8157ad8-158b-4b9d-9271-96b6b8e2f9e9",
        "indicator--3e6e654a-e4ee-4a79-adad-5d114634b4e1",
        "indicator--6c0b63e6-29b8-488e-8b40-a4178c752998",
        "indicator--f8c391c8-24df-4f7c-80cd-36c4c7a4882d",
        "indicator--49a8e3fa-bdb4-4d42-93be-32d73086c8f2",
        "indicator--81bd426e-0787-4a5b-b57a-80fc0748ce44",
        "indicator--44e81021-8a61-4676-bfeb-7ca414459420",
        "indicator--074848f4-58f3-4d06-8282-b2bb0139ca46",
        "indicator--44f46184-0e1a-45d4-bf0a-3b51f1e0ef42",
        "indicator--19ae6b43-35d8-4a72-b184-c1851c79f4d3",
        "indicator--21829a0f-edc5-44a8-a7b4-915cb7f249bd",
        "indicator--647c6cb6-e0e8-4b0a-bf59-d4d6952fac3a",
        "indicator--b48b8128-23f8-4af5-bcb0-8261e8a8e933",
        "indicator--c8566f98-c6c3-4dd8-a206-d08be48ffed3",
        "indicator--b7c0cbd5-cd61-47c9-8383-36df25ceae0e",
        "indicator--732e6874-ef06-4582-9210-f91b7266de5e",
        "indicator--7edbe240-57c1-4752-8d65-2b98083338d0",
        "indicator--4c4dc928-579f-42ca-81c1-0d6710a5ff52",
        "indicator--e99b6371-237a-426d-a018-4d001a31c772",
        "indicator--b316c3a7-fd19-4715-90df-7f2089143fec",
        "indicator--f3ef22c0-40db-45d7-972f-618c8e0f57ed",
        "indicator--991cca0d-45b4-4b79-96bb-dc5d6a29d9e2",
        "indicator--0a4d4176-d7ab-4731-b268-fe14647ce493",
        "indicator--a55f5772-b2d8-42ee-8223-b8433565377a",
        "indicator--0a31344d-9d8e-45f0-8c75-4e79bbc9ed19",
        "indicator--995306ef-09be-4f9b-8f90-15dc84e72145",
        "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
        "indicator--6e3740c6-8188-4584-a0f6-1d0ba5040b60",
        "indicator--7691a72b-f209-4b76-bdd6-a6caec8f6404",
        "indicator--4ac86f08-cf3b-42b3-82f5-0ff4bf7347df",
        "indicator--e5548a73-dbde-466c-8f15-33803c522c97",
        "indicator--cf384c6a-c2fa-446b-8b84-a84b9c7944d8",
        "indicator--7fb263d4-48f6-4981-bb3a-547abba44876",
        "indicator--92a09529-a2af-4127-b781-b6346268d542",
        "indicator--227e53b1-b993-4d69-bfe6-801c21c0ff6c",
        "indicator--77a609bf-af07-4faa-9ca6-ca65fffb24dc",
        "indicator--44baef16-1269-4064-aa8a-af2a3ca5f124",
        "indicator--ac397915-da04-49d2-a4b5-3e7a9f2774a2",
        "indicator--e94e9b82-b345-42b3-bc12-9ca06fdadcc9",
        "indicator--39fa5be6-1653-460c-bc12-356b1562146c",
        "indicator--37ce0f7c-1f92-46cc-8e6e-379d63e8aa86",
        "indicator--093b86d1-1be0-41eb-880e-498edff5d82b",
        "indicator--279d96a7-2046-45c8-b244-9c0a9e3fdfc4",
        "indicator--bd0d852f-8de9-4372-9fd4-6d4e0bf346ab",
        "indicator--e9b2a5a2-2c7a-403e-a7dd-dd0fc65e4745",
        "indicator--9c35d4e5-91ba-4f60-ba9c-b999144e4297",
        "indicator--083b3a9d-3513-47d2-b7cc-50fc1066237f",
        "indicator--0eab7689-b380-4679-a991-4437870f644c",
        "indicator--c4451cce-afa3-4b5b-a5e2-8a8ffc9119a9",
        "indicator--973bdab1-abc3-4b8b-8379-04e1bb7ffeb9",
        "indicator--a53f3cda-9238-4ff7-b007-2f829df792cf",
        "indicator--dd49ac26-b46a-4f8e-89de-b6c19045e73e",
        "indicator--f908c141-36a6-4535-820a-0623bc1743be",
        "indicator--62bdcdb9-27fa-4c2c-a5aa-ccb77dd8d6b1",
        "indicator--6e8e5748-0328-4bf8-a2d5-3f05dc5de41b",
        "indicator--92070c78-bf64-4280-b16d-e45771f0b96e",
        "indicator--89152a52-9d86-4122-b3a9-b97c173bfd0d",
        "indicator--8fb1957f-fa49-4313-9c2d-53796c59a725",
        "indicator--74260b65-eccc-4d47-8b7c-68b36e3e4257",
        "indicator--95839f5a-04b4-4f54-8c3f-413c4d7bfb8b",
        "indicator--71fad5e5-a034-43bd-b648-1a22bd97f384",
        "indicator--5f2c87d1-c695-45f4-9c7a-a0b853148a42",
        "indicator--53b5a59d-d838-422c-b030-302f3df88a85",
        "indicator--b3a83eb0-9806-48fe-a105-d3174081ced8",
        "indicator--35a82b12-df28-4dd8-b1e2-cb6edc643ed1",
        "indicator--82a5f667-f191-41ad-a6af-49969b9c2b81",
        "indicator--d9336836-2cae-4d28-b949-616ce88ef746",
        "indicator--9e679cd8-1ffb-4679-be62-2cec682cea5a",
        "indicator--82dfa518-512d-40e2-b33b-49c7a58969b8",
        "indicator--76ba92be-8ca9-48c9-93c4-7e4b05d8224d",
        "indicator--f8b444d4-b913-4a66-8e22-ffa7edf0e4b1",
        "indicator--bfc63d37-650f-4604-afd0-846873959cae",
        "indicator--a57927f3-a4c7-45ae-9a72-2240c3f62f94",
        "indicator--48ee95e2-023e-4d55-897d-548568e53a0a",
        "indicator--1dd61c3b-32a5-43c0-b638-0dea12cbaabc",
        "indicator--888de2c1-3ca6-4705-814d-e685f785a412",
        "indicator--5cfe7c6a-dc95-403a-b0d0-74f96296c9ab",
        "indicator--628888b4-d22f-4f59-ae3f-422b78418b67",
        "indicator--9ffd665c-9d1f-4687-a463-94eb0db2fdae",
        "indicator--83daa9e9-a8f4-4ef2-95c2-d7f2753a9413",
        "indicator--2303acee-2166-4ffb-9d86-d3741c8eb264",
        "indicator--63b626c3-8ffb-4a45-9dc8-bc911d895994",
        "indicator--710b6687-09a3-42d8-b4b2-bd6fda71189d",
        "indicator--905da54d-eb0f-4c43-b46a-b4c199368a84",
        "indicator--2f438faf-ccdd-4aa4-8b97-6ed092e4b28b",
        "indicator--a88e53f6-3589-46b0-955b-364c89b77739",
        "indicator--bc058dbb-0bbc-4436-973f-09ba12731b78",
        "indicator--dc540d05-9c27-4888-b4ae-041bdc72e93f",
        "indicator--51dc377e-345a-4f61-b7a3-1f10e0b515e0",
        "indicator--310b7633-6581-4f43-b77a-2b2d8f8dd100",
        "indicator--1b4b4956-44f4-416e-9026-3f12f87ff1fb",
        "indicator--a924cb07-9420-4d14-8ec3-35f81ce78dc6",
        "indicator--50e844ff-831d-4cb6-aa07-397fd70216c0",
        "indicator--a1042582-5210-42fe-8007-e0020dd94d00",
        "indicator--7c794409-105c-4918-8baa-cde1593129b6",
        "indicator--e85e40e4-9c99-4598-a445-fc68bb28cad7",
        "indicator--61d6161d-fcd2-4842-b80a-e388cfbb1c1a",
        "indicator--70cc8b55-368c-44c1-ba3d-2edf18e4744a",
        "indicator--56d84195-1240-4b97-a2eb-bcd2cd52a6e6",
        "indicator--f9fd586b-98ac-4dbc-9c97-75507e15d5da",
        "indicator--c53253d4-ace5-4c97-b12a-b783e89417b1",
        "indicator--d34393b0-351a-4138-938a-b6de0924d055",
        "indicator--fd44b2d7-6757-44b0-8533-392f29bf1978",
        "indicator--8eee3341-81f3-4450-aa66-fddfe840d4a8",
        "indicator--ee1130a5-34f7-4734-9497-e2775d4370bc",
        "indicator--1d452aa8-63c0-4432-b35c-5be7d418c6a6",
        "indicator--fe33ed51-d2cf-4843-952c-94022aa674e6",
        "indicator--06c32bab-db6e-4019-af11-b874f5fb3aec",
        "indicator--c37e88e4-d969-46b6-b2e2-ad2800f59606",
        "indicator--850f39db-fe57-49c5-b1c1-448b27a1da20",
        "indicator--1d20e18b-a057-4774-9017-579804b2ba3d",
        "indicator--02929bf8-5c82-4860-94be-592f11054f16",
        "indicator--b4c4296f-06de-4928-a861-2d0fdcc8533d",
        "indicator--79773bb3-d0ba-410f-8ecb-569295a7cad4",
        "indicator--8961198b-6059-444e-9ea7-2fda91c652a7",
        "indicator--91de9d7c-9ff5-4d72-a162-15458e183ada",
        "indicator--2f382722-fc1a-4161-9a30-70c097aa433c",
        "indicator--50d8f799-efb9-4969-8cc1-5b3c0b7f3ac9",
        "indicator--219e2ed2-eb53-4f1b-ba5b-d58aa7280b58",
        "indicator--d8334be4-feb8-420f-b8b7-bc0b75957808",
        "indicator--4f65d5cc-4064-441d-b114-4e91f24e658b",
        "indicator--920af35b-c36b-4a23-bb6b-47633bbdf5c3",
        "indicator--b1db976a-7883-4e22-b8e3-e2088ab52a5d",
        "indicator--b90e2630-c5d1-42e3-b2db-758804375546",
        "indicator--ac1143bd-4bef-4203-b903-6944911f3551",
        "indicator--228bdd1c-48d7-4ca2-a8ae-7be93351eeb5",
        "indicator--ee9210a6-5cd2-4638-893b-032f9287859c",
        "indicator--50c496ee-33e1-4a07-a39e-7eeb1540bb7e",
        "indicator--475ac818-bb49-40a3-acfa-67861b4b9156",
        "indicator--83657cae-b47a-4dac-a9cf-438f10d30e58",
        "indicator--314f9fd8-ef40-4316-b0f2-57b61fa52cbb",
        "indicator--fe2d9573-4650-4e59-a4ed-f02af9703bce",
        "indicator--ddf4ae5b-f939-48d4-bfb8-d9a216d5adac",
        "indicator--37fe5d9c-8ef8-4068-905d-a7d16b79eafe",
        "indicator--d32c3ae0-33f2-4904-baac-b5a630ac877e",
        "indicator--980010ef-8294-4283-9a63-e73f2b5bb7a7",
        "indicator--248ee552-2650-4642-bec2-f5f44c1e56ce",
        "indicator--e881cbcc-2c07-4a67-a7e3-eff691be39f4",
        "indicator--50ce0c56-8aa6-4397-8c87-7d7632197bac",
        "indicator--5a34707c-b2ec-481a-8031-5cea648ca9a6",
        "indicator--b3ff0e1e-2ab7-46b4-a3ec-b710ba3b3916",
        "indicator--f29d49ed-0c1a-4762-8b82-e585fef8e395",
        "indicator--a653049e-e23e-4668-bb4c-861691a6e4b5",
        "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
        "indicator--72de38f1-167c-4d80-af5f-b0cd4133096f",
        "indicator--f8817f27-8008-4ac3-bb0e-b1c012948902",
        "indicator--ba9abb90-ed2f-4571-8b05-2d8330ff80d2",
        "indicator--271233f8-9410-4da0-bae6-882ef51fc0d2",
        "indicator--18875d3c-b94c-49cb-be00-eec809ab0236",
        "indicator--5ea4a60e-6eb9-476d-9e0e-3d298db9d3c6",
        "indicator--3d732f2e-2800-41e0-a137-1590a77e4091",
        "indicator--b8690fcd-f7c1-48c8-a266-2ea0bea70d6b",
        "indicator--9b9b86ef-c95b-4bc9-98b3-0dbbb5c478b9",
        "indicator--c101a8c8-249d-43c7-ba33-59ed5b0eeb11",
        "indicator--61b4e761-4e6e-4be4-b170-4f5133e7eb81",
        "indicator--904eec76-f36e-42ae-a231-3cee3337cd28",
        "indicator--73655340-a814-41fa-9ebd-385551592038",
        "indicator--8da1356f-4406-4248-ab06-a16261212a72",
        "indicator--2cd688c0-244e-44a7-997c-b082da5364e0",
        "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
        "indicator--dfbb3d99-21da-47fa-b739-ed1bf0933ab7",
        "indicator--2bed108c-a09b-437b-ac6d-2982c0d4fb16",
        "indicator--3df6c0d4-4e3f-4a2b-976d-fa7ae927eb6f",
        "indicator--7d4b6b24-d9d2-40fe-b5a6-38eac2425342",
        "indicator--be1c1a2c-97da-46e3-a2dd-a46fdacabdd1",
        "indicator--626257dc-e951-4bae-b6d0-79debd3b0062",
        "indicator--2ea0a2fb-2ec0-421c-a757-1bf2d83a82b8",
        "indicator--e8c1cfd7-e974-4bec-9340-33b87cd9b285",
        "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
        "indicator--9bb9b8c8-c472-401c-9fee-87723ecc2900",
        "indicator--76856bd3-4aae-4401-807d-4c5481619f3d",
        "indicator--d3880c36-f8d3-4590-a2a3-fd2f182caaa0",
        "indicator--9fd78e74-bdbc-4691-804f-112eb2090706",
        "indicator--0950256a-4ab1-4830-96fa-d743fe4e9df3",
        "indicator--6dfae003-e14b-4913-a5e8-3b2405b62d2d",
        "indicator--73757381-eb5b-44e6-b3f2-a140e86a3cc0",
        "indicator--2bfdc6e0-f2f1-48ee-851b-30d915b4232c",
        "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
        "indicator--aae1fbeb-ded2-458e-a0cb-bfc0057643db",
        "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
        "indicator--010274b6-72f1-44ea-a0b1-97d7bad7c3d0",
        "indicator--4298407e-3d1b-4e5e-824a-998af4f496e7",
        "indicator--ab97ae69-b859-4872-a673-e61a006794d4",
        "indicator--abe28c0f-2399-4c25-bba1-a9427e6dcbb9",
        "indicator--1e0d6627-79c2-4fa4-a586-306f1dcc6557",
        "indicator--9c4cafa0-922e-441b-91bb-f658a9470f97",
        "indicator--3e1ce031-92f4-4d5f-ab2c-db49cc93e379",
        "indicator--cc32bb7f-a02f-47ff-8a99-805e3d657f5d",
        "indicator--5942961f-4397-41f7-b99b-8b025d25ea1a",
        "indicator--c7abcf7d-5732-4442-8032-4b6472cf3ca3",
        "indicator--62de0560-4de8-43fd-8d30-d3762de6bebe",
        "indicator--4272c4dc-467a-4ee8-9419-f7aaf2055373",
        "indicator--c7757932-ec40-4ad5-8026-033d1789909c",
        "indicator--2f348395-0ee0-4ecd-882d-4e3192308ad9",
        "indicator--b34ea883-ea13-4815-8004-6a63e756f8d3",
        "indicator--0ec50c06-f303-43b1-b311-19122e4435c1",
        "indicator--2b804ddb-f7b0-4f38-bad0-6746bbe33948",
        "indicator--9a739eb7-f862-4cad-9abd-ca06832485d1",
        "indicator--bafe7857-74a1-4a8e-848f-29e7d4f1bc50",
        "indicator--c0775695-4517-4859-85d4-16b11ab37288",
        "indicator--aa71558f-5289-4d90-912b-dd662d667064",
        "indicator--2cede636-1025-4d2f-b59a-84f349837b21",
        "indicator--83f93e34-a0ad-42eb-83f1-0bef8e174d83",
        "indicator--d380e05c-da46-4879-8666-175558035b61",
        "indicator--78664b79-2e67-4e74-ae67-8e7c6440b1a1",
        "indicator--04d6bda3-8eee-40af-9e4d-d68f2b938658",
        "indicator--c8536578-e293-4b37-bc55-ae064d478d59",
        "indicator--99bb65df-856f-4070-93d2-15dc22f78ff7",
        "indicator--57f84b75-0823-4991-ad64-7fc539057f06",
        "indicator--5acdc39d-2ca0-49c8-acee-3254da1f6b87",
        "indicator--41c4b1a6-4dd4-4460-8f54-f42ae13d4fa2",
        "indicator--26f7595b-8ff6-4cba-b734-8b9c38be0be7",
        "indicator--e1533d37-2602-4675-9b69-352498260dc2",
        "indicator--d45957e3-404c-44a3-99f6-6038ffa06dd0",
        "indicator--3df3a4ca-55f0-4f84-9655-998aa2ec051c",
        "indicator--65cc6523-af48-4a92-ada9-a2ac43ab7a6a",
        "indicator--5ea5a271-9e38-4f11-993f-d7263f528e0e",
        "indicator--8990be7f-bb70-46ee-9508-10406e290908",
        "indicator--96a1cc5a-7934-4551-82e3-a4095699cdae",
        "indicator--8ee18745-8068-4bfc-a805-d31c7d566d3d",
        "indicator--04274522-5976-4e2f-b515-50abad22e929",
        "indicator--8a7ea8c3-97aa-49e6-b89e-e0e25ad26db3",
        "indicator--5af8bd27-8437-42e1-874b-bdf56e506251",
        "indicator--3d9e6921-96e1-43a2-ae96-ee7a83d069bf",
        "indicator--4671ae32-0b5a-4d2f-87d1-57cf70302f7c",
        "indicator--030b4cb8-23ac-453a-8484-80c9375f1198",
        "indicator--e86fd562-ac88-4a94-bf43-733c9e42b675",
        "indicator--682148a0-9e7f-4e45-a007-16c10cb0e8c1",
        "indicator--9f48e1bc-d120-48a7-9f0d-ee220ea899b7",
        "indicator--6e62b77e-6014-4e5f-af7f-e3ff29a73d5e",
        "indicator--f79d4b4e-2ba9-4c04-922f-e6b32353fe69",
        "indicator--96e6c050-9bdf-4a7a-b73b-9c8e80afd896",
        "indicator--7feafaf4-97a6-45cf-9348-03beb84508cf",
        "indicator--674cb083-4a45-4bd8-bc99-c5802483a932",
        "indicator--27b67c62-d4d6-42ae-bcb9-a1cc082523cb",
        "indicator--a9895d21-89ee-4fd1-b930-c7a10240bdea",
        "indicator--6572769e-0d23-49f6-895f-2a122f886253",
        "indicator--e26fbf07-2083-4a21-8416-cace393d4e13",
        "indicator--2fe02ed1-3a06-48ce-86ac-cefc74e2ac63",
        "indicator--b09f16a4-3057-4a94-8ac3-305d80620ead",
        "indicator--b7be3b0a-62af-43d2-8b96-040282faf236",
        "indicator--0af4ca37-0937-4756-907c-4f99ef8895c4",
        "indicator--d78ef725-162a-45cd-98da-6272066d7cc1",
        "indicator--61dff194-bf2e-4b2a-a198-9bc2a7735c58",
        "indicator--a38be5bb-d9aa-4571-a060-cb5940372cc0",
        "indicator--1382196a-7067-45e5-b310-0c213a9fc79f",
        "indicator--94791f19-b078-49ee-90a2-32e0c00e7f0d",
        "indicator--e6dcf137-11c0-410a-9a43-28cfe6c057a0",
        "indicator--e2c18689-19d2-4ea4-828d-6851bb86b4e0",
        "indicator--401678fe-4cd5-4337-a95b-b8fb24511817",
        "indicator--d955236b-a124-4e37-ab75-b9ea314670e1",
        "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
        "indicator--831ad505-4ae1-4105-8085-b8880b2cc33a",
        "indicator--72313945-6997-4148-9943-a8e3e0cc2821",
        "indicator--3291185a-7006-4ca0-a8c0-0233facc0114",
        "indicator--0d23540a-9cff-4c18-9759-0268ab91ead8",
        "indicator--72579578-7ad4-4239-9d6d-3ce6125b604c",
        "indicator--f17f4bf1-939f-498f-ab6a-d12276d09819",
        "indicator--d30cb2df-b656-405b-9002-e6f796a8bb02",
        "indicator--b284baec-f251-4c7f-b60e-92884647c84d",
        "indicator--e500fddb-a6e6-47a7-836d-f57854303eb6",
        "indicator--c5552408-47eb-4086-9dc8-c2f0e1d2c740",
        "indicator--e9175936-af5b-45e6-9402-335b9b4bd428",
        "indicator--cbcdf3f0-4d9d-4762-b17b-1e9d4cfc64de",
        "indicator--a9220317-1370-48cd-a803-73ef93e89f20",
        "indicator--8b504a87-2029-4875-a0e2-dedefb66eddf",
        "indicator--3f955f3c-158b-461c-beb8-4c3b3ca61406",
        "indicator--4a026e31-1c9f-4060-8c0d-9cffb432c1a1",
        "indicator--588f4605-e23a-4a25-978f-3a991c845d41",
        "indicator--c0cfa43a-991a-4057-88e7-1813669ba37a",
        "indicator--5245059b-d5d4-4168-96fb-53c225f79785",
        "indicator--587cb772-2d88-404d-8539-73d2d9b42c66",
        "indicator--6744f0de-bfdd-4dee-835b-d1f0c86f210a",
        "indicator--2627b319-1fb3-4d17-bd4f-75a1cf039545",
        "indicator--2d28311b-0590-4d9d-8fb9-e718f24091b0",
        "indicator--83bb8abc-7ea0-4dd5-a959-8374ed791592",
        "indicator--75c410b8-ffce-44b0-8bbb-56992b4474d6",
        "indicator--6e37b85a-a4d8-4e78-80d3-2f4d8a1e2cb4",
        "indicator--f691c1d5-a685-4ae1-9045-9bb231ced591",
        "indicator--faa80b05-c800-4c36-9ba7-737062b21736",
        "indicator--7ba543b0-c92f-47c7-8d12-3dc69c43fc32",
        "indicator--32c95617-f1f0-4942-ade0-fa8ed82ed6ea",
        "indicator--63f189ef-baa8-4602-8db1-93bf187a0193",
        "indicator--6fe32d12-018b-4e6f-a169-e196fcd13add",
        "indicator--76e66f53-3e3b-422b-9a46-bbeb501bd478",
        "indicator--41b364ae-f2cc-4cbc-925d-74a77c1e6f06",
        "indicator--250fa092-1759-4898-aafc-9e5923cb7501",
        "indicator--3bb2379d-cbd3-4d5d-9936-a7b7cce52e86",
        "indicator--1007a1b5-e479-40ca-9823-f8565f9573f8",
        "indicator--d69bbc76-2867-4416-a957-95ca9c70485b",
        "indicator--b8638d09-9c6a-4bd5-ac58-8cd5d0775b2a",
        "indicator--b4ebf40a-7e3b-44a1-b0ab-4b0778c6b301",
        "indicator--1a5b0257-1b9e-4037-a664-9e1194cea90b",
        "indicator--a7ae4174-9a35-4225-afe4-342e74751a0c",
        "indicator--73305ce0-7e03-4403-838b-420eb85ae959",
        "indicator--1276b1c3-9310-418c-9624-1e3996115dd1",
        "indicator--5370fadd-ffcc-428e-9f7a-b21a218a2e7b",
        "indicator--c0f6fadd-94aa-4976-9a28-092669d5db4b",
        "indicator--cf309d89-3e80-4bd5-b9a4-63d71678fe6c",
        "indicator--72f61b76-078b-4203-adb0-d558cbf96e26",
        "indicator--df773f0b-ad60-4cab-b3fc-dab5b99c0ccb",
        "indicator--e2308b2d-8e47-4e61-aa2a-dc8ed3794ba8",
        "indicator--a895c44a-771a-433a-9e4a-ded377a5971f",
        "indicator--11d5f4d9-d356-42a6-b9b7-357b7117a1b8",
        "indicator--c8b42d93-d8bd-44c9-86bf-2507da1b4690",
        "indicator--c37df85d-19fb-442a-9b77-c7971cfc4d59",
        "indicator--9b526510-6f9d-4768-8dbf-8b21d50c87ce",
        "indicator--5fed55a9-36e0-437c-ad7a-30c1b64460b1",
        "indicator--d941e9e7-defa-42df-bb22-3a88ca3de12d",
        "indicator--ca1aec5d-e3ee-4b47-89a2-021d35d2e6fa",
        "indicator--7d151ac9-ad6e-4c4e-a9ba-4be3c61148e4",
        "indicator--e6975656-10c8-48bf-b7c4-2b09f1c1199f",
        "indicator--a44a4d3d-243a-4d3f-8fdd-23be3e0931dc",
        "indicator--86185a1d-5fcd-4c49-886f-166b808bb805",
        "indicator--cd4326d4-0ba0-4db2-8d8b-467d6d756a57",
        "indicator--c08da94d-319f-42e0-a317-9986f6752b53",
        "indicator--17cff500-b319-4a54-aa05-81d92cf680e5",
        "indicator--69f52bab-b26b-42ff-80ea-21ea196af017",
        "indicator--0f5f78e0-8ecf-45ac-bd01-bdc5df42852e",
        "indicator--460ec486-105b-4b9b-a229-0ae68d85457d",
        "indicator--9324ccf1-c9cb-40b3-a9ae-d2bed723e7d1",
        "indicator--781fbfb1-d687-4e8e-a2fe-bc25b4ec8a47",
        "indicator--f7bbfdbe-4ae0-4803-9ab1-88536bd1f02c",
        "indicator--efe6d02e-955d-440b-9a61-089b29503500",
        "indicator--b2fabd22-45f7-4a02-8901-13f3cb3135c4",
        "indicator--855c4fc6-2462-4f6c-acf5-ef594fe46060",
        "indicator--a7cb5b95-c266-4e20-b953-87af58591b0c",
        "indicator--10683e5f-e751-42e9-8435-fd4c97525445",
        "indicator--65c36a13-84d1-4198-846d-c043e4c7fc01",
        "indicator--ca33d84a-cc58-40d5-9bb2-5d7e15905a52",
        "indicator--e72599ec-f1f4-4c45-96ee-8e462ea99938",
        "indicator--c2760d42-3810-4bdd-b5b6-dbbe8697c7dd",
        "indicator--410cfc2a-07c5-4fb6-acc7-714210c31fda",
        "indicator--e9ed4cfe-d6c3-41e8-8d31-097469683af2",
        "indicator--c01661b7-7a80-487e-b7ad-14f05ebd1697",
        "indicator--14cfe304-ca8a-4b2a-a175-cb1a905cd5ea",
        "indicator--9719bb5a-4bc8-4719-a760-c28c8b10df33",
        "indicator--3518e6c1-2956-479d-8d95-02164379e470",
        "indicator--80f4445b-cfba-498c-82ff-300c87d4ca4b",
        "indicator--56b7b4ba-f5c2-45cc-8f1c-957ea03a6816",
        "indicator--b4c08a6f-081e-4a52-87de-683d5099fcb7",
        "indicator--05f2a8cd-fde9-489f-9e57-b8869d5ceeb8",
        "indicator--979fc355-bb49-4d84-83f4-1652bd4a1b89",
        "indicator--1abd864f-1b84-4e83-a637-926db6bda190",
        "indicator--cc860518-60f1-4c4e-b322-b832f050eaca",
        "indicator--a0debfef-f354-4fbc-8105-9b4b2867cb1c",
        "indicator--9fbc50eb-7251-4d53-9f4f-10ae2f324d6a",
        "indicator--1b8f51da-21ec-4a7f-b3dc-d22c2190de3a",
        "indicator--5f016561-460d-4c11-8221-67fd1015b781",
        "indicator--1e6187dd-a108-4325-b072-843c44968567",
        "indicator--ff366699-0013-4bb7-ac26-75284ec388b9",
        "indicator--018030b8-0f60-41e4-b205-0db42bf7f8e6",
        "indicator--d7caf332-b3ad-4c32-813b-1742d6ed18a3",
        "indicator--b244d925-f849-4a51-bca0-5d4535183f26",
        "indicator--a6905991-c8fa-43c3-9711-aa24afa6b36c",
        "indicator--cd05c543-01c5-44c9-8e6c-98e351ca7365",
        "indicator--d156b2ab-b96d-456d-a032-c6b2fbee374e",
        "indicator--174953d9-54cf-416d-add8-a48eabcb0e35",
        "indicator--12969164-0ca9-4d7f-897d-ef113abc2e09",
        "indicator--c54c77e2-1890-4422-bcfc-5135be5b17f6",
        "indicator--e52af31d-4740-4cb5-a8a1-0cf4ee009f8e",
        "indicator--be7e5c25-461b-4fae-85c5-2e2c5ff9e1a8",
        "indicator--1a19f8a6-5e09-49f7-9e48-bf78ae92ee69",
        "indicator--21b5f890-9ee2-40b4-94a4-80e0e04a96c0",
        "indicator--5a49b7ae-76af-4d3c-a544-2d4fd73aeda0",
        "indicator--ffc4d498-4260-4ff5-a2fd-ca8714813967",
        "indicator--9e0cde9f-f610-4755-8541-c62dc2ac4eac",
        "indicator--183a2efe-2b47-45e7-8883-ac240d6b1742",
        "indicator--54756f7f-6adf-49bc-b930-462f6f09440d",
        "indicator--42dc412b-a9e4-448a-a015-1e4b91c4b9b5",
        "indicator--affc6b76-8253-4aee-b225-3c4751f0c9d6",
        "indicator--a4c7f291-d3c7-491a-acf6-cbd8b47bdaa9",
        "indicator--b6a3b1ae-9e77-4cc0-8443-c771c6220b46",
        "indicator--1923533e-f5de-4b84-a075-3773f39b1d70",
        "indicator--cd0921b3-75f3-45d5-a711-7fa301dfc6ce",
        "indicator--3db8bcd2-2444-4949-9325-864d5c31947b",
        "indicator--8f1d227d-50a2-4bb9-b658-c81d45b02d37",
        "indicator--59c3eecc-12a9-4e4a-8d19-c7788082428c",
        "indicator--d1b2a830-ad3e-429b-bf86-c1c4f16e3481",
        "indicator--49617a02-b7ce-4f8a-90f5-8f13b29fa08b",
        "indicator--0d186520-ae2b-4087-982d-fbad39195c1c",
        "indicator--64f24033-d704-4c92-88a5-f570752b69ba",
        "indicator--93ac84e9-395f-4cfe-8b3a-8b2e1e98947d",
        "indicator--fca80239-b316-4068-bc0d-a34f11f5d93b",
        "indicator--78557298-05bc-4e08-85c8-3012104a06ca",
        "indicator--565e559c-5135-46e3-9adb-2d5e626383ce",
        "indicator--7ba55913-dd27-40aa-9ec8-00601e7e602c",
        "indicator--9f2af446-8d2c-4c25-bd9e-6f3e45e73a91",
        "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
        "indicator--b5d030bd-3708-4d78-bc9c-96b483a63176",
        "indicator--286f2c30-6724-4691-90ff-3fc1f674fc67",
        "indicator--39b57656-b73b-4b51-81b7-5e1b6ef20327",
        "indicator--0f5db2e1-5fee-4821-969c-cf5a22484d57",
        "indicator--279db4ae-7380-4ab4-b346-3823ef5e354e",
        "indicator--fdf2e1d8-f2bb-4158-ac00-56099ee964e9",
        "indicator--3571ec63-024e-4c44-ba6f-ed8c8489f99a",
        "indicator--07ab7a41-a7e5-4d54-ae39-71fbe9525f2c",
        "indicator--0229d06c-41b1-4dd2-a871-16d5704216b3",
        "indicator--b599d0c1-c1ea-4488-917c-ac16a1020cb4",
        "indicator--c43ec100-4829-4d8b-9fab-1b2cdbb00a2e",
        "indicator--290620fd-4dbe-47e5-8341-2682d79e58d8",
        "indicator--234ebc10-aeb4-4cc6-b79e-9b3369d35292",
        "indicator--a77c1360-0aef-4a92-a9a9-b1d494c9aa29",
        "indicator--5ccf5355-f713-4038-99d0-19e3997d9e64",
        "indicator--871ac0ea-d262-4fd5-b9b5-4fbbd496dac1",
        "indicator--0b8051d7-3e44-423a-bf09-2e341ec7f365",
        "indicator--ab678140-5d53-4e50-a174-2f2b83ca8943",
        "indicator--db863a7e-897f-4242-833f-ca880eefc74b",
        "indicator--04dc63e8-9000-47ee-8bb7-2f99fd57d0ca",
        "indicator--db3d9dee-d13d-4f9d-80fc-533d4ea480fa",
        "indicator--5ba3bda3-037a-4bff-95b9-b3504704fa39",
        "indicator--34c3d71c-8fcf-468b-93e2-88d0e3378eb2",
        "indicator--82b58437-d07d-420b-9a01-8101459b7636",
        "indicator--f949460b-3cc0-48cf-a8dc-7d95931e0c42",
        "indicator--aa29f52f-6b50-42fa-a7a0-b09792e776a0",
        "indicator--d54db283-3cb9-4c7e-bbe6-eb891c99c5db",
        "indicator--56d7a865-681d-4c0b-b03b-5cc81cd76755",
        "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
        "indicator--5d10041d-25ec-4c75-8b6f-0dca84da39a0",
        "indicator--b1ac55be-131f-4fe7-860b-57bb247a4e9d",
        "indicator--d436c95d-37c3-44b8-b662-22ac0b232c36",
        "indicator--912590df-822f-4546-a140-af87c53cff20",
        "indicator--e22d63a2-ae3d-44b9-8a9a-63791d76e4eb",
        "indicator--37ac87c9-4c99-439b-b878-42bbaec0d7b2",
        "indicator--42bfca8d-7dcc-43ee-a715-e7da09df5c53",
        "indicator--4d8d9404-8d42-46be-9a98-00781cfb5643",
        "indicator--07196b8c-12c4-4120-acbf-883810b4de63",
        "indicator--07d01aee-8e9f-4cf3-a732-2d8abc21466f",
        "indicator--118b2e7b-4a36-41a6-b1d4-8a836371c5e6",
        "indicator--10832eae-bf60-48cb-a361-9ee57937b0f2",
        "indicator--c777789c-2137-400d-b3d4-07eed4506f66",
        "indicator--c462fd35-f1c0-432c-9c99-de5f4419eb47",
        "indicator--4595812c-84ad-40a2-849e-958665d05b00",
        "indicator--abbb9b33-1484-4925-9dff-b971832eb102",
        "indicator--18179414-9bbd-49f9-9256-a11585f8bfb8",
        "indicator--d1b02a5b-d27c-4d3a-9743-ac8cdc41b106",
        "indicator--baea6f51-f88f-419f-a305-fbe1bfde1330",
        "indicator--a2db2f4b-7d00-45b5-84af-bd7c8aecb200",
        "indicator--f0c84942-9a41-416f-95e3-6f7e71a1bdc7",
        "indicator--eb6657bc-bbc3-4dfd-9dd0-45e873ad37df",
        "indicator--f8956b90-5815-4dab-92c1-838d4ba79c00",
        "indicator--4f9c2acf-dbe2-4dde-a93b-316ab57efb40",
        "indicator--017abcc4-702b-4b9a-b322-3b015681c62c",
        "indicator--f272a864-2c0c-444b-99f0-5aa65fb85e30",
        "indicator--9c4b21c3-00eb-42f7-8465-301b9c43197a",
        "indicator--5beaf10c-9290-4557-a825-44b6556c8eed",
        "indicator--9e990493-c657-46e6-a04b-af4511ffa2c9",
        "indicator--e5e73804-ce61-4949-9e6b-e21c1e1f0755",
        "indicator--f0eadbd9-86bb-4d46-b109-26eaa2bc4bbc",
        "indicator--5f3579ea-321e-4d00-9219-f91ba950d9f3",
        "indicator--4f6b2862-7382-4cc4-8ec9-86e65491d8e5",
        "indicator--dc553fe1-0cbb-442e-8b30-84671263a66c",
        "indicator--8328a6b3-017c-42de-b818-3fe4e81e5a19",
        "indicator--54859a43-5855-464f-856c-cdc7021c42e6",
        "indicator--599ba6ba-ab86-42c5-993c-5e8e74025585",
        "indicator--e868f8a4-9f48-4188-a7eb-768dedbf3d62",
        "indicator--1f50e6a3-3986-425f-ab6f-4567cc3b71f5",
        "indicator--1d60a809-d74b-4179-b85d-8976d07e10d9",
        "indicator--c76533df-98e3-4c20-af00-68934e5a5c7c",
        "indicator--cc60b0a6-a201-40bb-828d-11dbc58ef445",
        "indicator--88bfb627-5e75-4c92-bc04-fa1e2cdc3f2b",
        "indicator--83dc463c-450f-4ba2-bba6-11f8cb25004f",
        "indicator--00b1630f-bd70-4279-9897-4b58c9b503c2",
        "indicator--f78e1f11-8e4d-4465-8793-4224dd02cdfb",
        "indicator--0e6b0bfc-4953-4d2b-9278-0762e8ac540e",
        "indicator--53410b0d-639b-42ef-955f-c56a357498d2",
        "indicator--575375d3-64d6-42fa-97fe-9c9ca7a7a676",
        "indicator--316588b7-d7a7-446a-a735-3daaa086741d",
        "indicator--4e54e106-c8e9-4480-9e71-d4704daf43c8",
        "indicator--d93c64b9-36ca-4122-b7c8-5e60c9810917",
        "indicator--12eaf260-9f9e-44bb-81b2-7c0c4c0a9cbd",
        "indicator--3cac3469-5c32-4c9b-9bc3-a40719e6af86",
        "indicator--4b406c43-16ea-4665-aafc-cb73672daa3d",
        "indicator--8425456b-dd07-4abb-94d3-1fc57d90ce45",
        "indicator--5030285c-f5ac-4277-b773-02f91c7ec03c",
        "indicator--278198aa-e582-4ead-aa9d-1ef96d0169c5",
        "indicator--6b5f6ac4-3d9e-4aef-ab3c-9d5f56835d57",
        "indicator--758c942f-c905-4030-87af-9ccf1b41d00f",
        "indicator--06c25a7b-6934-4219-acab-d1d0a62479e4",
        "indicator--90918056-9489-4cbb-9a87-8c40cb2e19a6",
        "indicator--75af714f-d3bf-4b75-bb41-ac6a93fae112",
        "indicator--cae2226c-935e-4d09-bb12-89dc76987fee",
        "indicator--34d348a9-f71e-4ec7-80f9-9290795f668d",
        "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
        "indicator--ff82af86-7a6b-4844-adea-23170d00c845",
        "indicator--f4b63db1-4062-444d-a8f0-025c41965707",
        "indicator--e3cc5b59-41e1-43d4-a9a0-1858a15bf3c7",
        "indicator--a366b5c8-28b0-4467-aabf-98f57f99f01e",
        "indicator--b993ae62-1a91-4593-b287-8c3ef38475c0",
        "indicator--8e683a40-8247-4d05-872e-9917c2770bc9",
        "indicator--7001ccbe-238f-46af-9969-3bc11ff7ea1c",
        "indicator--b4326f00-ce6d-45af-ab5a-f219f1a00714",
        "indicator--c8881fc3-8f76-4c6b-bafd-09b175637513",
        "indicator--7f0e6170-7096-472c-a352-4b1355709338",
        "indicator--3308ce26-ce6c-4d80-a253-5a75261bdda7",
        "indicator--8568e97e-19c3-45d2-a61f-bdbc573194f3",
        "indicator--b16c1976-9dcd-4bdb-9e7d-e415bb1dca58",
        "indicator--e1c6e794-e46e-4ac7-b93b-69851e16c8bd",
        "indicator--27f66e9b-6134-4f9c-8bd5-8bf53799399b",
        "indicator--4c4cc434-9199-44b5-9e9d-c90cca899de3",
        "indicator--11c15d64-b857-4685-8545-843d3c5029c9",
        "indicator--7db10e79-fe3a-41cc-867c-477183264684",
        "indicator--5fe247b9-4419-41b1-ab83-0ee93a539fc1",
        "indicator--b9a236e6-f5b6-4e03-b53e-3324f6e72883",
        "indicator--3756ac87-1540-4842-88b7-c8865ccc6bd2",
        "indicator--1c794c87-8af9-4bb4-a521-47202ca883b9",
        "indicator--9a3ea0da-11b9-4b54-810c-802d20bca81a",
        "indicator--134db202-a58c-430f-832c-dc0095cc1b0f",
        "indicator--59eafc1a-01fe-4e54-8782-596abf9f916f",
        "indicator--dd43c473-3103-4b6b-a0e1-0aa9d24224e1",
        "indicator--0e9d725d-2816-4118-b4c8-0e5c3fc83a9f",
        "indicator--bb7839b3-5822-4259-9524-8b493a64b721",
        "indicator--d582ca9c-0afd-4f9a-a041-078135f0c5c2",
        "indicator--7701a8da-5e06-4467-a7d2-f9abd00ec8ec",
        "indicator--f47845de-6bf0-4d1b-9917-b118b0b1eacb",
        "indicator--cbce77d6-051e-412d-adcf-84abacff13e3",
        "indicator--0012ea3c-b5ef-489d-982d-2d230b9fd1d7",
        "indicator--41005da6-3147-4cee-b191-7abdc8a11203",
        "indicator--919496eb-6a93-4e01-803f-f38da11799c3",
        "indicator--4dee0562-baa7-48c7-a5d0-7564a871f8c4",
        "indicator--7ea61996-d888-4826-a9c0-ab5fe9089c78",
        "indicator--fd52bafa-63d0-497d-97dc-e556dba77e95",
        "indicator--15d75750-f1aa-4732-85f9-93ead2be7ee4",
        "indicator--8ec1456b-8684-4ffe-80ab-00e74630cc21",
        "indicator--dd19fa6c-bc44-48ec-9ac2-b162ab16d8a0",
        "indicator--571f4b2a-562e-42a4-8581-dc962c0882c5",
        "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
        "indicator--b936412f-42d6-442e-8f1d-870ff0ecf149",
        "indicator--def9891e-98c7-40be-9a6b-97b4651e252a",
        "indicator--405e51ef-fb24-48c1-9aba-3e1c0b7f1144",
        "indicator--6e35a387-a77c-468f-b3c8-142d27ecb15b",
        "indicator--28896087-847b-4634-b7a5-7dad256f66cc",
        "indicator--590d22be-4af0-4695-864d-9391e449f0b7",
        "indicator--9e6f6602-5d1b-4b34-af34-33a4022d506a",
        "indicator--c8233f36-f5b3-495a-9ab3-ea3e4ca218b1",
        "indicator--2a47c092-e4bd-48c2-b465-ad69198a591e",
        "indicator--b51466fd-4792-47ff-87d5-147663f98867",
        "indicator--e1975762-486d-4cef-9be6-1103ba7e6a54",
        "indicator--1b29d59f-75f8-4594-be56-1e01da8e2f75",
        "indicator--56b4508f-1476-429c-bcd9-03f5bfb97f9c",
        "indicator--8f7613e1-19b6-4f86-b516-d4825084968a",
        "indicator--72ac84cf-773f-4ea6-a636-8f1791cfa58a",
        "indicator--dea4e946-5c00-43ef-b501-6efd7b1bfcb3",
        "indicator--bbdc86a7-ee6f-4410-8988-656932223ab1",
        "indicator--1db275d7-7b81-4b5e-93e1-481e289f01ca",
        "indicator--09b0f9c6-5232-49c7-9b11-fe9ed8b95380",
        "indicator--13f04f0d-4e10-4b39-a8f2-e40e59fbe5c9",
        "indicator--2d583b21-9d0a-46d4-bdee-565a6f985a27",
        "indicator--d28f2f59-54a4-457f-880e-bb8fdfaf6a7c",
        "indicator--c4d7709a-84dd-4e96-9f38-31d21ea88e89",
        "indicator--b63bc71e-3277-4055-97c1-9d598405e72a",
        "indicator--42001512-84f9-4497-a4f4-2ec324b83445",
        "indicator--598965ef-ddcf-4d9f-ac3e-62aba3a33787",
        "indicator--eb308426-22db-4997-a6f2-191bd0551347",
        "indicator--e32c7d74-60a9-4e8d-b370-8dd7ad752bf1",
        "indicator--00fd4ece-a7b4-4b1a-95ce-983b1181cb81",
        "indicator--9814eb0a-0d66-458e-83c4-ba68fdd10a53",
        "indicator--c910d545-ec0e-45af-ba73-d4bb8a4a16af",
        "indicator--0d0a27ab-bc2b-464b-ab4b-328e25793be9",
        "indicator--c7e4ad94-4ca6-4752-a05c-529579cc8a21",
        "indicator--2864a17f-3efe-4cee-ae40-1423bd0d11b5",
        "indicator--a2b77577-83f1-4973-a539-2dc57e3cf33f",
        "indicator--6ec9b8a6-8aa0-40bd-898c-413bbb2ba40b",
        "indicator--c2bc6b84-8fd6-4ad0-a3e5-8d87be35aed5",
        "indicator--a68ba487-2542-45f7-a000-33e5b76e4fbe",
        "indicator--f068c390-4124-4bd3-9d26-4d45859e4f5c",
        "indicator--a7d23018-70e4-4ee6-923b-f6cd165fb454",
        "indicator--d63a6aec-49f1-4482-9f9f-1622ae59e11d",
        "indicator--70261900-1e07-4ea8-9161-9c0403f32c0f",
        "indicator--dbda9e6c-31b9-4806-821f-cc92934690cc",
        "indicator--17e901cb-b768-402a-bf3b-8391cc693406",
        "indicator--0a6c8b19-290f-47da-9760-f1552be5820b",
        "indicator--fcc1b5e9-4fd5-4a59-8b79-acb223a3bace",
        "indicator--1b2a70de-e9e6-4d3d-8456-607f04e20edf",
        "indicator--7497d09e-a654-4e04-ac4b-23d3ad1dfc0b",
        "indicator--9dc11573-4c91-4b82-8ff0-38e3c1928985",
        "indicator--445adbb7-ea72-4dc1-86e1-b462d83dbbf8",
        "indicator--dc1ae783-95e1-40fd-9faf-4ae721f12a57",
        "indicator--69284be3-39bb-44e3-8241-288ae3cac2a6",
        "indicator--ed184916-88b0-4504-9275-28182fa74ab0",
        "indicator--e5cf3508-b9c6-428f-ad0a-f6d3b55459d1",
        "indicator--c2f0f1a9-1d22-48a4-9689-7c2be4d2f3bd",
        "indicator--58fe02ae-1cb9-4b8a-a47c-508e15eeee5a",
        "indicator--e74786f0-a6d0-40d1-8000-5303f63dd7d0",
        "indicator--8dd88e56-697e-4a06-9451-7505204686b8",
        "indicator--0d8c5672-4cd6-4b4e-bca9-94becfab7623",
        "indicator--fad0a2f1-326c-486d-8acf-a46e5279dbde",
        "indicator--06146911-f05a-4a6e-99c3-f1dd98759d0a",
        "indicator--213793c6-fb00-4dcf-85b0-588016536a46",
        "indicator--0d44ffba-3b59-4ea3-851b-067ef71c538c",
        "indicator--abaa4e5f-734f-45f6-af86-c0ba202c02b0",
        "indicator--bd078f0c-5ccf-46ae-8616-f90545fd6b41",
        "indicator--d1bdf4fa-03c3-4425-84f1-b38adfffeec7",
        "indicator--8d93facd-5669-44a3-b33d-a28df3ab296e",
        "indicator--2ca3e8aa-a790-40f5-8ff7-526c7ae5884c",
        "indicator--7225f06a-5a0a-4424-a77d-f5eb68cacf44",
        "indicator--81c2aa2a-3c02-43e8-bcee-b2bd6c016126",
        "indicator--e71f9d43-87fc-4f65-82de-680b4f9d5ddd",
        "indicator--d6ca33ba-57a7-4d90-a7c4-88b697f403cc",
        "indicator--3fa1201c-4cad-42f7-bd64-4546e368bf5c",
        "indicator--ec08038c-0ba2-4885-988b-e1c5512009bf",
        "indicator--6336f467-e2e8-4cc6-85d1-2137e74282e6",
        "indicator--1874451f-7cb9-44d7-aecc-1a69f4466014",
        "indicator--051be272-2b00-4aeb-898a-44542986de95",
        "indicator--211e55e7-28f0-41d6-a483-bff672e44685",
        "indicator--f47159c1-afc3-4493-a657-f12091c9bcb4",
        "indicator--16d486ac-619e-4500-b8e4-c2695e922ef1",
        "indicator--4c5d2990-b203-42bc-aa1d-96bfb49db163",
        "indicator--f2ec1bda-ad99-4911-ab8e-5f7c38216e0b",
        "indicator--22443efd-7d9a-45ff-829d-7d989582179b",
        "indicator--803dd376-cea4-4fd4-b629-ea394e40b007",
        "indicator--e6c9e068-03d8-47b1-b9ac-759fb7477f72",
        "indicator--3c9ab011-e09b-4985-ac82-99d25611a8ac",
        "indicator--2a8d84fb-5cdf-46ee-a6b6-8757212a1563",
        "indicator--d81f4dc2-356a-4266-bb91-7ec487224d04",
        "indicator--98f336bd-169e-488d-a802-8eae570e4199",
        "indicator--f1eef516-3add-43b1-bed2-62733719145f",
        "indicator--5cb262fd-2d22-4342-a878-934d4f0615be",
        "indicator--b3a2704e-5e7c-4a73-bfbb-ae2e26565566",
        "indicator--b8966cbd-07d8-442e-a008-de818f21433c",
        "indicator--dd11f98c-3b29-4d4e-ba78-c406309f9202",
        "indicator--00269f29-fa19-4916-a767-f9a7f7b8300b",
        "indicator--c4d874a3-0f0f-4df1-95ab-108ae1d65f55",
        "indicator--ca456de4-0e3e-4fe0-a71f-5d396fe11145",
        "indicator--fb335778-1449-45d0-a83b-7f2fcdf4b5ba",
        "indicator--b35f1435-424a-4782-8cca-fe0560996fae",
        "indicator--8fc2bdfb-c186-4a92-aec8-ead34d7de314",
        "indicator--8d1387fd-d638-4aae-87df-a6aab4790efb",
        "indicator--b0fac396-320d-4b10-8e2c-4e7a29451a48",
        "indicator--e8c9c327-d5ea-464a-81cf-0cce81a463ba",
        "indicator--cffe7098-d64e-451c-a150-2c4789319dfc",
        "indicator--a553121f-821d-46b2-b32a-b4ae290771dc",
        "indicator--5b0f8354-330f-4077-a2bc-10a2700d2832",
        "indicator--abfdeff7-a03f-48c4-805c-11aba2c574bc",
        "indicator--cbee9f50-b9f3-46db-bb35-07745541f999",
        "indicator--d1f5881b-b55e-40a4-8b3e-a3dba2834da6",
        "indicator--b64a1414-1f03-4c59-b740-15c83ff40e1b",
        "indicator--16ac90d1-6871-4d43-a276-c14be28fac11",
        "indicator--6a3607a8-cb7d-41ea-a0da-a8ba040fac29",
        "indicator--5d7134c2-4309-44ea-b405-8f3342c1c935",
        "indicator--6f4c4f35-3990-46a2-826e-d46ea6d6be93",
        "indicator--c7152a83-7e12-48ce-be12-97d72ab51699",
        "indicator--5e6ed41b-6beb-4a52-8f15-18899a5736d8",
        "indicator--2478880a-5bdb-4352-8651-37eaf5d84486",
        "indicator--886ae124-2d36-41a6-88f6-03383b0f42e1",
        "indicator--a328bd72-1437-41ab-a10c-8a8c1979c0dd",
        "indicator--42aaa3b7-a45f-4559-9fb5-0a349e935d73",
        "indicator--754cde3f-1810-4252-8bf4-5903d84c57ca",
        "indicator--6e594d7b-6c01-4f35-bba5-0cb514b5af8a",
        "indicator--5b347790-4286-49f2-8457-0115956e71d0",
        "indicator--2885be14-8065-44c3-87dd-48fcead7e24f",
        "indicator--1599fc8a-8b74-442d-b816-156c8f005a87",
        "indicator--f628e081-0c46-464c-9158-706f27ce473f",
        "indicator--c1d3d6a6-0fa0-4c13-ad89-24fafbd36561",
        "indicator--e2a703d9-e976-408d-8e8e-d993c540d9aa",
        "indicator--de3423f5-4aef-4309-a548-4049456bd0d1",
        "indicator--e1eb6d23-16e6-4352-8daf-d412d7c0962e",
        "indicator--e0b4a066-e2ae-44eb-bac4-9a249da2529d",
        "indicator--f84369f0-0862-47e7-aa18-605bef6ede89",
        "indicator--fbedf4da-67d2-4184-97c7-937e4dfd5d04",
        "indicator--e7b45664-48c0-4d2a-9ebe-c5ff8da4b20a",
        "indicator--829eba47-a798-4493-bed2-1bf53b27ec20",
        "indicator--583f1779-671e-4143-9eb6-41fe5d68fbaa",
        "indicator--3b985400-1911-4835-90e2-5d45f07bcb83",
        "indicator--fc8944b2-b1dc-4cae-a3a3-b3bb51f2e0c4",
        "indicator--48ad820d-0ef4-495f-8514-9cfbc5139151",
        "indicator--83502710-1daa-4142-a877-8a0a036bb51c",
        "indicator--1671e23a-3784-4f7d-8e5d-c5bae2b4569f",
        "indicator--d4e0ce1f-357c-4f2f-a2f1-4568b1deb36b",
        "indicator--5c63ddd0-de0b-4920-8ebd-aa5d6eeb6841",
        "indicator--4f971776-3f3a-4aba-8f20-a44d35139b6f",
        "indicator--08810622-1007-453f-a718-55d03f687fe2",
        "indicator--16e1955b-5689-4099-b79b-5a9f80d1a33e",
        "indicator--31b3bd1b-1633-45b2-9957-3138c5611f11",
        "indicator--89e698e1-1ddf-4038-9c8c-46f52651f188",
        "indicator--070c107e-cda0-4245-9b96-ff0155701385",
        "indicator--303f0768-53d1-4837-afb6-acd5dd63f2d3",
        "indicator--fb68cbdd-02af-4d4e-87fc-cd91deab4a89",
        "indicator--c6acc65a-c6a1-462f-b5ee-a75af12cc304",
        "indicator--38af5f3f-e8da-4d54-a512-3ece5ad10091",
        "indicator--c3909a32-5289-4aeb-a98a-81e3658965cd",
        "indicator--4833820d-5ff8-42ee-abf0-d855d5be18a3",
        "indicator--6c596739-0c85-48c9-9445-e7e74d7a2e28",
        "indicator--334dfe69-26cc-448e-8f7a-de43003484b6",
        "indicator--3702811f-4a59-4d43-bfd1-04d4d9278cb1",
        "indicator--8a3fc1b3-621e-46df-8ad9-d35860ef7b01",
        "indicator--34e10eff-f403-4e08-9475-4f86b87dd9d7",
        "indicator--62f1eda2-298f-439a-8120-a60f2cdaf76a",
        "indicator--95782468-3416-4149-b636-1fdfaa2df606",
        "indicator--cd8ed947-ea4b-4549-b733-aa46df06dc43",
        "indicator--f8a31662-8cac-459f-a62b-781770235472",
        "indicator--dfbc852d-079b-4ead-aa12-7093db407ef5",
        "indicator--15060d73-b72a-43e1-b980-e76b11b99ab8",
        "indicator--841ae0a7-25cd-421a-a76f-b0c35359e0f6",
        "indicator--01c23d87-2135-4fe6-951e-088187fbcd06",
        "indicator--58706e79-9fd7-463d-a0cd-77b9e608ce9b",
        "indicator--49889bc5-d9f7-4b1f-b8d4-f4bf38ecc8d4",
        "indicator--8fdb8bac-1ca9-4be5-9f37-31a18339b666",
        "indicator--c68656be-3c2d-4229-b7db-b25d7b8b1e9d",
        "indicator--e7c331a9-4a08-4884-aa37-d96ad94a3b53",
        "indicator--c09bac66-bf91-4f4c-9906-2ede6d042620",
        "indicator--6a249b04-9e62-415a-98df-34a67b0fa73c",
        "indicator--21d5de2f-3aae-4734-9ef8-d91b20d83259",
        "indicator--d34b1894-15ac-45a2-a9ed-980586f1d947",
        "indicator--38bdee9b-47a2-420c-b5f2-31ae5d9f043a",
        "indicator--96f2e712-6238-4c8f-b66a-f428f13d82a2",
        "indicator--bb3c2f35-a9a2-4d97-893f-b36e3dff1ba3",
        "indicator--4dc9759a-f92f-412e-8d7f-d5d5b05e6400",
        "indicator--17ed093a-4c79-4050-92b0-e9ef9bef2684",
        "indicator--0d5dd88f-5757-46d0-9309-5054ed3357f2",
        "indicator--a053f927-2f75-406d-81e9-87beb4f21231",
        "indicator--4be34a8b-12c9-48e4-a31a-c2b4bdc2454d",
        "indicator--ed658101-1700-49eb-9c55-731b33726bed",
        "indicator--05399f35-4162-4825-afbd-d904d88415d2",
        "indicator--ee29da1d-cb57-4c92-a031-ec84109eea60",
        "indicator--f1f80c3e-dd62-4807-ac96-fde61bca66fb",
        "indicator--f721eea2-a3ab-4c64-826a-e4fa63bb99c0",
        "indicator--28fda1d0-e472-4d4a-90b9-ad1df83de198",
        "indicator--a4ffd61d-addb-4ac7-841d-e95686ff3b90",
        "indicator--eeb4c841-7351-4d70-a7e7-92345e01f98b",
        "indicator--18257931-c386-4689-bd96-499e81a7ed7c",
        "indicator--b48fd33f-2bef-46d0-a838-b0289f32e580",
        "indicator--8cd923b7-8c7e-4843-a7b7-4aafb3f9cfac",
        "indicator--c363e4a0-c4a1-481e-9870-358b217f7dc1",
        "indicator--88ee7fa0-cf65-4e38-b20f-83ab884c370f",
        "indicator--97d0f59a-4d67-489b-90b8-9f77afc25919",
        "indicator--428b13a0-af6f-45b5-bda9-bb8718d6b73d",
        "indicator--d25fb1d6-88e1-404e-abfb-6ec06ad94ba8",
        "indicator--f32e8bb5-eb0d-4de4-8405-81c8cb966d65",
        "indicator--5d0e47db-a7e8-4fbd-8e2c-165e7d8255ca",
        "indicator--c3f2107d-6c00-4839-a748-84b011bcc10a",
        "indicator--2ef6fb13-b474-438b-b19c-d689c381ef05",
        "indicator--826c8421-37e0-4c0a-8318-ea35d2b16b97",
        "indicator--df1eb664-e708-4d5b-864b-ce84d8a9e8c5",
        "indicator--a2f0c99c-5859-43e5-ae7e-11a97a8e8695",
        "indicator--677b0f76-049a-432a-9ffe-ecd53e530ab4",
        "indicator--61883f2e-71aa-442f-b9b2-a96d61abed5b",
        "indicator--fb81f16f-448f-4736-a608-12d4f90a7895",
        "indicator--5883bb84-68ba-4bdd-b1ff-f3b642735518",
        "indicator--a3f2c293-5167-46b4-9a02-8e14709d2d26",
        "indicator--7c321b0f-80ae-4ecd-9c8d-6d305aed95d8",
        "indicator--91972114-d7ed-4468-a2dc-b4e2b5a00cf0",
        "indicator--59f37f63-c2f9-46db-a2eb-bd5fdb4240d3",
        "indicator--bc33101d-7195-4ec1-a2d9-0d0184b6d5fb",
        "indicator--90782e9b-6a2f-418b-8029-d983b418a490",
        "indicator--fdfc767d-3012-402a-84b1-f55acece7c35",
        "indicator--a06d57a3-6d69-47db-8d9c-2a46d5bc8192",
        "indicator--9ae5ef12-5a67-4374-93e1-ddeb8f510ab8",
        "indicator--8d2b84f0-a6d4-4280-b1b8-f3dd70faf64d",
        "indicator--e19ada8e-071f-4f34-9b7b-df295da2ffca",
        "indicator--692c5a2b-ab35-4f63-a0c6-9ae80a249b26",
        "indicator--bdfed098-3063-4116-9841-19eb7779fd9e",
        "indicator--daa727b8-b7ed-40fd-af9d-51fe2d5ad3a1",
        "indicator--c2295769-b90c-4177-8960-fd140393922a",
        "indicator--ff196346-70ac-48b7-aa08-d27ff390d955",
        "indicator--35667023-4f52-44b2-81bd-3a85ac3dcc0f",
        "indicator--566d92f6-1198-4f93-92d1-4492949e2b2b",
        "indicator--990b99f0-80e9-4061-a997-9baeb575f31f",
        "indicator--bf2de3dc-ef35-4aef-9a20-2645f6846524",
        "indicator--c1872a5b-ff54-4b84-bce0-7ea4aefb9bc8",
        "indicator--c301aa11-2900-45c8-864f-5da22223ba1f",
        "indicator--2e4ace29-dd99-4801-89d5-1e0de7c9f0c2",
        "indicator--7233bf12-e2f5-41d4-911f-ab6a54154a9f",
        "indicator--7127e4af-e78b-44bc-9f01-2325af512f2c",
        "indicator--a8dfbcc2-4a97-4609-ac51-7381d23a8b1a",
        "indicator--7f5c226a-5425-42a0-b114-7590a5053532",
        "indicator--59085736-d867-43f6-bf97-0f1cf25a28af",
        "indicator--0c72b107-23c2-46b2-bfe6-d07197a68799",
        "indicator--351c6750-cbe2-4830-83df-41c9531cc870",
        "indicator--f9717278-6ab2-4098-b4f4-0ed507d9662f",
        "indicator--d7f3ceb6-2e25-4eaf-87cd-b345cb129140",
        "indicator--64a1d319-e416-46c8-bcaf-b74dd64ab01a",
        "indicator--0eb6477e-709c-4be7-94de-499f8f1517ca",
        "indicator--dca7cda3-87ae-45dd-8aa3-6ec089afeddf",
        "indicator--821d1789-daf2-456f-b5e5-eeb5f6dd3816",
        "indicator--d093e284-ce3c-4cc8-ae89-4c23145a5fc6",
        "indicator--068e6bb5-804b-4501-874a-877bae37a383",
        "indicator--360307a6-6ef4-4f32-8be4-7551024ea754",
        "indicator--ee65f894-bbb1-41d2-8546-7aa9bbdea6a6",
        "indicator--a9519e4f-b636-41a4-be54-e464e5749257",
        "indicator--36bc55d3-6224-40f3-b0e0-fee6469deefa",
        "indicator--8c42d68e-02b9-4acc-92bc-2fd5724f7b24",
        "indicator--76f35d21-e2f2-4f8a-95c7-6de8b666ae4d",
        "indicator--9c8b667b-f375-4f48-90e2-29e273dce9db",
        "indicator--c69d5fb8-40b8-495d-ac85-46db6a167325",
        "indicator--be1ef614-660d-4613-937c-5dd440910814",
        "indicator--71fc90f7-3031-4827-bd69-0b2c68b9cdfd",
        "indicator--a8a18360-02a6-40a3-a704-2882d23b5a0b",
        "indicator--26d135ce-5511-4765-a266-75d8756e6b4c",
        "indicator--8fa4d47e-12b0-4da3-9bab-404aa6724691",
        "indicator--ab54f0e4-4168-4707-9f9a-525cf385e062",
        "indicator--d42751d5-2061-4860-9919-61c318e30ac4",
        "indicator--28b7e96c-17cd-40c0-a6f2-fa66abe74b42",
        "indicator--7525bcf1-4314-4c0f-ac68-da2286508080",
        "indicator--0486ec42-cd2e-47a8-80ec-0b928c1f831e",
        "indicator--46a103a8-a262-423e-b330-a789c6dfb046",
        "indicator--21de56bc-f3b3-48b3-8886-dd27fe6f4278",
        "indicator--3788e15d-b735-4c90-8634-d847eafee109",
        "indicator--016df86d-a143-4275-9f46-7fc8212720a0",
        "indicator--afac0980-7d22-463c-80ec-868748b6b0f8",
        "indicator--36aff66c-644e-4830-b407-284f9e017b78",
        "indicator--1d70dfcf-15e5-4eca-a07e-7037fd59da3a",
        "indicator--96c2ffff-81f1-4b94-9768-1e1dc6f1dc4d",
        "indicator--8a233ca3-4998-4c93-83b4-5cf5a5ad79ac",
        "indicator--2d13ecce-bc09-4ce5-b8e6-20da17e7ed63",
        "indicator--60f213c1-da4c-4708-beba-23d9779e4a05",
        "indicator--b5f1eb1b-0c26-4750-af02-e16a6e94a029",
        "indicator--a544a7b2-ee0b-4afa-b9b0-23a08673a089",
        "indicator--6e72f6b9-ff8b-440b-89ae-8059b7caf90e",
        "indicator--d191a660-0b16-445b-a5e6-295dbad19a55",
        "indicator--95846250-70a0-4e7f-90e5-e517bfe4adf4",
        "indicator--da8ddf07-ba07-4689-9950-d02cab5567b5",
        "indicator--c66c4eef-7211-4408-aed3-70a445e276d1",
        "indicator--d6f6dedc-10d0-4ec1-8dcf-b356bca0f595",
        "indicator--94596175-4e57-4e86-93bc-deffbc03efa5",
        "indicator--29b3442f-f06a-48d9-9acf-5c1876ccc730",
        "indicator--de5039f5-43f2-4af9-8e42-086846a33770",
        "indicator--c2c2dd18-7533-435c-8d2b-1d797789ed9e",
        "indicator--8720210c-7044-41d9-ad75-cf434fe52d44",
        "indicator--8749a426-c832-4b64-8e8c-be33c1e01e64",
        "indicator--3431212b-71a0-4a60-81bf-d078032da9bb",
        "indicator--a9c2224c-6bef-421a-8166-37b2c99cd8e3",
        "indicator--cfd2ebfa-ba56-48f9-8b77-93d587d3d656",
        "indicator--23774ec6-59f4-4c1f-a22d-a1c0f58f0fc4",
        "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
        "indicator--1ce10881-54ed-4753-99ec-f281886c41a4",
        "indicator--137a961f-6999-4529-a951-236537f1e016",
        "indicator--30006ed8-fd23-4e85-9ecc-a4bc7804cf3c",
        "indicator--fe6cc1dc-b646-4128-b2a7-86f6ee0b4044",
        "indicator--d5724d5b-d6de-44d8-ae6d-912d9389e1a7",
        "indicator--b9ccb2d4-7474-4d06-b1e0-3a632714dc4f",
        "indicator--19883920-1d16-4649-88c4-55e8b40486b6",
        "indicator--079df935-db26-42de-99c8-274b17ff227b",
        "indicator--9eba8943-8c2f-420e-89c1-f6c4443b8ffa",
        "indicator--9b5590dd-c973-4a2d-821c-057fb452a5aa",
        "indicator--a8a5a697-3970-431b-b05a-afaea6bd0128",
        "indicator--efa9399f-ecf8-484f-abfa-060f4d505faa",
        "indicator--9e52a1a0-7a27-4a2f-930c-29eb52287ab0",
        "indicator--94f0ab99-5f02-4606-8926-98615918304f",
        "indicator--05da9e2e-d27b-4b54-834f-8384a301e30b",
        "indicator--23b56b94-0c8f-4cc9-afa5-09b853400b26",
        "indicator--f29352d4-2956-4813-a708-103112e303c8",
        "indicator--4c4d78d6-08fb-48b4-bf45-f7ba5db2d832",
        "indicator--080714b3-3de5-410f-b285-c5a830c2f834",
        "indicator--def3b2ec-404a-46ff-8aac-7f1eaa481c4d",
        "indicator--0cf49ea8-9e89-4b92-90c6-a2de6bac2695",
        "indicator--c453c8ac-e1ac-4fb2-97cd-d9025e4341a0",
        "indicator--a324169d-98cd-49e7-8446-80067d3e2722",
        "indicator--00055c8a-af74-4d5b-a002-c32f0b0ecf8c",
        "indicator--cc628057-cf6c-441d-b184-a05a0e800779",
        "indicator--bfe917a0-5871-4682-8c57-4262d48e74ff",
        "indicator--2cd6b6ad-116b-4cf3-aebf-7479f542db6b",
        "indicator--336bb054-c345-4edc-8904-b8310ccd3127",
        "indicator--cc957eef-0be9-4515-a232-b277e01846a9",
        "indicator--a8ed9102-746e-4216-85fb-cdbe84e2ccb7",
        "indicator--ec9c81da-c20a-4d4a-a325-73a3230b7e6e",
        "indicator--c79e292f-71c6-4c72-ba75-4102685db064",
        "indicator--908f3cce-7ed8-4d12-af3d-b65e1dd65d96",
        "indicator--b914b07f-7fd4-47a4-8491-9ffc85fcc8d9",
        "indicator--c5b2de4e-b12f-46a8-a34d-f5a5cc07cc4a",
        "indicator--dcce629b-9b5d-4a0c-86d0-934c9a8ac1b5",
        "indicator--81c801ee-1975-4d17-bfc8-f0009aee9e0c",
        "indicator--330f320b-4f3c-48ba-9e6e-b15f4095b47a",
        "indicator--adc0b2d7-8dc3-424f-b0a0-d22aebc3ee1c",
        "indicator--606708e8-9d0b-49d8-a379-c9899a88dc4b",
        "indicator--f364dbbc-4fa9-4153-86fe-cb7c49032ac0",
        "indicator--b3b9b88c-52aa-4609-ad1f-1e5b1f43cef6",
        "indicator--7ba511f7-362f-4c2b-93e4-95971c64bedc",
        "indicator--ed837419-6522-46c3-97bb-a257e6c267bd",
        "indicator--2af95ea8-f3dc-4e9a-994e-b609277f9927",
        "indicator--5b571c25-04f7-4f85-b048-603c1e22446c",
        "indicator--43ff2ade-52aa-4879-a9b2-350ec0b44a0c",
        "indicator--d4760efa-c1ff-4fae-beac-794bd982a261",
        "indicator--10bb9844-b64f-4eed-bcd3-7203965ba9b9",
        "indicator--a5c936ef-a875-401c-8889-93cfccf2a064",
        "indicator--1351e28d-90c1-4d3b-9013-98c90792cd0b",
        "indicator--2d42eb9f-d2da-4a61-8363-7b4ea1d1d93f",
        "indicator--4bcdec07-8071-43f7-8073-a1e9b9f300f0",
        "indicator--c85bf9ac-6e42-4f68-9352-16c73bc764dc",
        "indicator--4342f417-5b97-434c-9414-1cc23c1f5724",
        "indicator--49cf923f-6047-4c01-a355-0e75764e7a7e",
        "indicator--abe9af9e-b1b2-4581-bd7e-1259db241349",
        "indicator--ffb3bac5-32ca-434b-84fa-46600d3e3106",
        "indicator--fbe3db7f-7751-43ff-8353-96735979d23c",
        "indicator--be7ff182-da8c-49fb-92ed-d15926c31e3a",
        "indicator--c537c958-5684-41b2-9370-04ebc917514b",
        "indicator--82f24e57-e0e8-4e37-a993-93f275004040",
        "indicator--96510211-fc1a-490e-8420-3b699dc55af3",
        "indicator--09c5b029-e06f-4aac-90d6-6047deba4ddf",
        "indicator--afad4e05-1800-4442-847e-c56d600b5998",
        "indicator--3c287608-8d00-4455-998e-49b6ff5f6cc9",
        "indicator--8bae08a2-790b-4d37-a2f4-f833e3ef3fb9",
        "indicator--163b7800-2aaa-4ac4-aaf3-e4292d8aeff2",
        "indicator--735fe69f-ea17-4e5d-b866-1f6ffac93e64",
        "indicator--0e5959f1-b939-4b48-8f5b-37496e9d0ba9",
        "indicator--fc0f1455-1436-4447-8632-d3dca1fd6776",
        "indicator--7f7b8cd5-ee10-4b3d-ab85-b425bcf1758c",
        "indicator--8d9ab4cf-4498-4d67-82f7-c709990ce756",
        "indicator--69ae34fd-e72f-4453-a9c5-4d008e1bc4d9",
        "indicator--e6fc313a-f1e6-4ee0-a4be-962af2ef9050",
        "indicator--9c9a0ade-e06a-465b-8ba2-1fe732aa2b8b",
        "indicator--b0dba9ff-dc3b-447b-af62-4610b9c23bd3",
        "indicator--ad278eee-cf70-45e1-bb80-c97f35f4dd6e",
        "indicator--fbbbeca7-0e8b-4d1f-8f13-cd4cb2b14822",
        "indicator--abf0b2de-4276-4acb-8fcd-76b0d3db58de",
        "indicator--99c82b5f-889e-4682-8015-3ad158aabb9e",
        "indicator--6e2ecb29-d08a-46a3-8dfc-5221ba4af758",
        "indicator--98121836-56b0-4c86-a890-7d533854437c",
        "indicator--45dcc314-4f5a-4d2d-8777-17d5510ef94f",
        "indicator--b26596fc-dbe4-4c32-8d0a-9577a010cc49",
        "indicator--9a83f710-0bc4-4797-85d1-1b66ed2316db",
        "indicator--4211ca5d-d958-4a7d-966c-f6c098a3de38",
        "indicator--983fbc8a-3477-4e05-9c36-d0fd15ecc048",
        "indicator--44afcb42-d37f-43c4-9322-f3d3044743ba",
        "indicator--daa99f6c-3211-4f7d-adfd-a69c993a8368",
        "indicator--cc094863-4a41-4935-bdfc-02032c4f4b96",
        "indicator--989d08a2-a547-4a57-a4c2-0f393840af00",
        "indicator--8bff66d1-98b2-45d5-9523-2e503d4b06e6",
        "indicator--9d0572fe-0ea7-41dc-8207-f3f6048bca1b",
        "indicator--c5d4e221-c8df-48da-85e7-318e4faec334",
        "indicator--082f5f14-2214-42e9-b893-f60650b69d51",
        "indicator--4e46b47b-f645-4049-b265-e1b472786020",
        "indicator--46a3bc73-7c1f-4a2d-9593-462207dff9c1",
        "indicator--89ec3059-22e1-4f49-aba6-8f936123cd7d",
        "indicator--66148da9-103b-430b-815a-958c22ee0920",
        "indicator--99b1e952-2624-49ee-8eba-7faf7548bd81",
        "indicator--83c74af0-06b5-44f7-a457-9e8bad8ec33d",
        "indicator--311dd54b-83b3-4032-a408-e8abe9ed8bc0",
        "indicator--ef8e3ddc-0f12-4f06-b53c-3c11890c56c1",
        "indicator--9aa1811a-3223-4414-a09f-bb1e16ce92a7",
        "indicator--bbf84186-6e7a-4caf-a134-15926f8b10e1",
        "indicator--562eabc6-25da-433d-bc5c-fd19158ea163",
        "indicator--ab19ea38-fe00-4695-b188-464d8c549de2",
        "indicator--c2f9443e-8dac-47ba-97d5-d24bc8724ce0",
        "indicator--5f309b36-6547-4491-8689-39b85d4bcec9",
        "indicator--48c96873-b9c4-4aea-93e0-628d2efcdd6d",
        "indicator--e63a5135-ce20-469c-b900-c8a98bf401cd",
        "indicator--4d4d26e3-589d-4bd5-becd-21d36d898ec2",
        "indicator--858f6349-b242-41fc-a083-22bcd579e0b4",
        "indicator--8178b7e5-124f-4fa5-92c4-3b24af4e0f0a",
        "indicator--9ac952f4-9bf2-4b22-a709-97ca9d0b868c",
        "indicator--f5b63a64-bcd3-4d87-a366-df387c22db0a",
        "indicator--bdd126a6-2d7e-4ad2-8f84-b0e86e01b8d0",
        "indicator--e7192a67-a376-4489-b7ee-62f833596aab",
        "indicator--192f198d-1fe0-4ce1-80d2-7330f1f37def",
        "indicator--7628f64b-27a0-4261-9183-ded40c0097ef",
        "indicator--5221a78d-faca-49f8-889c-84bf32b8eda4",
        "indicator--bb69ddce-c65d-4de2-b8d2-c0ae9f41ed56",
        "indicator--b6b98985-0ebe-4889-ae2a-2de2f8eb7399",
        "indicator--ee6bc55f-d597-4279-8c02-a11120fbb18d",
        "indicator--0f6bf8f8-beb1-4371-beda-1428aed01545",
        "indicator--a14b5ac0-be08-4020-8a38-fa319b39a583",
        "indicator--e299dc71-8d8c-47c7-988a-4e2831106c4f",
        "indicator--e2345ba1-3a74-479a-817b-dc147e117d9f",
        "indicator--6cdb775f-fcfc-4da6-b9c9-6e4b4723beae",
        "indicator--fa1b04d0-1682-413d-bdfe-5b0502b989fe",
        "indicator--5f74999b-7ce4-4d88-87fa-e0d1ff3c1164",
        "indicator--faa994ad-831d-40eb-bbfe-df1992b302e3",
        "indicator--db7a33f8-383a-48e5-8ecd-d39459e00d74",
        "indicator--268d43fe-54f3-4de6-80ff-8b537c88e01e",
        "indicator--1692ac69-0145-4d65-be3d-37a6cb244d67",
        "indicator--6083eda7-aca2-4af8-bc20-d36152e0e5da",
        "indicator--06838dd0-65d0-4b77-aabc-5ec811c9cf27",
        "indicator--da342d4d-b25b-4289-9afe-e5f40afd26e0",
        "indicator--fa5423f8-6894-4eba-b4cd-fdf18c39bb47",
        "indicator--159ab205-c168-4fec-9aa2-7e6eae7f81e8",
        "indicator--02233260-9932-4056-b92c-67fcac37ef9a",
        "indicator--40b0e6ad-060b-4d0b-8532-a43648859ec8",
        "indicator--11a8ee0d-a036-4ab4-a174-d0228d25d4f6",
        "indicator--debdce57-4015-4471-8218-bff52e80f4ae",
        "indicator--cb931ad9-dbff-4283-a787-2ddb5a09992a",
        "indicator--8e647bc5-6a19-49d7-a560-7bbcac060f89",
        "indicator--7ad2f004-3842-4fdc-8cc7-48cd88c032b3",
        "indicator--006ad327-51c0-4681-a976-555c34346c2a",
        "indicator--63b59e9d-b63e-46ac-ab43-bcce5138e02d",
        "indicator--fb8302fd-cb82-4f8d-be32-4b2df96bd950",
        "indicator--cb83aeeb-95b5-4b89-8c49-ad44f0eef02e",
        "indicator--8926f3d6-9cbd-42e9-9fa5-e90a1142d475",
        "indicator--8f101f7e-442c-450c-96ad-8d41309d0bde",
        "indicator--d352157d-6710-4048-82a3-ba3c512f73a9",
        "indicator--ff92b26f-95a4-4ac5-886d-7f8373af19fe",
        "indicator--2b9e869d-34be-423c-9b9c-a45771ca1225",
        "indicator--8df60de4-961e-467a-9cf6-17e1e6b059b7",
        "indicator--96e05b5c-9b8b-4aad-878b-dd5a2bdb6c0d",
        "indicator--462cf62a-249e-49de-bd02-85351ffa63dc",
        "indicator--e16710ef-1bb2-4f71-90c8-e948f14b14a0",
        "indicator--2122837a-2e82-43b9-b2f4-86012a485028",
        "indicator--02d5cd52-0c71-4ed6-aca0-d84179ead431",
        "indicator--f34df281-e5e8-4fc4-a502-a983359d300f",
        "indicator--85f8db57-5973-4866-988a-6e38f0f4ce33",
        "indicator--4234a393-41c6-4be0-ab01-7b882472d3e2",
        "indicator--451b5bd4-4d83-4093-87a2-fe1b22a3991e",
        "indicator--01fe5d46-1de5-4438-a651-46e9e06c65d5",
        "indicator--5857159d-0396-49df-8d41-fb4a48358d29",
        "indicator--1fa5c130-249e-43f6-b32e-7fed05fa8c23",
        "indicator--6897122e-8fab-4378-93fd-379ae2520044",
        "indicator--5ffe9873-fa6e-456d-8128-5a9d8215b2e2",
        "indicator--2d001cc9-9f16-47a2-afa3-82ede3187b9c",
        "indicator--a85e8d80-8fe4-4e7c-840b-40ed03f9a870",
        "indicator--7d09b486-3704-4711-bb11-6aae62ae00cc",
        "indicator--587c49ff-1c79-420e-8f88-47b9dc79975e",
        "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
        "indicator--4565845a-a40c-4578-a541-f050d55ec552",
        "indicator--9a00e738-a9dc-482f-a99f-cebdfeee4267",
        "indicator--c5681b3e-bbf8-4923-b276-4a750ec086c2",
        "indicator--cee91b2c-1ec4-4052-9e37-d2641b53a4d7",
        "indicator--491281af-27b5-476a-a663-7f57af064da6",
        "indicator--641e1caf-6329-431f-9e4d-bee73f2e251a",
        "indicator--d1f1d5b8-4e20-480c-a22b-0254af135760",
        "indicator--5ee36acd-4492-4b81-af8f-a7b19bbef225",
        "indicator--fb482bfd-6761-4beb-bdf4-e0857104c658",
        "indicator--59c49b22-ecdb-4403-bee8-1b8d5f366e40",
        "indicator--c4ad5430-c997-4d8b-8172-8129928db964",
        "indicator--f803cf56-789f-4dfc-bc84-29ad7568441b",
        "indicator--ebfdfe3c-75e3-4579-a410-3ac420a45e19",
        "indicator--fab26337-04fe-4ee7-9e35-0f6f602b022c",
        "indicator--e7f77cf4-e766-4d18-bc4b-8c0ac57250d7",
        "indicator--6223c9be-241f-4c0a-820c-7db27162a6dd",
        "indicator--e580176e-93be-427a-a77d-7c99d3f9e71c",
        "indicator--7f046e30-a298-4a36-9775-412082a5628f",
        "indicator--b1f79f88-096c-4fa4-8863-b20db424a5f2",
        "indicator--764ba615-e128-44bb-94d4-45534eb61bba",
        "indicator--41887a75-9db2-4941-b924-805c0f4c8b78",
        "indicator--ef394677-8aeb-4a43-9e11-ebf49934e9cb",
        "indicator--8a2412ae-965a-4450-a766-59aac6a05a1e",
        "indicator--4d89fed2-e906-41d3-8b32-70e111821041",
        "indicator--f09aa564-5065-4622-b2d1-f4e037f26ad8",
        "indicator--bb036d14-ccbe-4d4f-be31-e7a26be8d17c",
        "indicator--c23c7daa-b2ba-4716-b104-36839b37d5da",
        "indicator--c569d0da-4f7e-4fdf-92dc-42ac37a452f9",
        "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
        "indicator--7e45a76c-6a12-4159-b430-c9681bd905a1",
        "indicator--82b74816-7825-4241-a8fb-ac74618c8011",
        "indicator--54c772d4-4422-4542-bf33-6e31e6d9e3f9",
        "indicator--c2e4cc87-c196-4fe6-883f-663e5a2884f7",
        "indicator--79475ebc-ae55-4861-9935-dcc4c74de0bd",
        "indicator--8b9da76b-9f7d-4dbb-b6b2-333075f3b9f8",
        "indicator--4b289e86-58d0-4cc7-9d9a-ad770a47205d",
        "indicator--43c5af08-cdc0-4e23-b1fc-159dba807df3",
        "indicator--e7ac0d59-de9e-4844-b044-984b4db868f2",
        "indicator--0a77590f-8854-46e5-94e4-fc4d7c7c5a93",
        "indicator--d56b9b27-68b1-4c91-bf60-e2fb9fd6a2cb",
        "indicator--bd8d326f-eb42-4bf7-a560-d27a1e2bdb5d",
        "indicator--ef03062f-8d9d-46e8-9832-ada951cf23a4",
        "indicator--4893e3de-11f2-4b63-a1ca-fdd0919b4869",
        "indicator--e14d2941-9e09-455f-be46-e07dca5499fb",
        "indicator--1500edad-7eeb-4cd2-869b-f605e59be349",
        "indicator--8a0528da-1164-4619-8fed-cdaa320d5ef1",
        "indicator--c0eee4fe-ac97-42f5-b6a2-dd265da5fa47",
        "indicator--3ca76aed-d25f-455d-886e-1749b769cbbd",
        "indicator--6708445f-3152-41bc-825a-edf28f490f83",
        "indicator--f10b47ca-ac85-4a87-832d-f5185f8de47d",
        "indicator--9c44c6fe-73d4-4af6-9a88-dfcf340fa1ff",
        "indicator--3d2b9df0-2605-461f-b810-78f14ddb214b",
        "indicator--3eebc7f0-feda-4bd4-b6c4-0064ad56f208",
        "indicator--a31b6641-8032-4cec-8ebc-b244f0c1634c",
        "indicator--c534357b-5bf4-4629-815c-380e19bb029b",
        "indicator--703a5ba5-b1d1-4cd4-b7fd-e47df7edd98f",
        "indicator--deb877a6-9667-49cc-a340-70ce60ea5240",
        "indicator--4a647149-f517-44c5-823d-bd555dbe8295",
        "indicator--067bb73f-f3b1-4234-a3c3-d435b3fd53e5",
        "indicator--5b3c0f10-7832-449e-8050-c3bee9222203",
        "indicator--a93d7a11-bbc9-4d20-b451-2707a5117f95",
        "indicator--98f7fc97-ed75-400b-a500-c5c507a51b85",
        "indicator--c644a39b-600b-4e15-bc16-b070daa4197b",
        "indicator--5fb02b09-8a32-477b-998e-058444ad0756",
        "indicator--26987f88-892a-4d84-a92c-5aac841dc215",
        "indicator--6806aeaf-c013-4c29-bc24-ce8e5903ae15",
        "indicator--7f61e51e-ec52-4b08-aebb-0be0e663da3c",
        "indicator--0e5018fa-1899-428b-bf9b-eabf9cdf592d",
        "indicator--7d71af26-ae35-44a8-962e-75809d85b2e5",
        "indicator--bfd4ce11-9cdf-46bc-a1f2-e2b9a447f73d",
        "indicator--d2ca6033-fe1d-4174-9e17-daeeeddb4047",
        "indicator--5755eae8-fe92-4c25-b0ad-1f4b152d5f45",
        "indicator--6798f163-2de9-4e5c-8f0a-7626186f73e9",
        "indicator--56ee6284-77dc-4d35-8238-08492da9d86d",
        "indicator--aabfbbec-43ca-4edf-a0a4-9403ecc4f67b",
        "indicator--2c7786b8-ebac-482b-8153-b4fe6bda475b",
        "indicator--f18807b8-4e22-4889-a390-0f770f7405cb",
        "indicator--52fe56b4-1f4e-4aec-b4d7-bd090c4ffd24",
        "indicator--5a5a6a33-157d-4db9-8134-adeb932fed14",
        "indicator--b7f0c4cc-f010-467e-b2bd-190704ea5f1b",
        "indicator--37cd996d-c2be-494a-8f08-bcf492b25fe5",
        "indicator--06757af2-e5c7-413c-a30b-2aef0e430ad2",
        "indicator--ebea11fd-2162-4626-b0e3-1afa2c76e292",
        "indicator--9617d9e2-65e7-46fa-bf34-a76a515a91fd",
        "indicator--587db14e-0759-4e25-8bbd-2434b4701a4b",
        "indicator--8ee63fde-2e0f-40f3-b4cd-3b193cf84d3c",
        "indicator--c052e55e-9b6f-4941-98a8-2944861d6859",
        "indicator--23768dce-df70-4573-8abc-8970c551ecec",
        "indicator--765bf693-119f-4900-89ac-e6ff860f25d5",
        "indicator--99f24965-aee6-4095-88c7-ac0dcbb62ed0",
        "indicator--528d057f-7ec1-4bfb-bc36-77d5949ca368",
        "indicator--1e7db2d7-2afa-4ed5-97f9-36531282066a",
        "indicator--f2226a69-1e3a-412a-ac90-3459ac51a2c1",
        "indicator--20f47096-70eb-407c-ad78-329e86b7258e",
        "indicator--b40400f5-162b-42fb-bdf1-76fba6149932",
        "indicator--7a35054a-bb54-4f0e-9330-20d959fb6fbb",
        "indicator--c8c0270d-2607-406b-8e0e-a1e3d90c08d6",
        "indicator--d833e2a4-e5a3-4bd3-bf70-615581fd3cea",
        "indicator--3ff3762d-cc7a-4023-94d8-b742a94edb49",
        "indicator--31fbdd45-aa1d-4c05-bc0e-2b13b11cbbae",
        "indicator--6ea4cdd6-a3b2-46fa-b1ba-7420cab7607e",
        "indicator--22f7db4e-3477-4aae-b2b1-d57ced56da02",
        "indicator--32259131-2bf2-4ddf-ac1f-acb694037611",
        "indicator--24495265-c15c-452d-9854-5d4a4a3c4db9",
        "indicator--dc7ec6fd-c5c1-4e32-bbc3-6ecc7bc34504",
        "indicator--2a6119d8-aff7-4ba4-85d4-43267cafe813",
        "indicator--4e075342-9fb6-4e23-bf42-687dccfaccd2",
        "indicator--308553fd-c591-4fa9-ae09-60011d6f8bd6",
        "indicator--779c0f72-25d0-444d-a57d-187b6069a18a",
        "indicator--f5031ef2-314f-4caf-ad26-021337519975",
        "indicator--e72de6a4-0274-48b8-bd21-07caa3addfb1",
        "indicator--111cef18-3d48-49aa-9ddd-9cd0f8ecc422",
        "indicator--f5b1959c-81c2-4d17-a23e-e8688cbce9a1",
        "indicator--0cfaf03a-d2c0-49f7-a3fc-b44bb7cfc777",
        "indicator--e0319b40-285f-460d-95bd-60530de7d57d",
        "indicator--5d4edaea-2ac4-40d6-821b-7e0edfd0ad22",
        "indicator--ef8044c1-0f35-49b2-8fb4-9118afcdc72c",
        "indicator--d8e2ebbc-28c3-4464-b49f-bbb054edec07",
        "indicator--bdca4929-3435-424a-afc0-7cc21f7db0b5",
        "indicator--e0abc76d-9ce2-433e-ab9d-0f00ae36ff38",
        "indicator--ba9af086-c53c-451d-b530-c13d13d3a431",
        "indicator--c3be4557-c1c3-4052-96a8-1c5000f67fcc",
        "indicator--a3a4ea1c-4304-44bd-b67b-f82a2294018d",
        "indicator--c7e96d16-cee6-4ab1-8096-06e9e4477f16",
        "indicator--44acd02e-58db-4cb9-8be9-613a0a4fefd2",
        "indicator--8b1ce6ca-1864-442c-811b-ae3685f230ae",
        "indicator--c800b6d3-6259-4b7f-8743-7f76e863a4bd",
        "indicator--3954758c-fffa-4d00-81a6-85a7b681287b",
        "indicator--e64d950c-e45f-49e9-81f9-1f2898487698",
        "indicator--e9846527-83bc-435a-8ca1-0c5af823b0fb",
        "indicator--e372d4db-9ddc-4de8-8225-9fa5565694f5",
        "indicator--296190d1-bff4-47ed-856d-f86fcbbf8fc5",
        "indicator--9623d3a1-a311-44da-8a84-7f6e40872145",
        "indicator--daf3d85b-e142-4250-b8bf-6e4a31949b90",
        "indicator--46db8633-34a9-4b11-9ee4-2e5c1ac55cb9",
        "indicator--18828608-becb-493b-8fad-ea8c3f3bec0f",
        "indicator--95daa7be-854e-4280-a251-955ad709c6a6",
        "indicator--b18fd9d3-9ee9-43b6-a0b2-e60ffe01cae7",
        "indicator--0d706121-3b5d-488f-bea6-ef9ce580851a",
        "indicator--b6e15e33-be81-442f-b135-46f2c7eca709",
        "indicator--07040373-6541-4c71-b622-0030b62be8ae",
        "indicator--67d6a01d-fe77-4d7f-a3b3-e729cc7dd719",
        "indicator--e11fc31c-7cf4-4130-959d-ef5fb9e5efcc",
        "indicator--9b4d115c-c20f-4429-a818-c70180c27fa6",
        "indicator--bd78a04f-84ba-4b82-aca5-ffba397a4466",
        "indicator--b3878d94-f634-47c0-a170-47b0a3a8c0a5",
        "indicator--c5faa591-94ec-4129-8048-28f1a961ab7c",
        "indicator--33f3cfd4-b7f9-4bb4-bbd5-1cdb59613f0e",
        "indicator--7fde891f-2599-4ead-bba2-40dd842c9f33",
        "indicator--0d4cb208-71d4-4408-bcec-bc907474a351",
        "indicator--ea92a6cf-c511-4645-bcd2-09bbc69784a2",
        "indicator--e550a2d5-b28d-425d-8ee4-0de3c650a63b",
        "indicator--e5a5a733-11b6-4c25-b445-d54ccb8f2a21",
        "indicator--266ccfa5-8adb-402b-9658-98817b797357",
        "indicator--60df10ca-c556-42da-9d19-b3498dafc11d",
        "indicator--6293a25e-77e6-4a86-a4fc-d473f336ebd7",
        "indicator--7a6bdbf1-543c-4187-bbf3-249a886d0f7c",
        "indicator--e3f1de0b-42ca-40ff-aabb-3ea2e37f9ddc",
        "indicator--96686af8-9aed-49ba-9649-47a68277fc27",
        "indicator--deb9c549-9df8-4e3e-bc2f-94ecc64cc843",
        "indicator--c7d1a011-dea1-400f-9223-54bc151599c7",
        "indicator--ea62c971-51a3-4045-8f4d-e39a8aaf5b12",
        "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
        "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
        "indicator--2fdf135c-f7d4-486b-9efc-eec7121f0d48",
        "indicator--2268ce58-b03a-45ee-9e48-5cdf88ce2db0",
        "indicator--d674daa2-a481-4e9d-a8f7-1fb48a3ab897",
        "indicator--38ecce0b-8d0d-4171-9cf0-0ac5ee649f4a",
        "indicator--7d13c679-80ce-48bd-95e6-f437976d3771",
        "indicator--a1f0dec9-5c5a-4a4b-bafd-e25b2b140209",
        "indicator--aef91ff3-eb98-4f88-a21a-b0a0d8224d36",
        "indicator--9d10795b-0387-4120-a54a-d5fe0c4fe805",
        "indicator--8b41574f-b1f4-4958-9110-d73a2399cbba",
        "indicator--d5dcc815-78e3-4f91-9742-9c42ed1eae87",
        "indicator--e40b8e6b-ba12-4211-91e5-c8b7ee0bc5a6",
        "indicator--1343036e-db10-4d9f-bab5-46b8c73c638d",
        "indicator--1b1b1deb-f92e-49b8-9eb5-510d627b7de2",
        "indicator--90cb250f-5ec8-4641-afd1-ad2edd088ef9",
        "indicator--3100fd8a-32e4-4f1b-a49f-b39bc9e3d112",
        "indicator--81598e0c-a02b-43be-895c-e6df677afd95",
        "indicator--2bb41f1e-329a-44b9-b9f9-aabbcb2a8b62",
        "indicator--72209dae-5c1b-4757-87be-0e9c432dbec6",
        "indicator--3a28b036-040b-48fb-a060-7a509e3ab825",
        "indicator--e1c74a16-8c84-4668-a8ce-37d2404fd8f4",
        "indicator--446a7206-69ce-4e3a-9a4d-9c6ad641ecb7",
        "indicator--2625fffc-3bf0-41b1-92e5-af1de6e07386",
        "indicator--5e316052-a2a2-42ba-8ddd-49e5c21535ba",
        "indicator--59656fbb-2e85-41b8-b76f-5a278349fb4d",
        "indicator--af6fe0b0-8cd6-42b5-a33d-b7ddf31601ff",
        "indicator--b158640e-a57a-401a-8210-9c5a77f366b6",
        "indicator--ef3214a5-161b-4f82-8b98-cf6fe85e4fff",
        "indicator--d2a040a1-7214-4a6c-8eea-5b30439d4d48",
        "indicator--338cbdd7-7e35-448e-9b18-b985e40006a5",
        "indicator--96913820-ac0c-498c-affe-28b4727305e7",
        "indicator--1cf55bfe-229b-4c2a-9677-a313dd3100c7",
        "indicator--d2e7ab9d-e212-4f80-97f1-90a217336bfa",
        "indicator--964e44ad-7e28-4404-b5c6-dc9afae3a8b3",
        "indicator--2a0f891a-384a-40b0-a2e8-a86937090313",
        "indicator--4c4b7627-8f4f-4b0c-9caa-0428222b0d2a",
        "indicator--48d2c30b-dc39-4f48-b339-de9595faa2ba",
        "indicator--c2d9a263-3dd4-49f0-acd2-880e8a7d23b3",
        "indicator--f2d443eb-a333-4d45-ab8e-996864d9981b",
        "indicator--f1776c5f-4729-4bf7-a392-acd6bc7b35bf",
        "indicator--9a706b4a-a227-452a-a05c-44755eeb25e1",
        "indicator--71f33a7d-8b8b-45fb-86c6-e16fe235bf5b",
        "indicator--e358fc81-6acc-4dfb-9cbf-c47e41d8ee29",
        "indicator--fd4ac7f1-a18b-4a4e-a27e-0436077013c5",
        "indicator--20cebebe-7796-4568-bc51-295a2a00b523",
        "indicator--0169029d-6052-4cb5-9d45-f234012e4817",
        "indicator--be129a9f-4a79-4529-a8e5-197fdd7a0fae",
        "indicator--b1ad1331-4ff8-4f2f-9f92-465c087fb24b",
        "indicator--995982d0-4547-42c0-a5d8-44c27ca58eb2",
        "indicator--a232169d-2614-49b1-9b32-1a07d9f37a05",
        "indicator--55d8f250-6626-4615-88fe-0f9b62e92ead",
        "indicator--672c756e-c310-45a6-bcc3-9b9280f34009",
        "indicator--1f444884-23fc-4c37-9366-9183657ea076",
        "indicator--aabdc9eb-8394-447e-9f03-5ebb2f0be33a",
        "indicator--cbd15d33-a927-45d3-816e-b7a53a219a81",
        "indicator--525b1a6e-0aa9-45a9-8ca2-894ae29d3dab",
        "indicator--689884ac-67a3-4a28-aefb-181844214038",
        "indicator--2a09f399-b199-474f-8a88-770c265423c8",
        "indicator--95842cdd-721e-4052-a46f-8041b3ce2597",
        "indicator--d277c586-5676-40d0-9525-1c8a4b37f4c0",
        "indicator--cdbc9416-f91f-4d58-985b-5eceac442d2e",
        "indicator--301c3910-35ed-44d8-9ffc-d3e4b474786a",
        "indicator--7717f42a-4a82-4753-9827-3fcf779a8944",
        "indicator--80ebe8fb-3119-4bf4-b1d3-fb9d11822a33",
        "indicator--a584109f-86eb-494e-8684-af026abca1ec",
        "indicator--5ef31886-d272-4784-8a91-2369c14942d4",
        "indicator--6cf2b7f1-a982-4faf-a5f4-eb7136cbc1fa",
        "indicator--6e1e27d9-465c-4518-93bf-d6268e9bc3d0",
        "indicator--f987636a-f354-4677-aecc-d4215080891a",
        "indicator--df2eee68-aba6-414a-887d-4c5786ef37e4",
        "indicator--82f51c08-ac64-466e-ab00-cd3015acf316",
        "indicator--d0d69d55-4062-4a24-8250-70e73944d1d6",
        "indicator--e38769d9-826a-456e-9d44-352fba0bafe2",
        "indicator--76a30736-327d-4264-b31a-dd90fffac10a",
        "indicator--0b59f52a-fb08-4f4f-8a50-9960a78aefe4",
        "indicator--f48dfbf4-1f73-4834-bdaf-f641505caf52",
        "indicator--6510a178-d671-4a81-a60d-0f0d9a905baa",
        "indicator--b512398b-6b62-40f0-bbb0-0044ca7e89e9",
        "indicator--528788ae-8417-431f-bd7c-7d0b92a70361",
        "indicator--f9c98ef3-79f7-449e-99a1-3b6d2977a923",
        "indicator--91088b24-1e1f-41b5-b005-a4c609df4ec9",
        "indicator--5f198d84-0c1e-4750-9212-629de4a63067",
        "indicator--c44b28fc-7ce9-4dd5-a416-1d17d7dad3e5",
        "indicator--d5c3bcd7-f81e-4d29-91e1-414829f0e695",
        "indicator--12f03950-dac7-4f2f-9aa4-967cf6da985a",
        "indicator--91b4e12f-cfe9-45dd-a3fb-2f6e589c050d",
        "indicator--4f5fb166-0597-4e4a-a78d-df15481f5d40",
        "indicator--ec9bf603-c7e7-4c35-b058-331ca6732142",
        "indicator--f85b0e01-869f-4f8c-afac-b33da755847e",
        "indicator--d86b4e83-d8de-4c13-8dfb-fdb5ed4372d5",
        "indicator--8dbd38ec-ec01-49a6-b9d8-587a879d1211",
        "indicator--f50ecfe9-0ee4-4743-9099-e04743e350f6",
        "indicator--e5ea6ef0-39f8-476e-a6ec-2ea2c90d47d0",
        "indicator--db81c215-aa54-46a7-991f-e56e29be14b4",
        "indicator--2d782603-ec2a-405e-b887-c56bdb3841b7",
        "indicator--d88697a6-386c-4b06-bbf2-d3fb30847576",
        "indicator--510f85d5-991b-42c1-ac79-53b88628c2a4",
        "indicator--a67d7928-b797-4471-8332-8b2ef3f6a909",
        "indicator--323e51fa-10dc-41eb-80d2-3cac97bf65a4",
        "indicator--4eb2e83a-c5c9-4b17-8503-76f2360b2982",
        "indicator--26ce1d67-6932-41d6-bccf-4fab64204a05",
        "indicator--1b9e5462-4ce4-4f75-944b-070e719ceda3",
        "indicator--805e7329-8c11-45b3-b1a7-58ee9cbc915f",
        "indicator--d9407394-65b3-4c19-96c7-5abcc5b0afc3",
        "indicator--9ccef0b1-bd2d-4c92-9137-7b3fecb1866d",
        "indicator--57ab1f7a-55ab-4ab9-98f8-e74e0a090047",
        "indicator--490fc743-3048-415d-ab42-09fb19b38b32",
        "indicator--d777950c-0048-49fe-bbd3-caaef1800054",
        "indicator--749d72ad-d6a6-4067-899d-c8508921e4d4",
        "indicator--d8264224-a1ea-4b80-abf0-aae412a98616",
        "indicator--525c6299-8bcf-4dc0-a444-65e8a615df23",
        "indicator--8dbac943-1b72-433d-95de-6e8f422f1a5a",
        "indicator--c2daf7d3-664a-43c3-8b0f-58c50edf0314",
        "indicator--26031dd6-fa3b-4b3b-a078-293ece295ebe",
        "indicator--1cd09269-898b-40fa-9c69-9e34bebb864d",
        "indicator--7c06932e-0038-4043-a3cb-d63cee8ea502",
        "indicator--ed1e9dc8-900c-47a0-b760-3cad1e18f23c",
        "indicator--124fc5b8-d790-48dd-a521-e7d91b6ba35c",
        "indicator--0e023db2-402a-4ee3-9387-e6fa63dfa56f",
        "indicator--3e348ae2-cdd7-4c11-864f-88442c815d6e",
        "indicator--ecce6e9d-a116-4bc8-b01d-6b651319d161",
        "indicator--6e9f13f6-6845-483b-9340-2a206c8d7279",
        "indicator--c73e8381-1b10-4bed-bc94-333646ecb29a",
        "indicator--cf43a14d-95e3-4f29-bd96-2a623da1f91a",
        "indicator--8942b857-f684-433f-9a46-daf182b012b9",
        "indicator--408ae202-829b-4b88-9c0d-c4501cd37453",
        "indicator--282d8010-13d3-48b3-8bd1-8c56c78e227d",
        "indicator--5f300c2f-bf26-483a-9815-7708b47bbf96",
        "indicator--261385cd-f14e-4277-b19a-fd20659adf8e",
        "indicator--72cef475-3686-44ad-a870-d1e60c5b097c",
        "indicator--a913cfa1-c87c-4cb9-8c86-2424f2230167",
        "indicator--95ca544e-7e03-4da3-a549-326c95b2096b",
        "indicator--1a5c7b7f-7b5f-4a82-8e8b-2e62da2791a5",
        "indicator--0ae7d10f-e03b-48ff-a55d-247656dc79da",
        "indicator--978dbe1c-f298-4762-b348-58869170b844",
        "indicator--b0efbe83-00e0-4eec-b8a8-5c645337e907",
        "indicator--a986bbfa-a5d7-4e06-9475-2f1e1542fa88",
        "indicator--8e7535d8-c752-4baf-acdd-a978d3db3864",
        "indicator--81751946-f124-45d0-8e5f-467f5169b905",
        "indicator--8d346e45-5590-4513-8973-96d3b09d36c6",
        "indicator--a0721c6f-4b58-4d91-995c-dfa009ff5c65",
        "indicator--0fc4ee3a-5347-4020-8fe7-37bea9ed32b3",
        "indicator--ed5d2a42-8b60-488d-8c56-73a09ac5e601",
        "indicator--625961f7-b92e-4860-8b39-04677511eb45",
        "indicator--198d28a9-083b-4e65-81ff-87104afd1d4d",
        "indicator--a506b1d9-df4a-4952-be20-a3928d7d3c29",
        "indicator--2dcc92cf-8db4-4323-9e91-a1b04f9f30a9",
        "indicator--fdd5acfb-46ad-49d8-a97e-2cb61f411201",
        "indicator--84581add-349a-42a3-95b1-dfea7c244065",
        "indicator--c6737dee-e112-4c44-b89a-2eaf26037a55",
        "indicator--2ad2c8cb-c82c-4b60-8bb6-929a0967c9fd",
        "indicator--d3430560-7773-4bf2-88fa-435015e5161e",
        "indicator--e758931b-682a-415f-9b99-9a480b1339f3",
        "indicator--657eca16-6639-4c8e-b975-75e7b99d6672",
        "indicator--8ab10c14-acf7-4666-810c-ebdaaa2dcfe0",
        "indicator--d4d3ae78-4951-4aef-b899-2ff38e89edcf",
        "indicator--e2c86d63-acca-4e7e-98b8-fac997d93e7d",
        "indicator--8a2db97e-f27d-4032-8da4-d9628ee882c3",
        "indicator--24a4ec93-603c-4de7-b4b3-f4833e54ca1b",
        "indicator--fa3ea4c4-7b07-4ce9-a073-f7c617a64903",
        "indicator--b64049c1-182d-42a4-9c08-92782c077293",
        "indicator--626ac04a-a1d7-4f0c-9e4a-72af6f722cae",
        "indicator--aecd1c37-ab8e-4504-ab8c-eed9446eb382",
        "indicator--714321b6-6e33-49a8-95b1-1c5427af0eaf",
        "indicator--1637bc50-e212-43b6-aa31-888397d1f351",
        "indicator--add5fb33-0e99-4954-81d8-a2b4bd48c993",
        "indicator--dad0579f-d126-4f8a-8a77-3242ad547269",
        "indicator--95158ebb-87bc-4501-8ec2-b5274d624a5c",
        "indicator--4936fdb9-e455-4e2b-99b4-0d5b8caf6181",
        "indicator--f79e0a28-f34c-4639-8847-a896509ffb10",
        "indicator--87442ccc-622a-4323-9209-da7b57dc9ee0",
        "indicator--6cd21bd5-4d51-4c4e-bc14-d7f9e2cab4bf",
        "indicator--fb9fc491-11cb-4e35-96a8-010050d61c2d",
        "indicator--cbb1ab03-3e1e-4fcc-b9be-aae1634bb550",
        "indicator--4c06cf14-8da9-4781-a14e-b2c2b98cc2e1",
        "indicator--5d30d105-310a-4cdf-ae2d-3df22a70a853",
        "indicator--60a44f2a-414e-454c-8d0c-a62d479fa67f",
        "indicator--b2238cf4-5e78-40c4-98c1-4f0434b730e1",
        "indicator--db713fa9-f38f-49db-a1f0-10be71522e52",
        "indicator--25da4489-8add-4376-937b-e255d8c71830",
        "indicator--922ab6c7-d977-46b8-8716-613a8d2ac6e6",
        "indicator--7a810400-3a29-4991-913f-ab5f6df2f942",
        "indicator--5d9f34a8-c784-489d-9695-7de1b4f02102",
        "indicator--6cfb3a0a-53a1-499d-b779-8a76da597ac2",
        "indicator--890999a2-0bde-4ab0-8075-59162c47e123",
        "indicator--dfe23c38-cb56-42bc-ba7b-484a79fbb50d",
        "indicator--41c0762c-cabe-481a-8156-316f3cef8374",
        "indicator--23d05474-5ca2-49c0-9b3b-9d3a0f24f2ba",
        "indicator--b01b8994-66d8-4c5b-ac07-ec2353a935cd",
        "indicator--6e40000f-b2bf-48da-ad35-35e52cbba35e",
        "indicator--1861f74f-9487-46e3-b18d-99e2440cb955",
        "indicator--50fa8c54-6196-4e46-8e79-dc8f7a168a37",
        "indicator--53f9a07b-dba2-4595-963a-22c1b8db0e24",
        "indicator--0836008b-d448-489a-a54b-e668bedda1f9",
        "indicator--976ed7fb-565b-4a36-be45-ccddbe4eff22",
        "indicator--ddf61c6a-6a51-432a-9d72-4013f306075e",
        "indicator--709e0d1b-dcd4-4f31-b767-f85f260754e8",
        "indicator--db7007bf-9549-4101-9a40-ba53fa1985d0",
        "indicator--ee2de3a3-2a4c-4d89-bb39-b2d05fac3195",
        "indicator--481aee3d-98f4-41eb-99a8-ddab3bb22e3c",
        "indicator--cf96931b-1133-45ab-9109-bf10507122e5",
        "indicator--6cdef90f-9f8b-48f9-8b44-70b9d82bc2cd",
        "indicator--79f2653f-4f0f-4ff7-8238-a184b6b65a73",
        "indicator--e65f4b0d-25f0-4934-a05f-61ef5551144e",
        "indicator--a160ec3c-1106-452a-8ec5-f6113b24eb96",
        "indicator--d8644a6a-5279-4927-8b52-66fe0c083ac0",
        "indicator--1cd12ab1-5af5-4775-9c43-09dd8a95a5cc",
        "indicator--2a1b6318-1d31-4355-8d12-1959b9c51f79",
        "indicator--39c8d329-0745-4e30-931a-a0b21d57c969",
        "indicator--61a5989a-32c5-4085-a1bc-a594c37b52ae",
        "indicator--d8e9165b-5736-4aac-ac9a-66e94afc6ac0",
        "indicator--e479a962-6e02-4b74-b560-0b665b0baf4b",
        "indicator--f0a28f38-82ec-4fc6-b2b1-507258847046",
        "indicator--7bb5d84c-1c95-4ae5-93ec-5041f5c12abe",
        "indicator--a2c2ed99-ef08-4c2d-9c31-3b7db6a5c973",
        "indicator--c2cda5a4-c71b-432d-98d6-837af0c6b684",
        "indicator--d3315be6-4dbb-4ad8-9bae-0b36298efcbf",
        "indicator--1c1f9635-d716-4c2a-8cf9-4eacba2ad388",
        "indicator--ca7394e3-945a-4b08-90be-387578de9e85",
        "indicator--c9d1b60f-29d4-4a5c-9389-45f581656f95",
        "indicator--8490c861-8136-4aba-909d-442afa97b4d3",
        "indicator--04874bdc-25d2-4696-abea-1cd3c647c6b2",
        "indicator--cf376c66-5478-40a4-a421-1e5dbfe51fff",
        "indicator--324f513a-6b00-4c1a-894c-c21174ffed0d",
        "indicator--c0cdcaa6-d7c3-4470-b869-ed1269f02db0",
        "indicator--e3608d66-f07b-403b-aa7c-ec18f61f39cf",
        "indicator--325af008-451e-4f76-a730-8fb3b012b2ce",
        "indicator--344dd4b7-c1ac-4c36-80c7-96982966e346",
        "indicator--9271933b-b039-4fe7-8d49-7709d5c2dd7d",
        "indicator--e8032cb7-eeea-4fd5-bba2-21cc9403d0d4",
        "indicator--e64bd98a-7664-402e-bf08-fb2aaea85f1b",
        "indicator--84a47eda-ac42-4ce6-9f71-27af7bef8e47",
        "indicator--976004f3-ed7a-446a-bff6-49a899b26f6c",
        "indicator--e475b9e1-ace8-43c0-b43a-8be587b2581c",
        "indicator--96b31a2d-5da6-4099-aab6-cacbe42132fe",
        "indicator--28e7d3df-eb96-4ec5-b8b3-cd42398c8165",
        "indicator--7afca4b9-df73-462a-a9a3-00d31b28c7ff",
        "indicator--c4518a82-936a-44ad-a7f6-c33434dd32b4",
        "indicator--019b4100-d7f5-4bee-89d0-f2579383baf0",
        "indicator--5c6ebf13-fb48-4b02-90f5-126c207a577c",
        "indicator--1a083d9c-2d88-462b-827e-e41c9a7c06cc",
        "indicator--e41cc27b-6843-47e6-85cb-ccc5bcc7358d",
        "indicator--4dd89e05-950c-4d4b-b1a7-83c3917f546a",
        "indicator--e76cc576-3651-4782-90c8-13ea60df80ea",
        "indicator--5988ff9d-b49a-4b01-b680-5802f1e7521e",
        "indicator--65dc382e-1517-4c84-93e5-5ab16d59e95e",
        "indicator--bfae2fa0-768a-433e-be6c-1e589dbaafd5",
        "indicator--732130d5-9674-4f7a-b6ff-4dd2a3e1d21b",
        "indicator--c9c0d3af-6d0f-47f9-a581-577311e84e9a",
        "indicator--d14616e2-f901-4f37-a55b-aa0810f4ff70",
        "indicator--f91ce1fc-e1e3-47e0-8c12-a13904ac7fa3",
        "indicator--aa66f4ca-b1fd-4dc3-91e2-8bfcbbb0abce",
        "indicator--b16aed80-fbd7-4a83-b824-20a665dbe9f8",
        "indicator--e9e7b1ad-8ce5-46d0-9268-6f95507abea2",
        "indicator--b7bdd2d3-efc7-4cbb-86a9-18f2ae188698",
        "indicator--428b941b-4ed3-4290-83bb-81971a59efdb",
        "indicator--4c29051c-ab8f-46c5-94c4-8bdf66fdfe7f",
        "indicator--207ab1dd-982c-4464-8a93-cd5d0b6693c3",
        "indicator--586772c5-dfb7-4695-9433-f515686d684c",
        "indicator--89bd707f-3642-41d0-bef0-c00e013d0ea9",
        "indicator--defa62bb-b67b-48ba-92ea-590d0a3bc75a",
        "indicator--ff2dab89-71d3-4fec-a097-a561851b1e90",
        "indicator--11051d6b-2c20-4da8-80eb-b4206a1f2b10",
        "indicator--74ea515e-c79f-4b79-b7d1-8939ad912759",
        "indicator--886a7a37-4445-49d2-9024-011e77966e40",
        "indicator--da566040-5ec9-4158-9567-ba86e8661e5c",
        "indicator--465fc089-67b1-4f1f-9d8f-e5a6a1bc600c",
        "indicator--92eebc11-ef87-426b-bdc0-f101cda1d4d6",
        "indicator--1411dc02-5772-4300-b42e-2565dc345d0d",
        "indicator--80363844-d396-47fe-ac6b-d883d319be81",
        "indicator--bceee6c7-2843-4540-8b30-14ac8e5f2563",
        "indicator--c2a72d23-68f6-4162-a036-364d38f7e05c",
        "indicator--76a55ed7-daf1-403e-8ca6-85d673afcea3",
        "indicator--e4731af6-be8c-4b94-94c7-bc96ec42e51e",
        "indicator--59cff2fa-9f35-459d-933b-13eb9d0eccc9",
        "indicator--10b1e698-4e41-412c-b68f-2b9fe48f1ee2",
        "indicator--3bae8785-be9e-4157-aa70-bf90866d476e",
        "indicator--8f7f7905-6f08-4a38-be8d-2a7daa703557",
        "indicator--e8e3ad8a-1edd-409e-ace9-a868cd0ba694",
        "indicator--1e817110-e11b-4306-9f4e-7a56d08b08e6",
        "indicator--e66be9c6-1abe-402b-92ae-5b9e246b7cbc",
        "indicator--1eabc001-abe0-4b23-8055-532bea2628b8",
        "indicator--0cd350ba-0f74-4a0d-bb5d-6dcd0c2a53ba",
        "indicator--3c0cad22-dc09-43c8-a994-c7ec6827f73e",
        "indicator--5c66b249-56e1-424d-9a8a-a54d127c3641",
        "indicator--00abe1fb-a476-451d-9c8c-d6c691d41e10",
        "indicator--bce95130-0f8d-43e3-af98-e9c9b7b91876",
        "indicator--c5c53ae3-f830-4a63-95e3-e418b83a50b8",
        "indicator--23f9834d-218c-4bf4-9fda-836e627dde3f",
        "indicator--ff3b874b-c534-43aa-a469-61f1aa7798d8",
        "indicator--e0835a71-a575-4f39-af2f-808ef78e3cad",
        "indicator--753c01bc-7d19-403a-bd72-9d081caf1116",
        "indicator--0e98f9d3-7021-4664-9538-561a31d2b790",
        "indicator--215846dd-1a20-41d9-8e85-638e656c08d3",
        "indicator--1b4ab715-155c-438b-a6c9-dbf3cddfc88e",
        "indicator--3338227e-095c-4a91-a1f1-2a280a692126",
        "indicator--1b84dd48-0b9c-469f-a124-3bae17096b7b",
        "indicator--8f7fd3b0-8041-48ae-8b2b-539dda3e6d40",
        "indicator--10c785ad-b1aa-40d9-8c3b-01ccc59f1c6c",
        "indicator--fb97da81-623d-4fdb-b2d8-0a869d9429c0",
        "indicator--aee4ad8d-8a91-44b1-950e-32fe47d44579",
        "indicator--eaa8565e-68af-40d3-b370-48bf7bd8d9e3",
        "indicator--e2a557fe-2cc2-40bd-afdf-d0e768adeb25",
        "indicator--10e640e5-de14-4049-a678-80131c952cba",
        "indicator--8ab95c19-19e4-4d4f-8231-ee9bbae0d123",
        "indicator--ed0a506b-c46f-41e4-a5a6-0671d9499e2c",
        "indicator--a7f292fc-ed81-45fc-81b8-14be8bd1c4d1",
        "indicator--564be129-336d-4b60-b29e-c02a58cdc0cb",
        "indicator--d9375467-1019-4230-b7d7-f3084047f17b",
        "indicator--b05af8c2-d39c-46eb-8831-def9134ed819",
        "indicator--75144338-260c-4330-b046-7b03e62120d4",
        "indicator--8c1b5dde-f505-4b62-b9e2-1827cbc968c6",
        "indicator--434b4373-35ea-4397-a287-24b08f1fc4df",
        "indicator--0b5d4f3c-463f-488b-8604-d52304fdfcce",
        "indicator--36d81279-c337-4dde-ba92-5a03c9d0c7f4",
        "indicator--1b795a3e-89a2-4e1e-b8c2-56817c4b656c",
        "indicator--17e69e09-2666-4491-99dd-5038e3f1d08b",
        "indicator--21504122-28ce-4699-8c86-61d3168596e3",
        "indicator--bbe86c77-1fb2-42dd-ab6f-a7123293eaad",
        "indicator--9bf5cc91-166e-4a3f-bc5b-fa20248cec36",
        "indicator--c5a482ee-82d8-4257-8c8c-9a75a954a774",
        "indicator--c115655b-57c0-43c9-b41c-a746a4570d2d",
        "indicator--94376f46-be09-4cbf-a3fc-eaaa8693e682",
        "indicator--7ae1145d-1b41-4a58-82e3-2b76e497a7bf",
        "indicator--048db06e-a9e0-4a69-8702-163d25a6b638",
        "indicator--75a00076-8522-4224-a572-253b2723dd90",
        "indicator--b7d5c06b-2a0c-46f8-b3cd-9d89386f66c5",
        "indicator--420c4abe-37f1-4428-86c1-12fb791c55b9",
        "indicator--b85044a7-0716-41fb-91f9-2f15f39303cf",
        "indicator--81a88e6f-8bef-4a43-9fa9-ddec170f1f64",
        "indicator--bbeab9d3-8afd-4367-9d6d-d7a79a4b3d76",
        "indicator--70533472-75c7-406b-9a84-709d60c02c8e",
        "indicator--531c9759-9594-470c-866e-6ca8cd7f0c9f",
        "indicator--3def49e6-22df-4471-afd7-26ca26cc8557",
        "indicator--a84cb977-515d-4a1d-b277-9f0414c17e0a",
        "indicator--f7bc8e13-68a4-4eb8-8613-b36dee61c943",
        "indicator--44b664ae-ce5d-40ec-aab5-e975508a21ff",
        "indicator--809c0d6d-ed63-4a6f-8a56-2177c0f57851",
        "indicator--74252049-e145-405e-aba0-2e16a75e0b8d",
        "indicator--15f021ed-dea6-40e6-868b-e250be57416d",
        "indicator--57e3cfb7-2b5c-44da-8c08-685284ffb7fa",
        "indicator--900218a6-1599-4bd0-80ed-5de6e0a7168b",
        "indicator--a677a9b7-01c4-4663-ba64-7457fe890ddb",
        "indicator--6d9b7be4-0d43-4979-8217-b215bb80e8ad",
        "indicator--c2115497-cd4e-4ebb-8215-15d5b0a14c0b",
        "indicator--cb5d3e11-a83e-47e9-bda9-bd15f30ca0af",
        "indicator--cb7cf653-bc1d-4564-9d9d-68c5c6e564d0",
        "indicator--bd1e7a55-8495-4e2e-824c-607810eb44b2",
        "indicator--4da4c68d-37d4-4707-9311-31c355dfed88",
        "indicator--9714f03f-61ef-4c9c-9a87-0f4dab7d68c0",
        "indicator--515967bb-88ea-468d-8b42-f535f7ee64fe",
        "indicator--15fa4e33-d5b2-42c4-bfdf-98fbee2bf71e",
        "indicator--c82f0d09-ff5d-4eaf-9add-1126b3ade369",
        "indicator--e773aa2d-58e5-4ac3-9e2c-fcbdebcaed37",
        "indicator--5aaa5741-cb96-443a-a677-39b255415c70",
        "indicator--9ea72ef1-9d51-474d-b378-3e5447de4db4",
        "indicator--9ee2871d-ebf5-4444-9d98-039773224d74",
        "indicator--ce8c7477-f50b-4afe-ab74-4b4f97013e9f",
        "indicator--1065d414-90ec-465a-8348-dd99cd033475",
        "indicator--a3c624a8-533e-4250-88c2-b76b202c3a89",
        "indicator--f073fc9a-0dfa-4f73-95bb-25aaa9f30226",
        "indicator--97adae0c-7777-4773-a4bd-5a3dc4afb282",
        "indicator--41245666-fe83-4d0f-a491-fee5aaa9dcf8",
        "indicator--ce2046e1-b8ee-4c90-a7fd-eef4b0b62382",
        "indicator--67f4226b-02d2-4490-8663-2e68948d4c3b",
        "indicator--a90b56dd-d802-4d5c-b7ae-fd8666a7634f",
        "indicator--c84beaf6-0524-48f0-9976-fab220df7ffd",
        "indicator--a031bcbb-869d-4da3-8846-2d29f1ee4e87",
        "indicator--707e12ac-fcc1-4273-8052-f115446d1826",
        "indicator--5eb3457e-aaf1-4b05-be55-aef6e046df8d",
        "indicator--55a6aefa-a124-4f4f-b456-b38450658a2a",
        "indicator--f2a8d6b4-f5ff-4c26-8348-371ce199761b",
        "indicator--9ad7c314-1ddb-46ef-a539-c3e7537ca6f2",
        "indicator--11e30392-8641-4e0f-ac80-50e0e45f0299",
        "indicator--b21b920a-5979-48f0-afc4-3b416fb111a7",
        "indicator--7aae0c9e-f019-4e00-b0be-bd37f799f58f",
        "indicator--e46d1877-f6ed-4b39-9beb-6606d491a0a1",
        "indicator--8372a4c7-6a22-48e8-9ede-1646e10adc45",
        "indicator--f0f4aeda-d74d-4c64-9e8c-ff7f7a94ca88",
        "indicator--416a40a5-0ed1-4faf-8e7e-40812d51e9e8",
        "indicator--ad6c6bb3-8afd-4e23-b33e-84a8cff5080e",
        "indicator--c19d54c7-23d9-4f9e-ab75-613046320fd5",
        "indicator--299c9132-ce7f-4cb9-8728-21eb823ce1e1",
        "indicator--d2c4fe97-8133-4e34-966d-c9b49d962abe",
        "indicator--7bd204c6-57da-443a-8648-c86587f02b72",
        "indicator--b9c24dfc-7fae-4a66-b76f-cefa672139f5",
        "indicator--a89a0a3e-4286-4200-9b8d-f529b5b10e70",
        "indicator--cf8256a7-a8e0-4f58-b746-eede9a5bb1a5",
        "indicator--f15d4387-fee0-4e05-93c5-886e51a50c75",
        "indicator--8eecf478-1103-42c1-9caf-46013778d802",
        "indicator--319ce4b7-886a-4114-a432-e2afd1358db3",
        "indicator--fc20cb40-b1fe-41e2-86d2-479c607a2f7f",
        "indicator--a9bfd5f3-b2c8-490d-a19c-d4c0644a9cd7",
        "indicator--3829a947-59f0-401b-a37a-1be6ca8022e3",
        "indicator--a42f2a43-b41a-4f51-a680-5a4e08dc1cba",
        "indicator--3b41e358-ba7e-4339-bb63-933db3f26417",
        "indicator--f36f08f4-dae9-4351-8ff3-3a5cb2ad0250",
        "indicator--4b74fb34-8a3b-420b-b853-607e111299a6",
        "indicator--7d56687f-fcd8-49ab-9237-9dce1d59e924",
        "indicator--c6295672-91d7-4075-a9d4-b66512814a87",
        "indicator--5d1c434b-9a22-4b7b-99a1-5499cccbb67d",
        "indicator--74420766-c936-484b-bc4b-a918827e5545",
        "indicator--2e9cf22a-f9c4-41aa-ac57-6e4f6e56a0cc",
        "indicator--cbd93c93-ab83-410e-b2db-c26e3b8f7c6c",
        "indicator--4fe7e189-0150-4b4b-9ba9-44c31e5c587b",
        "indicator--c8126f52-179d-4301-8387-afc94407074d",
        "indicator--233ca87c-3cd1-4471-900a-eee4958f9ba3",
        "indicator--efd90182-7a47-4dd9-a9cf-26f9bf4a6098",
        "indicator--6b752fe5-74a3-4e8b-a7a6-dd0549ce5579",
        "indicator--971fefe0-1fcd-4f70-9eb3-3aea1efee82d",
        "indicator--e1135711-4b84-4fd7-91a4-25e6cc33461d",
        "indicator--d75debf7-57f1-43a2-9fd2-98addaed91cc",
        "indicator--7e4f13b1-e14a-4d0b-9629-76dcc84505a4",
        "indicator--e73069d4-d048-4fdb-82f7-b57e7066f8ca",
        "indicator--a5ef2dc5-dd1b-4762-8792-c378a0ae3ef9",
        "indicator--e8d6a4c7-2b0e-4994-ae6e-a9787f58e4a0",
        "indicator--ad183881-dbfb-4276-8574-c65c0c6e1b29",
        "indicator--f63bc621-c378-4f7e-95d0-795fac4bdf6f",
        "indicator--4e2ec6db-caf0-4204-80bf-22ebc7d800d9",
        "indicator--10c30cd6-69a7-4fbc-9fe0-a6dd933a3e8e",
        "indicator--6c88d86b-983d-4eb1-96e1-b18ee893a82b",
        "indicator--5b5c7b65-2ef0-4fd4-8cee-249ed54ba896",
        "indicator--e6a04bbc-8641-4dc6-b6ac-6c227318e08c",
        "indicator--9b2549d1-1d37-44a6-979a-a5b9ab8a3d0d",
        "indicator--223f238c-e998-442e-983d-5dd76de2196e",
        "indicator--60e5fd34-8bc7-45e6-8d2f-b94974fe5014",
        "indicator--42ab5399-a5e1-4dc8-887d-6fb44bfa134d",
        "indicator--c2af7b28-fac7-4340-b6af-2f256c993777",
        "indicator--f898de0b-cd48-4e00-8962-404e6793c006",
        "indicator--39c26929-bb42-4ef2-8dbd-8ba871f6cfdc",
        "indicator--f2d0f1ca-7bd4-42b2-93f7-b027f775268a",
        "indicator--4323713b-3e65-4fe2-8fa7-03275d5fbd55",
        "indicator--3c0b2e82-1560-454c-baad-cf15cbd97fbf",
        "indicator--61109bab-db34-46ef-a41a-ded8dc6c8491",
        "indicator--be56dcd5-821b-4a5c-83bb-ff40d6264519",
        "indicator--9f389905-1cc8-4cf6-91af-6b09f25b07e8",
        "indicator--57b554cc-c9ef-40ff-a77f-d0a066143741",
        "indicator--00d9e17e-ec1c-497c-9992-820ebd654df3",
        "indicator--5ac49cdc-2c6e-4320-8d36-5979b9934997",
        "indicator--3f467f41-d44d-4517-a9f3-2d657fdfe4ee",
        "indicator--b8fa6973-757b-40d7-9e1c-4249fff0db7e",
        "indicator--9ae8e8e2-e817-4b11-8f1d-28b407a6e4e0",
        "indicator--4be7adf1-b49e-44dd-aa0e-4125cdffb269",
        "indicator--7fe2ec60-bed8-48c6-a54e-3a24f13936a9",
        "indicator--12777119-2b0b-4b4d-bffb-a2dd38d95855",
        "indicator--ac0e57d6-de9b-4dfc-9a56-cd403111afa8",
        "indicator--b5b1f47a-3837-40cc-be08-21602853e4c2",
        "indicator--cb617b3a-aa62-4185-aab4-0e8c920284fb",
        "indicator--35d4394b-a21f-4845-a563-5651d7a403f3",
        "indicator--9afac327-1f57-4305-af17-781537a15674",
        "indicator--f8c755cd-46e3-4ed7-ba45-732c92d2b037",
        "indicator--cc8be515-4d9f-49a3-8cc5-40d2757bffca",
        "indicator--39938a7c-bbdb-47cc-a66d-0fdbed1354c8",
        "indicator--c13c52a2-0cd8-4de4-835b-0c10f4f49d24",
        "indicator--44dfd1bf-9153-41ed-81cf-4c1012600dfa",
        "indicator--90670556-e247-4b70-bc5d-7d18025d5446",
        "indicator--d3e94005-35e3-4f99-a28f-4d90cd04a88b",
        "indicator--f41b67e4-0775-4284-97c8-dd16a90826c4",
        "indicator--e2c7db9e-ed5a-48f5-9352-dca4e3fb57df",
        "indicator--961f29d8-14b5-49f2-9ae3-bd4b1bd83e71",
        "indicator--24edcb65-a42d-4efd-9285-7922ae3564c3",
        "indicator--23a58fb2-e889-429f-95d7-4e3625d665e6",
        "indicator--2bcfb5e7-3088-4b75-8f5e-9f565e6973be",
        "indicator--d89890aa-b3f7-440e-a161-89e23668e885",
        "indicator--1c495197-0176-4cc6-802f-ef446de4db19",
        "indicator--c86b86f3-f650-40de-bc61-e7d8b0055c80",
        "indicator--66e3c1c3-b1aa-4f93-b440-b215ea23d7dc",
        "indicator--7e062507-de93-4f1a-8514-e00b2f99042e",
        "indicator--dde9b4df-7cb4-4dea-85b9-956fae8ef921",
        "indicator--a07d04e2-6784-4f62-b05d-6843aa522d70",
        "indicator--58abcf98-d4b1-4996-b0cf-b8e57bc34acf",
        "indicator--f5abdf4b-d5d5-480f-b5ec-1a1137ae4b54",
        "indicator--2dbcef77-f556-4c93-92d8-f5278e1ed1b5",
        "indicator--b1a85032-554a-4cfb-8f5a-0c8fc3962365",
        "indicator--7ca77ec9-e2d5-4824-8596-30d2955e5f31",
        "indicator--92449b22-b8dd-465b-930a-a448109e0ec3",
        "indicator--9a28f7f6-c04c-46b8-ae5c-d741568db9b4",
        "indicator--4cda05ad-7151-40af-8784-63aa800a6592",
        "indicator--86cf4e15-ded4-4969-9ff8-bcfeb9ebaec7",
        "indicator--3b9905b5-80c9-40d7-8be2-f3149f9d5ce2",
        "indicator--8bf4f5d7-90a2-4781-91ed-d7a9a78e4ff3",
        "indicator--0f7110e4-97c9-46d5-83d7-ec5f9b27eb68",
        "indicator--d34c4a2d-7644-4904-9260-0ce063a13950",
        "indicator--ae4f87a2-ac18-407e-a52d-42b7cad5ab4a",
        "indicator--fe97b5f3-46d7-4106-afa4-250006a0e8ad",
        "indicator--a7b80ae8-e0a0-46da-be1b-d6ebb400bdae",
        "indicator--87f5d282-dca2-4a51-9e10-5887938cce9c",
        "indicator--255a1bb6-2f9a-44e9-9375-ec57e93eaec5",
        "indicator--e42dd931-fdb5-49ac-898c-92a7b92d2e25",
        "indicator--2d440d19-3d39-4163-bc43-5f3163259b32",
        "indicator--b8ba774f-90dc-4bdb-a559-bfb4c05c1fc3",
        "indicator--36fd6e8d-68e2-4bee-9962-e2dac0f6b038",
        "indicator--65c5ab61-d35a-4bb4-811f-989de4592722",
        "indicator--d1e610b9-9123-40ae-a748-4404a69819f9",
        "indicator--32f0a8a4-e388-4ebd-8a40-629b203d4eb3",
        "indicator--ee04cf3f-939e-4e0f-bb9f-888506a803fd",
        "indicator--cb5c86cc-71b1-473c-bd31-df0ccd806634",
        "indicator--ca6ad6f1-299b-4676-9274-c41672ebdd47",
        "indicator--9a992da8-0669-40c0-9ada-304d14552518",
        "indicator--63ea2fe5-3504-4c42-91d1-bb2cfb1521fe",
        "indicator--406ccc66-5572-420f-a0e5-ef28ff6ca8a9",
        "indicator--b2dc72f7-eb47-4830-be60-5aaf236a9d2a",
        "indicator--18bba2c8-ad7a-4095-b39a-6161505dd21b",
        "indicator--67990007-465a-453e-ac52-5dce586e762c",
        "indicator--31fc53a2-c87f-405e-97ea-9b6941c22ce5",
        "indicator--ac34cbd1-db60-4a54-a7b8-3a7620675808",
        "indicator--933a8451-e14f-4b1c-ad40-2fbba72f831c",
        "indicator--da24ee09-9cab-4f86-8ad2-6601de8315a0",
        "indicator--82cc622f-371f-41d5-851b-22a273809c4a",
        "indicator--48861b80-2455-458f-81ff-c2946c953bfd",
        "indicator--e8bb8e4a-fef3-4d63-8b83-c6dfaa75ae8a",
        "indicator--c323b4ea-6f50-4b8e-aaac-eb1384cd8862",
        "indicator--2fa8eda3-d82b-441b-84a5-8d2de3a1f47b",
        "indicator--30362538-7260-4ce5-ad9a-c575cda0bd52",
        "indicator--f6ec95b9-2cd1-4c59-b1b2-6daad4a7add0",
        "indicator--8b7fb87e-e5e5-40f5-8063-3e0ef4e23709",
        "indicator--08e12397-50a1-4c90-8542-caee0b33c958",
        "indicator--d7f841a1-9c3d-4b8b-b2fb-485e8f2e6319",
        "indicator--31f8a10d-11ee-42f4-b823-67bcd1aaee2e",
        "indicator--00415676-0d2c-4691-a172-df1f2cc64b15",
        "indicator--7ee2eeb2-5281-456b-be4f-858856d87b06",
        "indicator--bad611bf-1181-4b47-acc6-3d73955b0507",
        "indicator--33b47e3f-1dfb-4702-9165-b187d4f6429e",
        "indicator--0f86822c-1932-44a5-a424-4a7efa050eea",
        "indicator--2b017970-4caf-4b39-8e5d-c60e6847c85f",
        "indicator--620f70f8-bdff-417a-af11-5d32a087d35f",
        "indicator--a59c77d9-af0b-4cca-bf0b-025ebe455113",
        "indicator--c4a1998a-c763-4996-80b0-31f5aac1ad6d",
        "indicator--4639261c-4ce4-4195-8da0-1ac26b272dc0",
        "indicator--a890ea9d-abb8-4430-b21c-12bbb949c2a6",
        "indicator--dee185cb-1ba3-4e6f-b7c6-f79ba4772131",
        "indicator--c2de82f0-2c39-4165-aa21-a62596770480",
        "indicator--ba544025-1fd6-49d1-b810-dde8363986ba",
        "indicator--2c61a222-c470-4a8b-9fce-daa9d49e5f5a",
        "indicator--4db76c70-58e2-4008-8cc6-0e94421dbd15",
        "indicator--277d8f07-cea0-497c-8f2e-15cb00827a18",
        "indicator--415ce6da-1a72-4500-b963-8930515a0681",
        "indicator--ce5317c3-1bf5-42c7-9b8b-ac3c0a220f75",
        "indicator--e793213d-28c6-4e8d-a745-eb42af1e4c5d",
        "indicator--8ff9a662-1b4f-4146-8903-ae3e6c8fb669",
        "indicator--ebf369a2-1be8-482f-81f1-07236a807e6e",
        "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
        "indicator--c094baea-f47f-4e5c-86fd-250247786ce3",
        "indicator--bf4841c0-6f85-4bd5-9b59-1402fc86b5df",
        "indicator--388a2a48-fffd-4c99-acab-dd06ecd412e4",
        "indicator--c6bb1f16-f944-49d5-b6e2-a02fbe578f43",
        "indicator--7b7974de-6889-4790-801e-b18cffda12e1",
        "indicator--5033c490-d393-4637-a037-520802312357",
        "indicator--80f0ee45-82c8-47e9-a1f6-f4b8637f0a17",
        "indicator--f4a19e9a-3c93-4463-ad13-b408524e259b",
        "indicator--b38b22e4-9962-4607-8999-c55602eaa719",
        "indicator--07210257-fd94-4fb5-a803-52424e133199",
        "indicator--53ae047f-14ca-45cd-9f08-4cd46df64d36",
        "indicator--19a4f6ec-c2d7-4e97-8cfe-806b2ae28adb",
        "indicator--bf1bab8a-3e1d-4f78-b72c-64c0ae495e76",
        "indicator--5f459f8e-3966-4b20-938a-37b985d5eab4",
        "indicator--42695438-7475-4010-b786-6e66e785ad7c",
        "indicator--259d3fe3-461d-4046-9c24-dc20adf37ebc",
        "indicator--f02d1cda-dc24-472c-a230-17bcb7e5f2d8",
        "indicator--87b76479-e1e8-42fa-89a8-db7a59542f03",
        "indicator--7ea89bef-99bb-48dd-a90b-a29394836f41",
        "indicator--b3b524b4-ef93-4752-8ca3-d966a2b47287",
        "indicator--c3178270-7848-43e7-9b77-f6a809b86b7e",
        "indicator--5bbea19a-b9b1-4bb6-8f61-21a0731e8765",
        "indicator--f07d1bea-166c-4efe-8903-2865407cf9ee",
        "indicator--533c7972-3555-4a07-a6e5-ab5f58b12698",
        "indicator--6af1dbdc-e171-4d88-9a28-8992564855c4",
        "indicator--9b8ff0f0-232d-494f-8f38-38806791c990",
        "indicator--6beb4854-05b1-4550-9905-65bb1a9fee14",
        "indicator--d9a758fb-c6a5-4e44-aaaa-5fff53ac0938",
        "indicator--28ccd618-0eaa-4937-87d9-25713cc70c83",
        "indicator--2bdb8ad3-cc9a-4b94-8a48-24442c3d7167",
        "indicator--fc09f173-f0e1-4026-a53e-c3bdb0513148",
        "indicator--91240d29-83aa-408b-9079-13541ec20fc5",
        "indicator--f12d0454-2e4e-4f4b-b5b4-04b774bb6b13",
        "indicator--32158894-1c29-4c6a-b485-d8732a392c5a",
        "indicator--bca8683d-230f-4096-b3f5-60999f1b5043",
        "indicator--9fd6b568-736b-4e61-9cf6-69265f43e61f",
        "indicator--dbb101ee-21de-43e2-8ce9-818453bf279d",
        "indicator--c1e09898-a73a-44db-8647-ed4551e09cb9",
        "indicator--cad97166-1815-465c-b40f-439bb75959e9",
        "indicator--acd877eb-4c8b-4138-98c2-70d52b947eef",
        "indicator--b21059f6-2773-491d-a18d-0db8dc6a1851",
        "indicator--6ea87418-cb8f-443c-af06-c9ba93010e0a",
        "indicator--6a230bbd-5f6e-4d58-b7d7-e21227f86b1e",
        "indicator--4d1b3ee1-b8d0-408c-b16d-148951dd2a06",
        "indicator--4a64ac30-59bb-4a6d-8218-99a2ec842773",
        "indicator--c3e14c80-4e5b-4874-bf5c-09228117c9c1",
        "indicator--2b958250-a37f-4a13-9010-9d1da03ca83f",
        "indicator--d9b721fd-e92a-4537-87a9-86f06931dbbe",
        "indicator--22522415-409e-46b1-895a-ac035057924b",
        "indicator--355a8382-7bb8-4c45-8a4a-76f6faf4bd69",
        "indicator--20002a64-5f3b-41b7-93b0-b4d8d66c8fe8",
        "indicator--3e1d841e-350c-4f2b-928b-4ab036068978",
        "indicator--921816bf-290a-4046-834c-7181a977503e",
        "indicator--c43823d6-4789-4dbd-b130-42787e92937d",
        "indicator--adc4aa87-9bef-4d0f-bc5b-7c5432791c25",
        "indicator--a1eb049d-cd75-4047-80fc-3689149707b8",
        "indicator--3c10557a-8181-4b08-9be7-fb9f68757d32",
        "indicator--c174dbca-90c0-44f3-b7fb-7c45b0618bb9",
        "indicator--a37432e9-6d17-4646-b86e-d3414e1f56bd",
        "indicator--2f6e1115-df8e-4d55-81e7-6c1b1e636f42",
        "indicator--4b559977-fe68-4bbd-9181-f0c09f735b33",
        "indicator--5dcdfcbc-766a-42e9-838b-00082db7b4d5",
        "indicator--e8963841-28c6-429e-842d-3a3e22f9822e",
        "indicator--bd9ec3ed-b696-4249-b5fd-e7f4a9034874",
        "indicator--e541779d-8352-4c54-8eb0-67b1fbdbc90f",
        "indicator--2a70f2df-5fd0-45fc-ae0b-902aa02610ca",
        "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
        "indicator--e2cb4b30-092a-4ca3-990a-688e95817582",
        "indicator--957623a5-c832-4087-9bdc-3fc815638883",
        "indicator--80b18d38-7916-4b4f-8b2d-0e980544d5a4",
        "indicator--10fa848a-4804-4b9a-a402-a64fc767735f",
        "indicator--770de5f6-2260-43ba-966d-7de2e5ee662d",
        "indicator--5c8c2e56-5855-4ab0-8c8d-aa7a3e297300",
        "indicator--a5c5d7e2-5554-40ba-86dd-d0eb6668905b",
        "indicator--622dd7f5-291b-4b5f-8999-720a31588d89",
        "indicator--1fa58f1c-0b14-4485-a9c5-a1fafcdb1ce9",
        "indicator--eb5b1814-ecc5-4a4a-b469-4480b2d7c855",
        "indicator--76835ef4-8c8b-4366-9118-e82704b59d71",
        "indicator--dd1150f1-06a9-476c-9b88-30650dde8ab9",
        "indicator--9f3ef997-fe45-4474-828f-ee73cba1015b",
        "indicator--a59e0ccc-3486-4f34-8e95-abad8921d088",
        "indicator--08dce9ed-a6f7-4e0d-a7c4-5df577ce2ca2",
        "indicator--afc3bce5-7dc5-45c5-b593-f63cd64d2741",
        "indicator--23d14e8d-1df6-400d-95d5-9c8f8e7e51c3",
        "indicator--cd5b3877-3a79-4f83-9cbc-7578f75dc678",
        "indicator--70dec905-af76-421e-bbe5-feb2dc9586bc",
        "indicator--62cc088e-a365-47e0-96c5-05950e06dbaa",
        "indicator--4c7beb51-03fd-4743-bfb9-ca7f6fcda7d7",
        "indicator--a675d34e-c10c-46e3-baa7-ad69816c5038",
        "indicator--af17b2ef-11cd-4991-bcbf-29038e222cb2",
        "indicator--84684169-abb0-405e-9873-e2832db6941a",
        "indicator--a99946ea-18dd-43a3-b06c-a6c8bbb8f5eb",
        "indicator--8931c6f2-1806-4d05-9b20-d8b1c53761a4",
        "indicator--4224e06b-f95e-4fea-b900-414cb11d2f9b",
        "indicator--0b81bb7d-8f38-4e87-b414-b22bb3376e1b",
        "indicator--6702e520-46da-4193-9269-d321c2f1938f",
        "indicator--a00af559-ef38-4f09-9e71-6af7855c5fb9",
        "indicator--51fc2999-63e3-4022-ac06-1a5365ee7b29",
        "indicator--0f156ac1-26db-4265-88f5-e99e665b0c5c",
        "indicator--c6a6340e-775a-41c4-b27c-f8ff8100a884",
        "indicator--aa5553e1-9719-4d72-9dc8-43a95d6698a2",
        "indicator--75c38f78-2c9d-4512-8d84-f32775e02963",
        "indicator--95b611ed-caf6-463b-b981-2a4a864c6ac5",
        "indicator--291adc00-d4b9-4843-a349-d2255d28c658",
        "indicator--a2d3f214-d5d6-4eed-9087-9e3d11981e14",
        "indicator--0dc1dd1d-f225-4189-9f87-6fd2dca06181",
        "indicator--a4cd10d7-39e8-4393-a997-15bd3d1d2bf5",
        "indicator--4aebd443-f7cb-4f35-95a0-d7b9679e2c74",
        "indicator--5eb4c354-7518-4d37-b09a-900ef74ac85f",
        "indicator--4a0eb991-2986-42c7-8bb7-c2f3c2bd01b5",
        "indicator--04c7d252-f36c-4afe-8f77-b89166e955c7",
        "indicator--e652071f-392e-496e-b700-5ac6a63424c2",
        "indicator--3d9c7f1b-c535-4819-91cc-66e5f3022b91",
        "indicator--9e455ada-bbf4-4a54-a53b-658b24e8cf91",
        "indicator--1e4f1475-98c1-4ce8-a785-62094457eff6",
        "indicator--92fbafa1-b136-4891-b363-6a70fa61e9b9",
        "indicator--864e0673-f6eb-408c-a5be-33c75c31997a",
        "indicator--b3a1c6bb-a0ff-4a2e-9da7-f310aaa53c3f",
        "indicator--27d25e15-32be-4fb8-880c-7e8f7b8d6ea1",
        "indicator--3746d5ec-375f-44c4-b58c-baf923de543a",
        "indicator--24c5e477-d4bc-4bf4-8a37-a905d517849d",
        "indicator--55ddd197-1060-46fa-ac59-43e85a419392",
        "indicator--0ae463a2-9f24-4f54-be0f-3ae40aad20e3",
        "indicator--fa318bdd-6017-4477-889a-aaaaf0522bb3",
        "indicator--193b3272-1647-4197-8e94-3419c22d0e70",
        "indicator--4439ebbb-79af-4a12-afe1-bfadc87e8a33",
        "indicator--454bac4a-91e8-49e6-be2f-29288d8d778d",
        "indicator--30146447-7b0c-4970-a014-0329bbdab087",
        "indicator--0c7a8ef7-b1e5-45f5-9f32-fdee316a61d7",
        "indicator--30dc4a52-f414-44ce-8271-dc248942350d",
        "indicator--8c87330c-1f9d-48e7-8f4c-eb5443a6314a",
        "indicator--d551cb5f-4e96-4cd2-9545-110e4f8b2707",
        "indicator--afd36d38-3c97-4836-9749-719f003c10c2",
        "indicator--cf2baa12-d925-4b07-a754-dbeefb06123d",
        "indicator--9c4f1698-341c-437f-b648-4a38fa19466c",
        "indicator--b25667ed-0883-4cc0-b470-c6e091ef3e1b",
        "indicator--8383f536-523f-481e-aa6d-6a4d0f627fb6",
        "indicator--5cbd6a68-0136-4772-be72-5b958d16a6a6",
        "indicator--e841ab27-cb88-4325-90d1-6e17f26b9516",
        "indicator--f67a59dd-aa15-42cf-8804-241e2c401dce",
        "indicator--7ac7253e-6ced-4aa4-b514-f3817614193d",
        "indicator--e438ee9b-e6cf-4075-89f9-f19034858dc8",
        "indicator--453c1c77-0d37-4a27-89a2-933db385c6a2",
        "indicator--789b6944-403e-40ee-90b4-e20d83ebbc68",
        "indicator--0d49bdd7-9f8f-4ba8-8dfb-931b6417fefe",
        "indicator--ea82ca38-c7eb-46d0-b74c-17ff34b99f39",
        "indicator--1ebc9dfb-2a26-4683-b163-5eabf1c28729",
        "indicator--190c2be7-d23c-4a8a-901d-fadfc0e560b0",
        "indicator--9b785ea8-2bb9-4373-9c7d-abf8887c445f",
        "indicator--1daa9882-13f7-44bd-ba30-155ab9c8c04e",
        "indicator--973d850a-c842-4e95-a559-2a5a8f825004",
        "indicator--c0417d8a-23dd-404d-b06b-53dcbe96383b",
        "indicator--8af6e959-0970-4013-a9c6-c8c0bc872d1a",
        "indicator--4dc847eb-821a-4aaa-9c9b-31e57df54103",
        "indicator--d5fa39fb-5df7-42ea-b6a9-c611c20e4add",
        "indicator--b707912a-a905-41d1-a9b9-1af91330cb3b",
        "indicator--a51943f8-ec2d-47a7-96b3-1b53b482c7e2",
        "indicator--676a3852-e0da-4d74-9ea9-12ff94ee9c55",
        "indicator--9e552a55-92cf-439e-b472-4a03af6816ae",
        "indicator--d42a4479-dfa5-4231-809c-5e7db5888397",
        "indicator--46d8d02e-f47b-4f5a-8915-eec83d0f0489",
        "indicator--2db96f40-5ef5-4563-b65d-264fd9b7d9ce",
        "indicator--d67bde3e-b928-48e5-bd35-5240d7f2fa0b",
        "indicator--60b389a0-d96d-468a-baaa-5a157f9f7dfc",
        "indicator--03a9faf2-2cb7-4fe5-8dbc-27238ae8ae5f",
        "indicator--28f3fe63-3fdf-4cb9-a0a5-605d721975e8",
        "indicator--584cf865-d0e0-4d3c-9329-d0860fbc0f82",
        "indicator--2d6abf27-5081-4a1b-baff-d2b3e5a9e12d",
        "indicator--2ada4726-c452-436c-b8b2-33a1acbe7bba",
        "indicator--92c7bbf0-f4bb-4bdf-ab8f-1df5fc569020",
        "indicator--cf8398f6-d5cb-4946-ba65-67b83fdd0470",
        "indicator--ae89ffd7-4fe2-414b-982b-51142414b91c",
        "indicator--85230581-2fa2-4d23-8437-8384bdb7c3a6",
        "indicator--8b5c0b6a-8710-4854-9801-a92cc8527593",
        "indicator--ae59ab64-180e-4f2f-9f3f-30256806cfe2",
        "indicator--b7d6b3ec-fd7a-4797-a74f-d545ef43318c",
        "indicator--55f16055-26ad-4695-9b0b-6364806e39ff",
        "indicator--c7c3b222-87f9-4ffd-9516-47f22d5ec080",
        "indicator--808d95f2-8a11-4d3b-bf8e-edfc4f711bc8",
        "indicator--1267dd40-365c-4fc6-875b-58b17f06c3ea",
        "indicator--f42df1b1-ab19-4b20-b22a-b76d268b4b38",
        "indicator--2e2300b6-461a-49d3-bec8-d3d0305271c9",
        "indicator--63df61dc-5639-43f2-9ded-55015c5d6f81",
        "indicator--27de468b-6cf0-4aa9-af77-a529f7816a21",
        "indicator--515b0c99-edfb-47ce-a08e-ef6d99ddd772",
        "indicator--f6c5f89c-4c4d-4a90-a412-aa115f13a20d",
        "indicator--1cca2fb1-f216-437a-98ea-dba92b0da1f6",
        "indicator--acb65837-c6b7-4a12-b5e6-e063d1efc789",
        "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
        "indicator--f209de52-e780-4499-a790-5d983b619f4f",
        "indicator--c0f376ba-25e0-44eb-8a42-a93c428fede6",
        "indicator--35f8f1fd-e48b-4af5-82de-0f87fbd79417",
        "indicator--d7d85f74-d3f7-4904-85d8-dbdf4368f55d",
        "indicator--27667b46-549e-49fc-bc43-c9bd3769176b",
        "indicator--f28d4ab1-d795-4e5d-8ca6-109f5023f2e6",
        "indicator--3c43f727-e349-49fc-8956-6327df19af00",
        "indicator--9b8008ce-f2fe-49c7-b95b-7f5e01e4e9ec",
        "indicator--8e4c6cfb-fd4e-4f5c-8385-75231417140d",
        "indicator--d72adcf2-7d23-43d5-ba55-833064aaf002",
        "indicator--5fe2091f-3749-4771-9d02-45ee21531b03",
        "indicator--8cbd1adc-9a35-4f97-bc9b-ca1940ff1d4f",
        "indicator--08aadb53-f162-49cc-8797-6f3025a549f5",
        "indicator--997c6009-38a8-4401-8113-4b3f845383ef",
        "indicator--4345555e-08fe-414e-bc8c-179888fe9d93",
        "indicator--e210de3f-1415-47e8-bb82-18df4036b16c",
        "indicator--4065fe43-92c4-406a-a3e2-c2b26994718b",
        "indicator--3c86d17d-013e-4ec8-bde7-6c7deb5d5e89",
        "indicator--7a3d102b-5a5a-41b9-950d-dbbbe1f30825",
        "indicator--5256f131-9363-40c1-a8e5-920d3e762bd2",
        "indicator--c3d5a5b3-d121-4b97-a4b1-add8e52b586d",
        "indicator--6f53437f-c06a-4828-bb71-4c0a32f32e08",
        "indicator--b52e7b57-958d-426b-9f1d-f561e9574b2d",
        "indicator--d613acce-13fc-4f66-bd17-c8174b4ec684",
        "indicator--571418cc-094f-4511-8b8e-72ea80a1b472",
        "indicator--62526437-6189-4345-8f18-11d3a2ff1f9a",
        "indicator--ad8f6c24-db9e-4073-bc90-46aaa5ffb824",
        "indicator--9a5a3e22-ba7c-4aa0-b7a2-0d6da54bcf3d",
        "indicator--0a574939-f25d-4af1-acf1-ac0304341401",
        "indicator--4a27b9d3-12c2-4007-8cae-38dfe7e272cf",
        "indicator--2e7e1984-2c67-4f7d-a851-d55b3f618519",
        "indicator--0c3d4ec6-4320-4971-83c6-720865904870",
        "indicator--090816dd-9b19-4770-9fc7-f5ec5029d018",
        "indicator--32a613c4-e263-4390-a7d9-15871cf4a6ac",
        "indicator--d756f86b-d8a1-44d5-8c45-ad1e63feb74a",
        "indicator--3fc98896-5f41-4df8-8b24-638b4b3f5886",
        "indicator--4b725b5a-5152-4ca8-a071-19ac60026ac1",
        "indicator--a91c9ae2-34c9-451d-bf16-53ca39dfda40",
        "indicator--12321e3a-8008-4b01-9b7a-5fd7f9212736",
        "indicator--110caa8f-f649-4634-b59b-f4930cb29cc0",
        "indicator--03e8ba4b-1aa7-47d5-9152-4f4c92051511",
        "indicator--2ea66a35-1660-4a0e-9f2a-3da4fbc4f146",
        "indicator--9ecde781-f464-4213-9c30-0fd9c9864c45",
        "indicator--51f9dee2-aa36-4df2-96e9-6d5dc01ce242",
        "indicator--286f8b5c-f9e4-467c-89a1-401702d6f0a9",
        "indicator--32828f09-f796-4e45-88bf-0120cb1c2f73",
        "indicator--af77e1d6-5bb4-465a-86fb-7078475bfb6f",
        "indicator--aea9aff9-e932-4e46-9d63-29dfa9b14b55",
        "indicator--6d8f844f-8c03-4c7e-b0ab-efecd5ef72de",
        "indicator--1a4f22eb-3449-4644-aa01-6e136e3e14bc",
        "indicator--267a773a-095d-42d3-b5fd-ce0a9e5a1e50",
        "indicator--20de2dc8-5d71-443e-9837-edcdb2c20b45",
        "indicator--474ac3a9-0bca-4b2f-abf2-9cd6d91406cb",
        "indicator--fcbd2685-e1f5-41d2-a17a-b8991d564b70",
        "indicator--e312c12c-ba1b-4b7d-af1a-f72b215881ee",
        "indicator--0fbb174c-49b0-4fb5-bc00-563e89943b89",
        "indicator--83c895b4-ffb3-4514-8113-c140f24ca8aa",
        "indicator--7e790f10-3651-4e10-a8fb-6c96d4810943",
        "indicator--6bb152cc-5d2f-424a-9ace-eb58b63fb45a",
        "indicator--b7ce0d24-bc4a-4d77-872f-56724c402348",
        "indicator--68d80ead-e207-4416-b259-bad04e6998d6",
        "indicator--b648c2e2-870a-44cc-92c1-55da36f0b757",
        "indicator--20b8a5f8-a545-42ff-99db-7193fec15053",
        "indicator--f6b28a5a-4a5b-4d18-8ec4-13d7d8049d3f",
        "indicator--a74d0342-24ca-4af1-a5be-637797dd8680",
        "indicator--763fb0b7-eecd-4f7a-bf3b-c7d8e4e1beab",
        "indicator--5583d9f9-2a6f-4790-a4b4-cbc1bef9c63d",
        "indicator--f14683ce-00cd-4041-9f90-d312095247b6",
        "indicator--3b38db84-441a-43b2-8b68-fd6f01e178c6",
        "indicator--84c91484-f4c9-4a81-ae34-ccc9ba1ef98d",
        "indicator--b3da3872-51d4-4a54-8812-f0d1c7e14736",
        "indicator--7e5cfe02-7130-4ed0-b6ed-4074012e4467",
        "indicator--15dbe329-3c3d-4a23-947f-d7d865726779",
        "indicator--2c0810b8-0ea0-4745-92c1-389c5b5962c7",
        "indicator--163293bb-e9d9-4a9f-a03e-86afea5b55e5",
        "indicator--fc544203-e66d-4c41-8857-e3287a1f0159",
        "indicator--573225a1-b6ca-4e57-a973-df7f761da025",
        "indicator--6902a184-062a-4bd5-8709-a46ef9b4fa0b",
        "indicator--bf246b1a-7aa3-439d-bdeb-8b44182b312d",
        "indicator--b412b98f-1173-4963-8f5e-dd89143b43f2",
        "indicator--a1b9b91e-7300-4fc4-9226-8fbe96cde816",
        "indicator--7a7534be-d5b2-4eab-bd38-d685a217276f",
        "indicator--354cc2b5-96ff-47f2-9706-4436f01ce7ca",
        "indicator--b556e29d-cbc8-4618-b323-cd7b80c8d91c",
        "indicator--7e8a16bf-c726-4fb5-9276-ac7aa5fcad29",
        "indicator--6169aa37-4c72-4f68-b5d5-88ff2f18837b",
        "indicator--b6cad070-d43e-49a5-b615-646c2bdc79aa",
        "indicator--6304ddfd-6e90-4ad1-b761-eff6e7ba7e57",
        "indicator--0a5d88d7-6184-4d1a-b7ae-4c8db6e6b09b",
        "indicator--9b189d53-10c7-424e-9a81-bf898cd4e143",
        "indicator--906eb17e-e7b9-436b-a83c-2097a14aacb8",
        "indicator--70eaf66a-22c2-4d28-b5dd-ef1c4cc8743f",
        "indicator--47b386e2-1728-46e8-ac5a-da91f82cf2f6",
        "indicator--546ff561-c1b7-4788-b150-316d0b9a43f5",
        "indicator--04b4f9ce-3285-44ad-a164-b68c1143610f",
        "indicator--2632b55c-c146-4f62-8dc6-66191c76dbb5",
        "indicator--cbc67404-e744-404b-aa62-ce19b895e6da",
        "indicator--39341a5a-2d48-41df-b7eb-696e7b987758",
        "indicator--c49f959b-5942-4996-af49-69ad553f21b9",
        "indicator--dd83a1ba-7c89-40eb-942d-82432f0d16b6",
        "indicator--25605881-627e-4d1f-8e41-8d10c841bac8",
        "indicator--e6a73315-a61b-49e9-9e8b-d7f3d53d2b8f",
        "indicator--9896e034-7ce1-4292-8058-62673b5c1de7",
        "indicator--b7b2abaa-0d9b-4f25-b8f4-63422187a6a0",
        "indicator--8f794c9f-e1e9-472d-b06e-7fbe7b357ec1",
        "indicator--13d417b7-ca96-4f34-bbf8-f4349a2e8272",
        "indicator--113b4eab-9df0-4c4c-98e5-d2420c5212c3",
        "indicator--4704acfc-9529-4ec9-b7cd-c5913f2ce3e0",
        "indicator--71939079-eccc-4823-85c8-d5a242b478e1",
        "indicator--f56de56a-429e-4e99-9695-9f023fbb1685",
        "indicator--4111fb74-47be-47d0-b1fd-270696d67401",
        "indicator--78584a97-0c4e-477c-9fad-9c510d354706",
        "indicator--f5b430e5-2153-402e-acbf-8bdd32360af7",
        "indicator--40f61673-2a3a-41cc-b760-9784a9c65f06",
        "indicator--ae30adf4-aae0-4156-8e04-3e41ff9a0f68",
        "indicator--e9d7555b-8208-4966-af32-8eeb38f3de2a",
        "indicator--3efa7230-0a76-40b1-a357-d7012f37c83e",
        "indicator--997566b1-263e-480d-b9ef-3fd2263ef472",
        "indicator--6d856bf7-d183-42ff-8f90-04a780e75260",
        "indicator--0e9ae4ea-0537-4da2-b62b-be7860534519",
        "indicator--f57cb9d1-8ef6-4c0b-8fa4-d7db91c57af3",
        "indicator--817a3bd6-addb-4028-bd0e-91bb09e9d3aa",
        "indicator--1569a362-7fbd-4728-b538-e0bdc193ded9",
        "indicator--4217732e-df81-48e2-804e-1c47d49e62fd",
        "indicator--94fe82cd-1802-4e1e-a8ee-4c0b2174ec3f",
        "indicator--bf0b0fd5-04e4-4022-979b-daee1d300c19",
        "indicator--e1b47a42-9674-4356-95ae-f8bf575d470a",
        "indicator--b231a672-47db-4033-bf4c-1f68d876b1ba",
        "indicator--c7904438-0531-4eb8-90dc-411e677d9596",
        "indicator--e224e36c-8f06-4799-a1c0-094111286ffc",
        "indicator--e73dbb0c-a027-4bcc-9e85-aa1640529afa",
        "indicator--48bb4e69-ff25-46a6-8145-3379faefbec9",
        "indicator--c56e21ab-8520-4d25-92f3-0b4772523cb1",
        "indicator--95ad3ab5-7bfe-4e5b-bdd4-b09c7fa7cef1",
        "indicator--e1bc05d4-3816-4e14-bbe3-a410b762a070",
        "indicator--93ed98b9-912b-4ac0-b080-ef07f582025b",
        "indicator--7f9ef71d-9c9a-4433-9ea9-fc8e20b6eb09",
        "indicator--43423e7c-0cfd-47a4-81f0-1fc79bc96606",
        "indicator--da4e55ce-1674-4623-9322-bf9beb49fdad",
        "indicator--2b7ed60f-2c04-44fc-98ff-0c52b7b9c2f6",
        "indicator--270c42d7-f3fb-4397-adaf-ccf534d0d7ab",
        "indicator--78ff70ff-a3f3-43d2-b120-ab1afcd08163",
        "indicator--cc910ec7-2a6b-4b05-ae96-c52aad4550af",
        "indicator--0c53d773-fbbd-4019-844c-52b944cf7041",
        "indicator--7bec12b8-1013-4f52-a037-67f18fb456ef",
        "indicator--06740c2f-e1e5-4f9e-8b5c-27b9a8ed8cdd",
        "indicator--8dcddffa-36b7-4e61-8a47-dcaa0e3b9e39",
        "indicator--75944978-17ff-4ce6-b804-402eba16a79e",
        "indicator--dc05f032-5bb6-4afa-9ced-756d2b5103af",
        "indicator--e6b9afe5-06bc-49b1-ab73-4adc91ce268c",
        "indicator--a57ac641-3cf2-46b6-936e-f485689e7294",
        "indicator--b99efdeb-3120-4639-b825-7601630e0443",
        "indicator--1e45ef06-c8cb-4458-8dee-14570bb26c9a",
        "indicator--8ebe94ce-ac6c-495e-bacb-f876864fee25",
        "indicator--bf1f142a-da69-45c8-94fa-7b3b08b22c1e",
        "indicator--b3911f83-ca4d-47e3-8636-837a0729aacd",
        "indicator--71f700a0-e12c-4965-85c0-9101a1e68029",
        "indicator--381ef45d-653f-4785-888d-2ef4037ff877",
        "indicator--9b5fc7cf-3a85-41b4-b37c-683b1f238048",
        "indicator--6757fce2-0a03-4e04-983e-f18ca398400b",
        "indicator--70108cd0-4d98-4099-9edf-e22ea14dc25a",
        "indicator--93ba5069-7dee-479f-91dd-53f4f59d4697",
        "indicator--c0f84b35-58db-4a13-9478-ab35cca7e368",
        "indicator--96394ccb-98f7-45d5-9293-4c07a5e4854e",
        "indicator--043feacc-d972-4e1c-b1e3-dbd0b6073f61",
        "indicator--91b5c36a-2b68-4cb6-87fc-b48bbbd7b665",
        "indicator--30d77914-02f5-457c-8fc0-c643d8c40bc0",
        "indicator--f283d690-d4d3-4954-92cf-d93500e963e9",
        "indicator--e402365c-595a-4332-92e9-54493ca520a6",
        "indicator--6668d11c-dad2-48da-8341-f3c51cf637de",
        "indicator--0f6687fa-2ce5-484d-97ef-fe4655993d21",
        "indicator--bc0d7fe3-79dc-4544-be7c-9ae73a6e2bae",
        "indicator--e5bcc242-9ff0-4811-b6a7-9f1091ce503b",
        "indicator--ab313e85-db08-4ab8-8ca2-9079542b987b",
        "indicator--61277feb-2322-419f-ac14-a3f4bb808cbe",
        "indicator--0e295883-9d5d-47cf-9dec-031e07594d91",
        "indicator--e8e91247-3014-49fe-adf9-e5f709897c47",
        "indicator--7fa6cacf-7878-45ef-ad04-85158b2b905b",
        "indicator--ed4d4d34-6cc0-4487-af21-87125788b0dd",
        "indicator--5f0b827f-5fd1-480d-a21d-f1102e9881fe",
        "indicator--2444d111-1635-4c3e-9486-1d92be0434a1",
        "indicator--a8cba964-3cff-42da-8c20-abb9578a3bcf",
        "indicator--8f0219b6-d224-4953-b926-cfd060dfaa7c",
        "indicator--2eb7534f-3361-440b-af44-48157a5021db",
        "indicator--c3aff435-dd5f-4b34-ba1b-4527e4d18543",
        "indicator--cccc1112-1b19-4d84-838b-36b7dfededdc",
        "indicator--1ae2ecba-b57b-410c-87ad-b44beb9e1d47",
        "indicator--faa3170c-f73f-4cdf-a205-9c9a0199a5ea",
        "indicator--fc9363a0-9509-40a2-a71c-a52a1758d75e",
        "indicator--81fe6c51-4227-4421-a613-9c54250dfa6e",
        "indicator--8087c8c4-2e28-45f9-9ee2-c9082bd7d90d",
        "indicator--6b3c7e7f-8f06-4ce3-bd5f-290013b0a5a2",
        "indicator--21827904-c1e5-4244-be73-7eac00ada749",
        "indicator--c6cdae23-4e1d-4370-809e-0979b12d96ae",
        "indicator--c19abbb6-4c1a-41d7-96ed-92febe561c49",
        "indicator--9470754d-ef2f-4dcc-8399-fcc725cab2f5",
        "indicator--20d6f7d2-7f1e-4e3b-a7ab-c9532783a8c0",
        "indicator--d7e2fda7-3946-4a4e-adf3-061119f130ce",
        "indicator--d2d9f93e-1868-4b3d-a80a-4971974062e8",
        "indicator--012b9bd3-16f3-410f-8cad-2b88017e44b2",
        "indicator--122ae993-73ff-4a84-ace6-4f2afb13b996",
        "indicator--4cef1bc6-d6af-4e9a-892e-e1d2511f4a34",
        "indicator--5bf8f6d5-834d-4639-b3b0-6e6e65525792",
        "indicator--67705010-8c7c-4913-bc6c-061931e89a24",
        "indicator--a302765f-cfc0-4544-926d-cd184337662d",
        "indicator--8f07dbd4-1126-4562-9ae3-580fd964c89b",
        "indicator--8cba0e21-b833-4b2a-8cc2-6d144652e2a0",
        "indicator--e94213e5-cfeb-4425-ac95-cf45e0fbb32a",
        "indicator--8e5a5d8a-8baf-4c37-8b52-f3e8fe8cb4c9",
        "indicator--5f6e9069-4034-4d42-8d83-672e6da516b2",
        "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
        "indicator--8ed4d507-afdc-43a6-81e1-fa08cde18eb3",
        "indicator--a95aebf0-1306-4d90-ab40-880c0bb54538",
        "indicator--714d6898-4199-4027-8714-ec24244becfc",
        "indicator--1dd0aecd-b0c6-4c03-8b3a-ba5001e16f33",
        "indicator--fc04567d-fad4-4385-ab25-2a0050b230cc",
        "indicator--9bd6fa2a-4dc3-4157-92f4-98b208fe08b0",
        "indicator--aa716c02-b8e8-4fd3-a9b0-cc99f5ee02f6",
        "indicator--51757d5f-1b65-4178-95c8-75efd48251ca",
        "indicator--8694df63-367c-45fb-8e48-73a3ff9c9d1f",
        "indicator--fc12a587-5b90-4752-9daf-676cf1f3d6ff",
        "indicator--9afe541c-6721-4634-b526-7b2b90deba15",
        "indicator--b2cadc4b-781d-43e2-8e47-a44710162b35",
        "indicator--2bf2acac-e486-436b-8ae1-86231e2ecc6f",
        "indicator--9c430076-b68d-4c20-908d-8b80ad98bda0",
        "indicator--fbd0dd4a-d070-4f3e-bb5e-b7ad9e77805b",
        "indicator--a3908727-dbaf-4db2-85c7-b4cb9b9feb49",
        "indicator--67b12084-1c70-4366-99f2-81b946e09659",
        "indicator--9bbb2bcd-b05f-4b98-88a1-80218d7cfbec",
        "indicator--cd7dae1f-aef1-4c07-84e9-70186eae637d",
        "indicator--fa0a6046-8478-41c9-a9da-7ced674aeffa",
        "indicator--5a84257b-599c-4ca2-81fd-3fd79737623c",
        "indicator--d5e0d968-36e3-4253-99d1-3374e5bce0cf",
        "indicator--9bc752d3-1708-449f-afd5-0f20c05b29cc",
        "indicator--ce420b4c-e6b5-4dd0-8b8c-d168b6ea05a4",
        "indicator--aa4c3198-7298-43c8-b1dc-c4b0cca2d5a4",
        "indicator--6b58eaa3-b8c9-4d13-bc53-284a65b84b46",
        "indicator--39bda1b1-0522-4efc-98d8-a08b3dc1e8aa",
        "indicator--8a7e742f-3d3c-4d95-8a33-9fcc08c7f4b4",
        "indicator--179b8fbd-5d3e-4030-8419-5d08355b07b1",
        "indicator--5e58c20e-d703-481d-96a9-f1ee09e3aee5",
        "indicator--0c63f1ec-1db0-496a-8ce8-c3748413910b",
        "indicator--6464bf83-dbe9-44c7-9cd2-8e7bfa4739ab",
        "indicator--b598dfe3-d6db-470c-8264-f9d4528e1411",
        "indicator--79074e5d-4eab-4d01-8bad-6883e9a7f130",
        "indicator--c57fe4ec-52b6-462a-accb-e8a18c873924",
        "indicator--1830fa09-9885-4e47-85c4-c55fb509bd8e",
        "indicator--9f88aece-5c98-4000-8be9-7083811b423e",
        "indicator--8f4c484c-e649-4cda-b113-9a3dc8ca8998",
        "indicator--a692850d-805e-4615-a138-e07fba1de173",
        "indicator--254cbdc5-ec13-4161-bc96-7ad8b69f94e4",
        "indicator--5da8b21c-cbd3-4c79-b446-9bedfee9b36e",
        "indicator--354669e4-b74f-413c-97e6-b73909f5d280",
        "indicator--7adb9a03-797f-4851-8b6e-a4688e2e2b40",
        "indicator--8127d7f8-d72a-4ddb-a42b-4b206d7380b2",
        "indicator--7d43fc8b-9ab0-44e4-80e1-057cee34a8c5",
        "indicator--8a693586-f6a4-4b93-80cd-abea285bd4c1",
        "indicator--c3fef20a-dfbc-47d6-9310-ff125a2c84aa",
        "indicator--c890ce33-8cad-44a9-a003-088f4f198b72",
        "indicator--1171e9c1-c846-468d-9264-be0f0474c4b4",
        "indicator--fec325f7-ab78-4cf7-b5dd-2d240a14b0b6",
        "indicator--ada2531f-4dd5-45f8-9b0c-195f3b7385eb",
        "indicator--22255904-0ee2-4c66-82a8-4aa0aed7fef3",
        "indicator--9596ff6b-cb82-4a24-bb93-d3ea80ee2165",
        "indicator--d06e9862-b8e4-4f31-b2cf-9b6788c93c24",
        "indicator--86639012-c5cc-499d-8c1e-8e7c449585e1",
        "indicator--7380ff13-877f-4333-90d4-0793791ddd67",
        "indicator--5ad86291-2401-4ba3-8bbe-4c47e2d10cb2",
        "indicator--3a9222d7-ec1f-4b59-8064-c4f9cc6489cb",
        "indicator--7af25294-3e64-4238-9f9a-d838a728585b",
        "indicator--f4971d16-d4e0-4453-ad70-11c9bd291d9b",
        "indicator--8443b76c-7453-4193-8bd7-652bf27c4be1",
        "indicator--b79cde4a-7520-486f-a6e2-265097065b4d",
        "indicator--d49b8ea7-7639-402f-b376-93aa48384a04",
        "indicator--ffafaa18-14bd-4c40-a135-08974301211b",
        "indicator--cd61a957-d4b6-42f6-9328-19ade48de934",
        "indicator--865a2aea-5a73-43e5-ae30-6c34f703ca0d",
        "indicator--f33113f5-8447-4398-a904-3da6b6bf935f",
        "indicator--966b8d55-4bcd-4865-83dc-7e5a9f7e93d2",
        "indicator--3b395047-d954-4ba9-8534-9e638c0c301d",
        "indicator--9500164f-987d-4dc6-aa09-ecd88640ac84",
        "indicator--17ae6aeb-6cd1-4936-9ac7-a7e2fdbc8b49",
        "indicator--adfd6237-c55d-443f-8368-5bf89248f094",
        "indicator--10a16dc9-48a5-4c75-b46f-b6a8dca20336",
        "indicator--62119476-894e-4333-be3b-c5ecb13c40e4",
        "indicator--ee6542f0-c2b9-476b-bf30-c120b9a2887a",
        "indicator--d4af880c-1bb0-422c-8a27-d4a84132411b",
        "indicator--672232e7-c284-4b71-b1b7-c4701e2a3411",
        "indicator--ee8dc2bd-acc8-4279-9d0d-0674e993f96c",
        "indicator--19160274-e7a0-4d03-8445-0e5e98a1d55c",
        "indicator--a992e584-c8d0-4ee4-911d-099a2ba4fc9c",
        "indicator--aecf776a-915f-4728-ad57-9ccf8fe75aed",
        "indicator--62595142-4762-4148-8f06-0da93db15bcb",
        "indicator--2e36aaad-18c6-4abf-a731-9e14a666c652",
        "indicator--e88a91e0-6267-402d-a16e-fa09b8a12e79",
        "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
        "indicator--32da7e94-67bd-49e8-83b2-0a7c549ca3c2",
        "indicator--b147fbb0-7368-4056-a7e5-46fa404648bd",
        "indicator--725103a3-8c88-461a-a2b2-d81f8e15f6f4",
        "indicator--ac23a67c-461e-416c-affc-56a64f6f0b03",
        "indicator--70618f04-dcb8-4cfa-bf92-c9add9e99907",
        "indicator--d1df47cd-1c82-4870-be16-a1671d967f74",
        "indicator--c7bb2feb-38df-43ed-a418-a4497c61dbb1",
        "indicator--130125fd-53bd-4c5d-af25-c33219aa5380",
        "indicator--1dca32d0-c08c-40aa-ac31-c829f08aaf1e",
        "indicator--440a1f55-e702-4795-bfcd-dbbbe5dbea4b",
        "indicator--3e853679-3074-4462-936c-8fd0c467a745",
        "indicator--34d65e5d-e94e-4832-ad9f-73fe480ec3be",
        "indicator--0219bfe2-288f-41c7-a984-71fa27876c84",
        "indicator--22be67f1-7b62-4094-83cd-b4d9248676b1",
        "indicator--69133d2d-6f47-446c-9c6e-4bdc28689a8c",
        "indicator--864bcf82-9d66-40ce-bcbd-1e86ae779b1b",
        "indicator--0e64c170-528a-48c5-84ae-2f098316c608",
        "indicator--e12b7f19-028a-488d-a00a-4f20600a4e67",
        "indicator--8dcbb056-c166-4ab1-8fe6-f11e5507199d",
        "indicator--34741dde-697e-4acb-885f-7cf4872778e7",
        "indicator--0e35584f-4a2a-4a51-860c-546cb550cbd0",
        "indicator--d454329b-b8df-4fc0-ab6b-9dd3ea0bd80f",
        "indicator--96b42dd9-66b2-4a94-add4-b9ec1a1ed737",
        "indicator--c36f2837-6aaa-4775-a06e-1874a96f7196",
        "indicator--b2b859a7-3bf9-451f-a460-0dcd9039e96e",
        "indicator--17b974a1-dbb2-422f-ad75-633323ceb069",
        "indicator--b3ab6d9b-4400-4afd-98ab-09c70bf29805",
        "indicator--1a7280f4-d8af-48a0-b413-6bf1e8fbdb1a",
        "indicator--9ed034f1-9d66-44e7-adba-72f193cb42ab",
        "indicator--37f601b4-2b4b-460b-8d80-c4270c3bda56",
        "indicator--ee4bce54-02f7-42fc-b105-d77aadd76d5d",
        "indicator--aea34727-57cc-4263-881d-028e5b151202",
        "indicator--41e61f59-1bb5-4a99-9488-a8d93ef275fe",
        "indicator--a5b3ef69-df37-4ed9-bc8e-673883e794e5",
        "indicator--45f6a2b1-f5ea-4363-b1e0-f71f69f9efec",
        "indicator--2fd18e5d-7c1e-4993-b194-a9240630572a",
        "indicator--f48b0861-89d1-4ebc-9ba1-cf906da1e83c",
        "indicator--290eb7d8-5f51-445d-9d9b-1a22b0c4d076",
        "indicator--8173f20c-aa35-40c2-a351-8fd11a56e801",
        "indicator--02a03048-1b7c-40ee-9bd6-2fe2848029ce",
        "indicator--9f4b3320-9e35-4934-93b0-7e5cefbaeb85",
        "indicator--ca9c4987-51a2-4bfc-83ac-b2c299c2eaba",
        "indicator--ffa3335b-41cc-4926-8316-eb8dcf7a144e",
        "indicator--204ce407-d724-4a96-b1a0-a29f6194f87d",
        "indicator--5fa29840-df92-4fff-83fa-af197bd68ba8",
        "indicator--16a27a0f-df69-46dd-8a59-eeefb4e19b13",
        "indicator--65758f38-b9ca-48a8-8226-bbd4f09b08e1",
        "indicator--eac8fa49-cdfd-48e8-ab70-a6dec0d2abd6",
        "indicator--9fa22e12-0197-4196-be27-9dd318e33841",
        "indicator--5d9580bd-32be-4fb8-82e1-2f5e6f69decf",
        "indicator--6a8b7a68-734d-4a0e-9720-641d22fb71f4",
        "indicator--c9ccf025-e458-49cc-bd5b-f8a21a1dee84",
        "indicator--944ef159-de72-4b10-9e01-dfe0f35fd959",
        "indicator--b550c270-c9e9-4bfb-b4d3-18311d8d6898",
        "indicator--b819eb99-f2bc-400c-9181-e0445d150130",
        "indicator--8ded2670-2faf-4adb-b3f3-ac47991ea0b7",
        "indicator--b58c757f-c6f8-40c3-a71c-ee0ec3c052ea",
        "indicator--09cb8e04-5685-400e-90f4-45cfdcb2e863",
        "indicator--7c357613-6c0b-454e-94ce-ce3d5e613570",
        "indicator--4909f12f-6168-47d1-973d-543bc9d0c44e",
        "indicator--6380f4e5-ab4f-4389-9807-d69d8ef8ed0f",
        "indicator--cb898d42-8274-4ffa-a292-614f38ecb0d6",
        "indicator--ebd08371-f690-44c1-a4dc-9d0f498686f8",
        "indicator--762b55da-3192-4a9a-83c5-a04138a32f54",
        "indicator--2462938c-ec19-4078-8d71-c11bac695c0f",
        "indicator--36ce50d5-501e-4fce-a3e6-ffd2663de43c",
        "indicator--ec7a3327-4fe9-40ee-8c98-1c49d366ed23",
        "indicator--8e2a7009-c4e9-4a33-b5b9-16691e563e2d",
        "indicator--0a147ecb-d82a-4e62-ae68-9d4ed3e548f6",
        "indicator--6bda7a2b-13b7-4101-a9a2-e923e5c41d9a",
        "indicator--dd5006ba-4a6f-4e09-b581-6d3b975108af",
        "indicator--eb82f758-735d-48b0-ab66-df05495d0ad9",
        "indicator--5ef219e3-ed63-4412-a076-f29393c499bb",
        "indicator--8402a36f-a131-442e-8d01-00eed97eec30",
        "indicator--6f11c217-667b-4ac9-872a-2884db5c2935",
        "indicator--f6862cad-bdc9-4ae4-b020-12ada9e9b4d8",
        "indicator--c5e27439-4d11-471a-a1bb-d82fe2f44054",
        "indicator--181e6e05-0046-4f13-a288-d1e447b56e9f",
        "indicator--1946f735-f099-4c53-b832-d3ba334e4137",
        "indicator--c82ca928-12b0-4a1a-b1a3-1700e4d4ae6c",
        "indicator--d1e4ab3e-a0ae-4e93-b270-65b369437db7",
        "indicator--1bfa346d-e27d-4498-b765-3dd9e078243e",
        "indicator--e60512a9-cbc4-4043-ba51-3e0bab64de5d",
        "indicator--9f95f978-1878-43c2-8014-13acebef6b78",
        "indicator--bc687e13-964d-44eb-b72f-69cf4466e5b4",
        "indicator--1fa7870a-5047-4812-b47d-6094a4c57ca0",
        "indicator--50d44a8f-c57d-416c-b247-066eafef25be",
        "indicator--6777e372-c790-4050-935e-774f9e6cc516",
        "indicator--71a318e5-54d9-4fda-a39d-6c3215e45875",
        "indicator--97fe85c8-a782-4df2-86fc-7d54a79c9c23",
        "indicator--e4b25625-16ae-4ee6-a7a2-79267586f6da",
        "indicator--cfcd06c8-f037-4506-a7ad-62c955a6c2c3",
        "indicator--68ed2e94-e191-4225-9da4-6e700164eb01",
        "indicator--2b40cbce-201b-404e-952e-d3fe53d6b122",
        "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
        "indicator--ffa98d32-25eb-438b-a8f5-f07e875496cb",
        "indicator--63cd03eb-0869-413d-8604-19bc4f328d3e",
        "indicator--0e1ede6e-76b8-478c-bacf-40b739889e9b",
        "indicator--0afe38b7-be81-4f5e-a0f1-1289035fb714",
        "indicator--b1cde156-f744-4a90-9a3b-2c37b50a8cd6",
        "indicator--20d77404-cda0-408c-a998-0f20fd476c51",
        "indicator--f1ce24fb-8a46-4fb8-82dd-9385f9dafcec",
        "indicator--2ec97be3-cd43-46d0-a31d-37ba58b04237",
        "indicator--fd9b7fb9-1a13-43a9-999d-c0bc955fa737",
        "indicator--2c9e1421-aa00-4e9c-a07c-0358edccb5b1",
        "indicator--4772bec6-5edc-4e44-bf5f-521c7c664e55",
        "indicator--5e1b3043-451d-48ab-8205-7c01ebee8547",
        "indicator--9fd8f06f-67cc-4716-b52f-336ebdf02e4c",
        "indicator--b25bf906-65df-4079-92ba-25e4b3fe68cd",
        "indicator--b220329f-393c-4a48-8673-397da65ac5cd",
        "indicator--c534112b-e54f-4945-95c5-168763f6459e",
        "indicator--6f904ee0-19a5-462c-bfec-4f37b7de0f63",
        "indicator--4ff52f22-74e2-4f61-b338-cf58298799d3",
        "indicator--6d4dffb1-1b31-4366-b3a3-5772b2a94695",
        "indicator--3ab86e5a-fd01-4a6e-8619-5d7956890655",
        "indicator--ca67d2a2-41db-4032-8ad7-da0107afefb5",
        "indicator--b64e0443-fcf6-495d-b641-6dae3adaba92",
        "indicator--84fd24dc-b323-40ce-8bf7-1ba96e098c36",
        "indicator--07f93adc-ff4a-405c-995f-6d924bfb4c0f",
        "indicator--24788ee2-bbd4-4f54-826b-9882cacf540b",
        "indicator--4ca66a4d-6aa5-4d8f-92c1-e7b0a6e24b23",
        "indicator--9b3d0254-26f4-42de-9fd0-4476e02a59a3",
        "indicator--5e552172-1ef7-4a26-bd20-f37cd72931da",
        "indicator--9a216525-6452-4172-a185-d3710f5f727a",
        "indicator--5868c146-a61b-437e-9a5e-017186f4c370",
        "indicator--43179299-63dd-44b0-b95d-6adba7580e10",
        "indicator--56a1ea18-9ca7-420d-91f2-e6a8cb2a85a5",
        "indicator--0bd29b7d-e97d-451b-b7df-5cf867431902",
        "indicator--e40e7624-1219-4355-a68b-6997bd771385",
        "indicator--fcf99b6b-b5cd-467b-9d66-131d45b4505e",
        "indicator--f2eba859-9861-4111-90e0-203cb0e9d434",
        "indicator--b14d5191-0af6-4129-8578-4bcce4191ab9",
        "indicator--c215c121-698a-43e9-b121-99dc18cedf6f",
        "indicator--ed0e4e90-ba02-428c-95f4-ec50312d7079",
        "indicator--ad000853-72c5-4a33-b487-557e5ad60bb7",
        "indicator--37faefc9-0a96-419f-a4ea-88a6811dc91f",
        "indicator--90f6fbfa-c48e-45aa-921c-cf416c79c1f8",
        "indicator--7560f455-4305-4961-8cdd-ce52f467ccc1",
        "indicator--2312e761-6bc9-4acf-b90c-64076914cc65",
        "indicator--36148765-701b-42a6-b356-72529ef7b16d",
        "indicator--5bac5300-4b4b-444d-919b-6d2f7a7e1098",
        "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
        "indicator--ce1bf697-8090-4d09-bae9-cf076f4fbe99",
        "indicator--0f464454-2db4-48e0-9a29-4b5193ec6a4a",
        "indicator--d1e860f2-94fa-45fa-afc3-43080efd2c57",
        "indicator--5bccbba8-32b3-43cf-a188-2a3a2d77a75a",
        "indicator--6cbd5a53-f9c8-423c-ac13-1517714d18d9",
        "indicator--03babd3c-f2fc-4675-adf9-436599a913bf",
        "indicator--1eb53b6e-425f-4b08-9c6d-10b8219a1833",
        "indicator--5407d86c-0b3c-4185-9924-e9439166723a",
        "indicator--f67bcc38-4343-4700-bf1c-99ff1b2fd1b7",
        "indicator--dfc3c190-913d-4830-9dff-9ff9f0cee685",
        "indicator--11b8a410-e1ce-4c31-b361-e7d8124ff6b9",
        "indicator--764541c8-ecce-4c36-8e7e-4fab58218772",
        "indicator--f003822c-56e9-4cf2-850a-b059cd022432",
        "indicator--2e7de68d-1f50-4988-863f-bab4970713a2",
        "indicator--f3d70ea7-4f04-439d-ba2c-2cac1d680e28",
        "indicator--d6da65d7-43b3-4118-9fbb-65233a5e0eda",
        "indicator--d53aa1fc-54aa-484b-9285-12e29cf9fb4a",
        "indicator--55ba95f9-ad62-480d-adb5-aa963f4f2cfb",
        "indicator--01731537-9b88-4be2-baea-c6fa3f4f3ee9",
        "indicator--fb4f92f3-0c2f-45b5-8235-3a81fff0631b",
        "indicator--670fd14d-b96d-4ea7-90d8-c4c076e6710f",
        "indicator--f2f42770-ca29-453a-8aba-233100a0ef6c",
        "indicator--41dc28bc-4f3e-4f07-beb8-75858e626551",
        "indicator--13c5ffa6-0d21-4fcd-9098-312c58c83e9e",
        "indicator--6d810a4c-e545-4077-b9a6-7cdad9140e32",
        "indicator--1d8eb2ae-e1e0-47b3-809e-a71332783ca3",
        "indicator--3517616c-0266-4377-b667-87aeee21d522",
        "indicator--0523467f-1049-4749-b522-218d32a1a299",
        "indicator--3c5c6b7f-4c3e-4dbf-9e4b-2c38e8ddca0a",
        "indicator--822b6278-3136-48c4-829d-fb7682bba7a0",
        "indicator--a3495fac-a4d1-4fbc-86ae-4b19d1912418",
        "indicator--408e4688-9d3a-4288-80c6-9f7b114cb07e",
        "indicator--a10c8c6c-87be-4328-9c7c-dffdb722d5ca",
        "indicator--3986cc22-3e53-49c0-8b8d-417ec5b90a56",
        "indicator--5ea8c268-07f0-45ba-9fe3-aacaf12ab60f",
        "indicator--14f9527e-fb0f-4416-91e5-fcb64e3fcf19",
        "indicator--4bcd185a-8dcb-452b-a7a9-0596fbe440ad",
        "indicator--e5de7a2f-b2d9-4e8b-91dd-c22e2f1c6528",
        "indicator--0499ee25-6380-4ed9-b2d5-0aa8b7fd5f22",
        "indicator--3476f950-b16e-4ce8-a60b-3c675d06ec59",
        "indicator--06a2184e-2c84-4d9b-9829-78ae88dd6172",
        "indicator--5e9026ac-323e-4325-8685-c5d88079c34f",
        "indicator--b5c39848-83fa-4911-a9b2-89bb6553f807",
        "indicator--d37c97bc-bf4f-4788-9330-a33183b069d0",
        "indicator--64972cc0-5062-4ccd-a50e-5222759d0b59",
        "indicator--c724b900-793b-4fc5-b4cc-07c1784c56b8",
        "indicator--74d0ebb3-82b3-4f94-9c6c-9f2ee7abbceb",
        "indicator--244cf451-ebb3-4f4a-b8f0-912fbb9f522c",
        "indicator--23613dd2-8bb6-4e2f-81f5-90a84b7650b2",
        "indicator--c7ef3755-2dd2-4e50-b4e0-09751b6f4912",
        "indicator--3f43d373-296d-4858-b6da-f208babc4483",
        "indicator--21530dbd-f272-4c2d-8d4d-6a030b3c6280",
        "indicator--4aaf5857-9498-4fd9-9f23-0cdf287a2d9a",
        "indicator--caa9cce8-e888-4724-b661-cd93c08d8ce1",
        "indicator--ad396403-588d-4059-95dc-a8e6ed6be18c",
        "indicator--d9db45fd-6799-4473-802e-aff1f3aa7ce7",
        "indicator--07fc1ff6-327c-41ed-8272-bbfcf5683960",
        "indicator--e72e7f65-b347-45b7-829e-9559a50ee8af",
        "indicator--6acd89fb-a04c-4e75-9706-d6edc88b6170",
        "indicator--06d3b10c-8a41-44ec-bb50-325eaa81e09b",
        "indicator--eb54aa48-1d60-4da9-806d-5c4c7a7550d8",
        "indicator--2341b950-ce1f-4543-8139-25040e138f4d",
        "indicator--4ed7af46-dbff-48e4-8cfc-0a3a0ceb70e2",
        "indicator--0d9dbf91-7679-4834-9486-fd5cf765e5ef",
        "indicator--b1dba78e-388a-401f-b6ae-53bdf0d2c430",
        "indicator--aff47176-8d79-4fe9-92ae-d8dfb90f699b",
        "indicator--b39addaa-10a0-408c-a824-c86d6d546530",
        "indicator--548dd076-7713-4ddb-80b5-163cb514cebf",
        "indicator--68a9077d-99e9-44ba-b7c4-cbe05b71719f",
        "indicator--72dc3290-fafb-45da-8332-0dba785487dc",
        "indicator--e979d996-037f-40d7-90ff-9df4968d816d",
        "indicator--4ed84bbe-0dc1-4d46-8d70-27c0a37e2476",
        "indicator--0aa77709-ecaa-44e3-9d54-34444ef563e1",
        "indicator--829fb2e5-1990-4e80-a808-866b21cf6e3c",
        "indicator--bc89cbaf-a8bc-44c4-84bf-9467ddbf2312",
        "indicator--4ee30982-c395-4e00-9d67-935680ec95c4",
        "indicator--61940e62-b73a-442b-bc78-7b518eef5566",
        "indicator--c13ea5fc-eba9-4698-9aa9-d5f34c00c3f1",
        "indicator--8a6d77c6-37d8-420e-bef1-e227d8b8db8b",
        "indicator--74913c86-76d9-40ab-a5f0-a67326e768bb",
        "indicator--431c0d28-3162-445b-af94-b5ca8e9f5b06",
        "indicator--3bed4d8d-8829-4ac8-a356-7d8602f2ef28",
        "indicator--acb385b0-ed15-4c9a-8965-86cecab39683",
        "indicator--f717a45d-0d58-4b94-b7b1-88eb4ba88107",
        "indicator--17160688-57fd-41d0-9f6e-417a457f1b07",
        "indicator--a647e605-6730-4ba7-ad61-3b6c6c40f2b2",
        "indicator--56172a8c-f5cd-4b6d-9773-31d7d56f50c3",
        "indicator--3622e3e2-4ef6-484c-a01c-ddba5f4e5c07",
        "indicator--18062449-f1f4-4dbb-9a80-b8769d34e62f",
        "indicator--aa4b1c60-c60e-4ce3-86c1-44e1fa317a2e",
        "indicator--89141306-f812-4855-a451-79165be57b28",
        "indicator--5a9b1950-daef-4314-b466-4b031b2ac63d",
        "indicator--3e70b8ed-fd1a-4aa7-a696-b9edd9b39302",
        "indicator--1f4afdda-6646-4458-af9b-36ac7c7ef5b1",
        "indicator--2296bb63-4b69-471b-bb78-5c201216bea8",
        "indicator--d5ff9dea-9a1c-4aa1-ad89-797229ce90ea",
        "indicator--bbec8e7f-5db6-4f74-8d97-f29a3c46e388",
        "indicator--f19ad781-49b8-40d2-8485-9fd22fca024a",
        "indicator--47591cb1-476f-4e34-98b2-e9230da2bd06",
        "indicator--e307a6b3-b354-4242-a111-8a491689569d",
        "indicator--57914dea-3192-446f-b60f-7d6db9d827e9",
        "indicator--7defc777-892c-43ad-9161-af6494f5290f",
        "indicator--b1cd4607-97eb-4e4d-8583-ac42e0529603",
        "indicator--461b13a2-1de1-4004-a20f-4d80f1aa1141",
        "indicator--b69aa64f-e31d-4c77-b16f-3370ab3ed54e",
        "indicator--e0d494a7-921b-4174-9f2a-12eaa5c37f13",
        "indicator--c6c3b75b-d671-406f-945c-e5aeb2d2c24f",
        "indicator--dbc1c241-cb58-443f-8354-d1eb2a3cc745",
        "indicator--ae7b17d7-30bd-4647-9d84-45518730ff35",
        "indicator--4cabb1a2-67ea-4bdc-9c84-09a4c552f09e",
        "indicator--bb51ea1c-03af-4353-9f4f-449078a9af22",
        "indicator--8c1a359a-2484-4cb3-b2d4-e00954bfc249",
        "indicator--3698c4fe-87f4-4a96-8e63-ea048b3b27b4",
        "indicator--bde96bb2-b68a-470c-a777-868a2b18f1ea",
        "indicator--07717d90-caae-4245-9f7a-a62964518fbb",
        "indicator--276fe695-5422-4cb5-9261-722bb2946a9e",
        "indicator--610ca676-8123-4232-9915-98f580ef6f63",
        "indicator--2a894a14-4aa6-4e8f-91a7-0a877fbf540a",
        "indicator--4d6a6949-b429-41eb-8729-462bd52c1dff",
        "indicator--584f033b-0f84-4b1d-b9be-a87c6edbb86b",
        "indicator--6054b759-af00-42d2-9364-3a82217c5566",
        "indicator--6c6810c7-ffbf-43c5-bda2-9ad1b634531b",
        "indicator--4e66bb3f-c0fd-479d-86ad-27ecedfe0697",
        "indicator--22e19a6f-857f-4323-b7f7-ebbe52dfcb1b",
        "indicator--d7a3e607-804e-43ed-a272-87f1e1d0c213",
        "indicator--64db3107-60f2-4394-abef-ade749e251f9",
        "indicator--2dacaf5d-9bda-4f33-abf7-f9b4076f1d4e",
        "indicator--bd5b5204-40be-4b29-9d05-6f96b551225e",
        "indicator--d52510c6-18b1-4ddd-9dc9-4d22a2f70d0c",
        "indicator--7eae5d78-5233-4009-a91a-4189366eb4b4",
        "indicator--a3f2f23d-e855-494b-b43a-3f4756b2ceeb",
        "indicator--50309375-5818-4498-8f9b-73d307d7bdff",
        "indicator--0db1c5ca-ad0f-4610-bf9a-28a79d950f66",
        "indicator--bb7bcd65-039b-462a-a21e-52cd66dc3853",
        "indicator--ba3c0a63-ef24-4189-bbb6-2da5c242558c",
        "indicator--a1d59d4a-76ae-4998-b19b-b1029de806e7",
        "indicator--e18a08a4-bb0b-489b-8a2e-0c7fca068c35",
        "indicator--8b2f431c-b975-47b3-b933-1db6030c73d8",
        "indicator--89808108-275d-4e16-bda9-40fc01e15ff2",
        "indicator--5b9afecc-705e-4697-ba51-9c1241f49706",
        "indicator--ae721394-2bbe-4eef-8788-4f7ec274da41",
        "indicator--bec263e5-f761-480b-be99-854961c018f4",
        "indicator--effc7c63-71f1-452f-ac78-23af0cf6311c",
        "indicator--dda0682e-d213-4c3d-8536-2d5ef0639123",
        "indicator--03aa2619-da1d-4866-8934-a335a5499ae1",
        "indicator--743761a8-9d2e-470b-94e3-5e3d88f2b48d",
        "indicator--e8a690a6-bbd1-4efb-8588-95492c8ced95",
        "indicator--11780a7d-4f39-48c0-b3ba-81c2282e6d97",
        "indicator--31e05ad7-f421-4f38-af6d-5c24d58c6a55",
        "indicator--f401aa20-3f85-4e5f-81f8-7f3c517da48e",
        "indicator--6a2582b4-645d-4aa0-816d-41ca86033681",
        "indicator--ece9c92e-4318-4aa3-a039-d82d91381e62",
        "indicator--8ebcd856-ecd2-40ff-aea2-d785a2053443",
        "indicator--412152e4-4a82-400c-85d7-8bbfc29b42d4",
        "indicator--8f203b22-8d0d-452b-b233-2da93dd93b35",
        "indicator--a7ba1e32-4298-49a3-957c-4d8cdd8870e9",
        "indicator--b583c4ee-bb35-4dcc-be78-634042c9207f",
        "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
        "indicator--7c0cc863-a56d-44d8-9098-30e3036ee882",
        "indicator--0c571e02-68f9-4713-a4a6-3e737082155a",
        "indicator--ec205d76-de42-4c96-9b65-a84f622f8d15",
        "indicator--b8f629f2-795f-4c12-85c0-6a9c44f98160",
        "indicator--01c4dc4f-9873-4241-8dc9-b82ca12e49e7",
        "indicator--a56f0ad6-c928-43b1-b712-831bd4a7155a",
        "indicator--fcbe1fde-4d57-4d1f-9d82-dc3634663931",
        "indicator--396b97c5-bfb1-46c2-8d62-b7ad622e3ea6",
        "indicator--c4583e3a-e93b-4f01-9589-2956f65addf1",
        "indicator--4265f576-a618-4620-a46f-6a6d34ee0a98",
        "indicator--fe1c2b21-ca88-4225-af67-954bedf2d52f",
        "indicator--1d7c62ae-66cc-45d5-991b-e36ddcbf8e76",
        "indicator--4ec5ed96-636f-4f48-b405-bb52be2ebbc9",
        "indicator--1d9ae13d-dafc-4883-969e-0bef612a50af",
        "indicator--2238778b-ba5d-47a5-80b7-d7de69427d6e",
        "indicator--3d09cd69-e475-4773-8822-ba4a8583fdb7",
        "indicator--a836b247-07a8-42c1-b0ff-c11f5800c5cf",
        "indicator--b85fcbda-5b78-40b1-bca7-77e529aababf",
        "indicator--48b82671-be0a-4d89-88f5-af4dabefec99",
        "indicator--d0ff125d-256c-4ca9-b06b-43fe5c841ec1",
        "indicator--2f012bb8-c92a-4ba0-80f5-82c8a4cc0d45",
        "indicator--3ce14e53-dff2-43cb-a9f3-4abfb63f97e0",
        "indicator--fb7c450c-3ce4-4969-893d-803135f254cb",
        "indicator--2f0dbbbc-0c4a-46ae-bb0c-c4f4d8071f7f",
        "indicator--53aa4f96-7bff-43da-ae61-9ad34796d0b6",
        "indicator--34433231-b911-454f-9bd4-7829ec295c5b",
        "indicator--abab84b2-6577-4f53-9466-62e8b0b12367",
        "indicator--dc5069ec-d60e-4997-b541-c415274556a1",
        "indicator--96396258-6fe7-4533-8b67-60e32433ff59",
        "indicator--aac4009d-5844-402d-ab45-b7f9e5b08497",
        "indicator--4078c1de-46bf-4288-9830-db0bfbba0292",
        "indicator--97b253de-c983-43f9-a498-0c9035b442ad",
        "indicator--ea98b80b-65b4-4dcd-8fc9-8bb0e339a4c6",
        "indicator--7a520020-60c6-472e-850f-630ebda6113b",
        "indicator--0efb18e1-b84b-44db-9348-fcd457548bb7",
        "indicator--478e5af9-620f-4512-aa5b-e8943f79efab",
        "indicator--f793a1c2-a61c-4c9b-8b11-122a3c2edaab",
        "indicator--7138ee43-8c76-4c3d-91fa-72b8d06acd84",
        "indicator--d9a602e4-abd7-4a81-bdaf-213e138bcd56",
        "indicator--08092dca-c7b4-4a48-aded-2bf27ef4852a",
        "indicator--c4e9d811-e173-4acb-ae10-a8878a4f5cc6",
        "indicator--792236cb-53c6-4db3-b271-3449c6360270",
        "indicator--a7e2f7ff-f7e9-4a8c-bc91-83392a40804c",
        "indicator--8e33ba81-0c4a-422c-b41b-f9d393342c62",
        "indicator--6ec86440-235d-4eef-afa5-b5c937a53221",
        "indicator--b706e1ab-d286-4931-926a-039cf66fa8e9",
        "indicator--bab7b57d-b1fd-4748-aee7-c525da56ec5b",
        "indicator--e7977b96-f324-4b30-8099-4d5f42f2fe5c",
        "indicator--f466a736-e1d2-4cc9-bbb7-8b9048be08f1",
        "indicator--4109c600-f273-4008-bb8d-230a64adeaa5",
        "indicator--9accf37c-764d-4a4e-a0bd-87f0b81fe97b",
        "indicator--3bb6a3ae-c200-4a82-9040-79ba4d3ed414",
        "indicator--ee60d5d2-032d-4ecf-8f18-ff406a530179",
        "indicator--9e6af3dd-e069-40ca-a8d6-11703375f034",
        "indicator--a6916193-bf3f-48ce-98f3-f909f4425d82",
        "indicator--d8098008-b66d-4482-a599-a8175285a8a8",
        "indicator--c138dc48-c86c-4dd5-99d0-04e5c407adf8",
        "indicator--f93cae81-050a-4ad6-a923-cf89367dd344",
        "indicator--e590f168-8421-471f-bb23-e27b140f5051",
        "indicator--211af979-931f-41d8-881a-5455acdcea5a",
        "indicator--d906abc2-5101-489e-83e0-8cfdf40c38f8",
        "indicator--037bd19d-935e-44cf-8edc-ba598a60961b",
        "indicator--b74bc249-701e-454b-9225-4dea5d844bb2",
        "indicator--6073fe45-7159-4fce-a87c-d96aaa2f1ca3",
        "indicator--414bd078-d019-463e-886c-706af1e14706",
        "indicator--26ba8f38-a3fe-4a4c-87ed-6db8e8fb3ad2",
        "indicator--0f3eeacc-8584-4051-9e25-6ed56a9e6aed",
        "indicator--5395d067-1d1d-4a60-97fc-82905ea6552d",
        "indicator--7ec5d669-5629-4b30-ab34-3bdfcd64fcf0",
        "indicator--cfadc74a-9725-4251-81f6-f5bf570d3dab",
        "indicator--a3bf3b3e-18c3-4ccf-9282-2ea996af90e6",
        "indicator--6dabc999-3e85-481f-b61e-21484d046470",
        "indicator--0444e682-5311-4995-91b8-9218f315847b",
        "indicator--f32cce86-f57c-4892-b60d-d293cea22e7d",
        "indicator--8f4219d2-4ea2-4164-85ea-4a639da44db3",
        "indicator--47a16119-fb6c-4ab6-842a-247316e74d1d",
        "indicator--38ec0345-51da-4144-9816-545b366fb01a",
        "indicator--42a5cbd0-afda-45f0-88c6-3ea95d1413d2",
        "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
        "indicator--c541c4de-66c7-44e4-91c4-2921d957db0f",
        "indicator--4772237a-fa28-40e1-8393-24e4b4858a78",
        "indicator--758901ab-e371-41d5-b6be-312aa454941d",
        "indicator--80603f3b-aac9-4d9d-a675-6a69f27d448c",
        "indicator--1de5332b-ee3d-447e-bc48-caeac9dac626",
        "indicator--797e9093-73cd-4a49-b740-24eee5321225",
        "indicator--6578d392-6e60-43ec-bcc4-e6997287bdd6",
        "indicator--7a7203c3-ca70-4420-90bc-4b2d7e3fb1e6",
        "indicator--93bd5faf-c0fd-4320-b349-d452d8070791",
        "indicator--e1ce5c37-41ad-49bc-b6a2-ae2a6f61fac2",
        "indicator--c4297078-22c9-45ee-8bab-97a581b55562",
        "indicator--8b4a70ae-2ced-40cd-a91a-59bee9f817ca",
        "indicator--e562fe8d-b1e0-4f0a-92dc-6955a16d0440",
        "indicator--460c1652-d892-47a4-8fcc-9b25af8b1aa6",
        "indicator--0143124b-8319-42c2-93b1-e1138b3cc893",
        "indicator--e0c30055-60a1-4ba0-99ca-5a2ebfda29b5",
        "indicator--e6df7f43-b22a-4bf6-ac75-9c796d822cf1",
        "indicator--bd8bfaf3-cf8f-41eb-b898-09427d4a1922",
        "indicator--9807f87c-97c7-4cd4-a6ae-fb556ed3c007",
        "indicator--0ffb0408-9aeb-4a5f-99a5-f5d10c4ba8c2",
        "indicator--590c3503-c2f1-4e33-ae47-7c92a387b1d7",
        "indicator--45aa392a-70b7-420a-aab6-8445be6bc8d2",
        "indicator--6bc0c74c-f8de-4700-9335-34e9ac8ce69d",
        "indicator--0339ae06-874e-4db1-8e96-7cd93ee36520",
        "indicator--c4d757f5-fecb-4090-91fa-9e264b708eb3",
        "indicator--bb6713e7-c527-4d54-89eb-0dbfb988eeae",
        "indicator--e0554651-be8f-47da-94ed-c8e8b01d9883",
        "indicator--73881ec3-76bf-4abd-ae39-b9b8b0e92dbb",
        "indicator--084c83a3-ecb5-44c4-b7ca-acb04b55c985",
        "indicator--61d0d381-5cc5-4d8c-a4c5-be32e23011d0",
        "indicator--b9223952-0523-47be-9ccc-269d37b1b43a",
        "indicator--2e6c9e44-af79-424d-9cff-cd1f975d8ce1",
        "indicator--5e6c6f09-f510-4c77-9021-9110b5c51f9c",
        "indicator--aba4c110-9d34-41d5-979b-4bbf4222017b",
        "indicator--5c8af818-2bdc-456f-912b-734815a760fa",
        "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
        "indicator--5abda58d-b8a6-44f1-87c3-480d157957e0",
        "indicator--fb874416-6335-4549-8800-6902b08ad519",
        "indicator--0bbbf644-61ba-4612-8940-97f1f479a53c",
        "indicator--041fcbb1-77ae-4b8c-8584-b0c6e405b90d",
        "indicator--564c478d-592c-4657-a37f-86552a17acd1",
        "indicator--0d3acda3-cb8f-42f0-b679-d07fe7ca4f6b",
        "indicator--08767915-557f-46c6-80b7-85378c2d4cf8",
        "indicator--6d33d6e6-3fe7-4d63-8fa4-62ba6ab1537f",
        "indicator--47e2a0e1-1286-42ed-a2d6-6f346ef20c7e",
        "indicator--c544a97d-1692-475a-91d9-2298264ad385",
        "indicator--fa35c074-c080-43de-8a98-988ab5f7056b",
        "indicator--dbaa7224-020b-4a7e-80ca-1f08d69eeb3e",
        "indicator--15b07647-c025-4186-ae53-ea42f530b1d8",
        "indicator--4d3a1b4d-4a37-4e4c-9e5e-b7280dc774a0",
        "indicator--ccd441e9-bbfc-4d94-8dff-d8bb7ad2f06c",
        "indicator--43330a85-731a-430b-9941-f7c8337cb247",
        "indicator--c472a44e-e3fd-44d4-ba74-6cfefba06375",
        "indicator--d0965925-a449-40ed-ae09-4fa6ac7fb451",
        "indicator--77800885-fbc4-448f-aa93-68b098fd0def",
        "indicator--3a389170-2d2f-46b6-8299-fc2b9e19281a",
        "indicator--ec522969-2c10-4fc4-8252-d4142e29665a",
        "indicator--2f6b27d2-c93e-4f4e-940d-bbed15c9d9f5",
        "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
        "indicator--68c62d3a-5f5f-4480-9258-ee069450fa84",
        "indicator--eda8f56c-2e9f-4ea1-a7de-2515c795520e",
        "indicator--5e7dc920-ff16-4a15-ad09-7e35ecc0d4a9",
        "indicator--e1b4948a-51a0-4db3-8fc0-4629cd52f3bd",
        "indicator--789f8776-46e0-43f2-b494-098c85bdab3e",
        "indicator--fef1023a-c242-4497-a2a5-5a3529a818b9",
        "indicator--56945d45-42e6-4288-92b5-710b2817ecb0",
        "indicator--8cfa98f0-413b-4b09-bf8a-f497b1017bd2",
        "indicator--50418bf3-35f9-4435-957c-c95224863d5a",
        "indicator--b811b332-8016-4f6a-bac8-11e70d1d88ca",
        "indicator--fdd555ff-7c3c-4267-8835-d47c507e5645",
        "indicator--9ded847d-e8ad-4370-a957-593949963fca",
        "indicator--772096a9-5b49-4623-b5f2-132f04ff8fc8",
        "indicator--2ac8a35e-49e7-4d7f-881d-c0933e2c54d4",
        "indicator--ba4c4d04-64d9-4358-b608-b6d5f8987af0",
        "indicator--1c659db0-865a-4358-9ffc-58b2836ce2e3",
        "indicator--c6b1d61a-39db-4488-b176-42c40c0651cf",
        "indicator--7d9835c7-ff1e-4a30-b343-24e213c60012",
        "indicator--174d308b-c5a5-4c54-9fcf-1962084ec3ad",
        "indicator--dfa2c145-3d94-4e6b-85e9-6e6c500815d0",
        "indicator--f0477934-bf91-442c-afa7-03d62114805c",
        "indicator--898dd054-101e-4287-bb02-5784e24da36c",
        "indicator--12686d89-9843-4e05-9dc9-036294b22b66",
        "indicator--dc293e99-bd08-490a-bbc7-fb01bffe6735",
        "indicator--f07ead9f-551c-403f-a72f-718243fdd0b0",
        "indicator--e7a39860-7b48-4163-b1b6-5bbc54ffda05",
        "indicator--83553caa-9324-41cb-93eb-ddde864c3092",
        "indicator--fced9aa4-6717-4bec-9e52-943576fd54df",
        "indicator--3349a6c1-72a6-4a23-9afe-726ea5be6da3",
        "indicator--4f54a37c-8bec-4d22-9b47-2045fb3fdb4e",
        "indicator--6f22bcf2-5657-4a8c-97ed-f02a9cf6d5ff",
        "indicator--9c4825e7-ec68-4e7b-8e02-0c623b0604d2",
        "indicator--c2aaa6d5-3df7-41a2-ae35-e7d301a51fe3",
        "indicator--df8e65c5-d120-44e8-a328-c411879cd46e",
        "indicator--fbc0ebdd-3a5c-4815-85ab-2fc24fcae75a",
        "indicator--4a2238ed-0d99-48e3-943b-ece5be97e33a",
        "indicator--d50695d7-f844-4982-99bc-caf48de278a4",
        "indicator--15116625-4dac-495c-b60c-f688970b948e",
        "indicator--cb0e9192-8e9e-48c9-9d0b-c2b3f26a2346",
        "indicator--6327ee9a-d2c0-49a5-a6f7-7bfe8ea7a7ea",
        "indicator--8c756592-df62-4def-95c9-6943719a981e",
        "indicator--999fad93-74ef-4326-a943-df56bf81ce8b",
        "indicator--294e2f48-6bde-44c1-8e0f-8878810d66a9",
        "indicator--da8956d6-8e7a-4e9f-b511-bbda85228e0c",
        "indicator--5b1c311e-8424-47e7-a22a-cd162ddbffca",
        "indicator--fa130b52-32ca-451f-b56a-049402c9806d",
        "indicator--4f010ccb-917e-4d42-acb4-bded6d83fd2d",
        "indicator--e906fba4-af67-4397-aa49-0dd5c7e9fd0e",
        "indicator--8a3a7654-1f83-49fb-9fda-29dccd41b9da",
        "indicator--3f65e120-8a56-4310-8b2b-afde534359a3",
        "indicator--20a0a4a5-3219-4947-abe4-af9ee7800c8c",
        "indicator--d714e171-0b50-4a05-9cda-fd709e34908f",
        "indicator--413af945-1597-4f21-8fed-3896f86e0a66",
        "indicator--b5b16dc6-c44f-47eb-9db9-21c6bbcc64fb",
        "indicator--d8a558e9-f16f-4d93-93cf-a422fab367d6",
        "indicator--1c1f6392-9f4d-4cd6-b996-f0617f154ddc",
        "indicator--09daa750-b3c3-4735-846e-305c49626cea",
        "indicator--d4f0ef82-ef5c-48ec-a57a-ba0d485dc51f",
        "indicator--8ce20261-2687-4f47-98c2-5d44db7821c4",
        "indicator--208b494b-cee5-45d6-a3ec-0be330017c1a",
        "indicator--7e04e99b-92e7-47cd-9202-229b5f43fd51",
        "indicator--f0c94dff-d3d8-4686-a186-8d122a7044ff",
        "indicator--efe75e83-4ee2-40e5-b9e2-a378d8301132",
        "indicator--15fe0488-4eec-45d8-883e-9bf9e55ddef6",
        "indicator--ce6ce735-435b-4cb0-b9e2-13bf2f306a47",
        "indicator--1bf5578b-c9a1-452b-9d5b-db794959765f",
        "indicator--5f200c1f-14f5-41b7-a943-099d52329263",
        "indicator--5c535a69-346b-4799-b16e-1d5befee7c81",
        "indicator--e2ad7ef7-2995-4ca3-bb02-54de77d4cf2c",
        "indicator--15e4b662-9efd-4fdc-9ba1-f624fd2b96a9",
        "indicator--6591d104-3569-4837-8b42-559428e52b29",
        "indicator--93211c5c-56cf-48d2-b2dc-73b75c1ad68c",
        "indicator--e17095f7-ba49-4ffb-80aa-407591d785d5",
        "indicator--fe66c29b-6dfb-4637-bde7-fa247a3f4186",
        "indicator--db91ed01-60c6-43d7-a84a-b383ea6f83ea",
        "indicator--5d1841cd-7774-4a14-b423-526c7c5ec261",
        "indicator--8803e283-484a-4188-b6c6-84c90b945ccb",
        "indicator--5a823ec5-1233-4f81-a400-bbbd64c46960",
        "indicator--57400dac-d812-4f81-96d1-1df14ce927a0",
        "indicator--35a4377c-4098-4c3b-bcff-8feebcdc9cd4",
        "indicator--916c9d00-bfe4-4005-bcd1-18ead28fd26a",
        "indicator--b27d7006-b8dc-40c4-8a22-a4bc96a01da2",
        "indicator--48b434d0-446d-41ff-bb83-e14a171295fb",
        "indicator--90fffd40-7847-47a7-ae90-cdb8c1acfcc3",
        "indicator--ade465b2-4b33-4f96-ba84-7a491a769b8a",
        "indicator--1f66a59a-d422-4f18-8324-1b8091f81217",
        "indicator--4dd90f92-454d-4124-8f01-88c8fe0e76b6",
        "indicator--b4468008-74a2-4cd6-b39d-21d432f25ced",
        "indicator--6a87a7d9-e54c-4256-a23f-adcc7cf7e788",
        "indicator--198b008b-de57-4119-8a1d-a5539db93185",
        "indicator--b6fbcaf9-bb3b-4b40-8be7-6c51048ceac5",
        "indicator--1074a1e3-a905-49e4-b547-54b657349f42",
        "indicator--d4e29410-df98-4d17-af7d-fe0a622ec6c3",
        "indicator--9b8a9da8-b719-42bd-821a-582954bb0894",
        "indicator--c12b58a5-0aed-446f-afb1-23d83052da88",
        "indicator--0994d90a-d181-468e-9a41-c8e20965d175",
        "indicator--59f4744c-896e-4f84-a45d-1d90185e9768",
        "indicator--f32ef30f-40cb-4874-8994-d98b2d609c89",
        "indicator--5d6a9a9c-560e-49d3-8403-fcf990461533",
        "indicator--1434fd8a-bfaf-4c84-a83e-6ef4e8ce7c1e",
        "indicator--a4a4535e-5c46-4324-875b-d98b6205f85e",
        "indicator--fc6bfbe9-e1c2-4aaa-8ba3-00dd22745bcc",
        "indicator--af125564-8288-431e-ba2b-e6699d6d8f6f",
        "indicator--6e502fb4-445c-4719-a19c-cc553fb55266",
        "indicator--6650c1ed-531a-499e-9dd6-6c4ac22480ba",
        "indicator--3cecd910-21fe-4b22-83e9-3c49e623ee1f",
        "indicator--44afb50a-dc42-44a5-b7d1-30d277acc89f",
        "indicator--b50163f4-100d-40da-85f3-485af9568c32",
        "indicator--3858c6bc-74fd-452f-a23b-db0e57ec995e",
        "indicator--78493126-f11b-4a6c-b169-6f6328322686",
        "indicator--5bf0dbc9-9a3c-4cce-9778-358c0145142a",
        "indicator--7c7edea7-e242-4ee3-92d4-47c4d5cde459",
        "indicator--1f8723d7-1ab8-4418-8837-5f4c8721ef79",
        "indicator--fbedbd12-88ff-416c-83bc-c4ae61ea5502",
        "indicator--b3a977fc-366c-4196-8ced-b85c740011db",
        "indicator--22f4b833-a7a0-4622-8759-ccf29284c1e4",
        "indicator--0ee52e5e-fb20-48da-b81d-2da377f15a17",
        "indicator--dfad6f31-a693-4054-b327-6cad23f28c47",
        "indicator--2159c48d-fdd6-44c6-8ac2-b253d1f598cc",
        "indicator--966c9758-1ee1-4b45-83fb-0c52fbae654a",
        "indicator--2d43185f-e2df-406a-bbd1-a61379548e64",
        "indicator--e6fe80de-2109-4040-a2f3-d5656a419f90",
        "indicator--90cacfe0-68c8-48e4-90ab-9b0f717fc8f7",
        "indicator--216f28ac-ec98-472f-a2b3-f3e4fc70709f",
        "indicator--ec28ee9f-03d2-4c06-9a7e-82d05e381f1a",
        "indicator--df444881-1bba-497c-bb1c-5115453b7c5a",
        "indicator--aa2266ef-9d9e-4e67-9b7f-74c891fab854",
        "indicator--b6b10844-c074-4cd6-95c7-6e9dc1177326",
        "indicator--52e63c82-2194-4fa5-ba12-e3308ed332cd",
        "indicator--62ca9b06-bc4b-40c3-abc5-ec2e7dcc8681",
        "indicator--8587a260-611f-4d98-b46f-5065d822e5c6",
        "indicator--650f97dd-6462-4274-910c-f78390654e36",
        "indicator--e69bcd7d-fcff-4c6c-aa6f-5dcc81766b44",
        "indicator--089d23aa-281b-4e5a-afe7-7ba48bab0d8b",
        "indicator--6c9580c8-8840-4e48-83c7-e62e62d305de",
        "indicator--5b5653e4-59ad-4108-b3a1-8378867aced5",
        "indicator--b464767c-c89c-4f61-97c0-c8e4fb2c6214",
        "indicator--f95f2284-6554-42ee-aa07-9f498265aff3",
        "indicator--fd9f3d8a-1c77-4eb3-b22f-45a6fc51f8b9",
        "indicator--4fa5fb99-c488-49cb-887e-d87febf2cb29",
        "indicator--b336225d-bc15-4b6d-8831-4b573f5b1172",
        "indicator--7bc45370-ec3a-4b8f-9ef8-18179ce540c3",
        "indicator--852080fc-41ee-40ce-95ee-083a85beb897",
        "indicator--0eef90cf-4328-4450-9e04-8b4d1089dfc2",
        "indicator--067f7eda-1979-48e7-99e7-ce5530e8c81f",
        "indicator--56535e4d-2332-4986-8ed8-60b17ae811c9",
        "indicator--490f7958-a9e3-4528-bbbc-083a21fb1e13",
        "indicator--2355948d-83bd-432b-8021-85e31b6aa489",
        "indicator--85634332-39b0-4a3e-9a22-23330b8d8574",
        "indicator--8307f2bf-c820-4e24-9fda-1950e51a83b6",
        "indicator--9b6f6943-9bb4-46c0-ae66-20b8b2dafc7c",
        "indicator--4d568e3c-7368-44e0-9646-c788b906a8d8",
        "indicator--e3035322-2f18-47b7-ac53-4121b2c1b977",
        "indicator--3f106623-0656-4fb8-b28f-b792ce457f7b",
        "indicator--f137c435-0f3e-4837-ae60-0decd31c3a22",
        "indicator--64479603-0f6f-485e-96bc-269f6b84ee4a",
        "indicator--617adf06-934a-48b8-8514-625c20a3820b",
        "indicator--b0a4494d-312e-4938-bfe4-07f3fc0b33c5",
        "indicator--23706074-3d56-4d3b-81be-4f743ca72c78",
        "indicator--b613b15d-9d6a-4d29-8c31-cb71404e0202",
        "indicator--6cd046dc-bc0a-4d4e-82a2-33ca6861923b",
        "indicator--136457b1-50fc-4b77-880b-eaa0846ac949",
        "indicator--f3876572-096a-4484-aaec-dee063b72055",
        "indicator--f9bb3408-fbf6-4d79-a449-23f4ecd2679d",
        "indicator--fc599b0e-590c-4c24-8768-f0004215552e",
        "indicator--39b4cbf3-5191-4c6f-a7e1-3d783e053a6a",
        "indicator--85fb35ff-72de-4383-8e33-293215dcfdd9",
        "indicator--2f2e1374-18e0-4588-ae21-867ad4599642",
        "indicator--bbc157f7-2ac9-436d-bca1-2ed57fba273a",
        "indicator--8a17b14f-2994-418b-a7df-3559114085f8",
        "indicator--a2b1c40a-4676-4e32-8145-d459ae7f7eb4",
        "indicator--e264f860-3b53-4d98-bc2b-6f743d978f5d",
        "indicator--9bdf95a4-404e-4a43-af2c-8aaa6289ce33",
        "indicator--2fee66ce-1463-45b4-bb4c-bfc16de29746",
        "indicator--28a51ff9-e954-45ae-9938-6681a45259bd",
        "indicator--a6049f24-8650-4273-9511-0542ebef210c",
        "indicator--4164bcce-5381-43d5-b69f-d589d532dc0c",
        "indicator--61157442-eb1c-45b0-918d-fb6e27ae0fc1",
        "indicator--4495702b-9b27-40b7-a7ca-a17472bc1e7d",
        "indicator--855a83bc-3566-4ca3-994c-0f847ff25209",
        "indicator--374eb7e7-55fa-44fd-9fc9-542387b0e5b4",
        "indicator--1a799f61-9cf6-491a-b766-59682c4a1814",
        "indicator--a37b510b-57ed-41e1-99a7-32d34ac03483",
        "indicator--306287fb-6c84-430f-88fd-9ede282e9d26",
        "indicator--cb290b49-f3e9-4e99-84a4-83c9fb0630c1",
        "indicator--4ee00dee-5c0e-4552-9135-aa37a5ced0c4",
        "indicator--b39fd16a-4515-4c10-976c-a5c7104f5677",
        "indicator--a00fc43b-04c3-41dc-91e4-bc54f7da9398",
        "indicator--5420c685-1426-4ce0-a96a-a9d633addeda",
        "indicator--f5e18404-d533-4490-854c-9a3c24a3cccc",
        "indicator--67064104-ff20-40d6-b9da-86c890cd468f",
        "indicator--73bfb66e-9452-4f7b-b06e-41bf21fb5beb",
        "indicator--89442728-e116-49b6-8fe3-926549456edb",
        "indicator--ce060406-c0c5-4993-a8a0-ad09c1bd7c08",
        "indicator--428ea883-2490-4616-b125-2f3f2193da2e",
        "indicator--b92820d7-b397-4faa-bd0e-ab1443e7fbf8",
        "indicator--301bb4c1-1196-4040-a9ae-9886b2421296",
        "indicator--d3add855-2cb8-4269-854a-c53a2fe60c14",
        "indicator--07e5c54f-bd04-421f-9a5c-6192f6468c11",
        "indicator--e5175429-453e-4a18-b226-55e338ddcbc3",
        "indicator--bd0e7007-3663-4d6f-ac52-43503485df9f",
        "indicator--2a3582a7-8fb1-4ecd-8bfa-7b4a363c02f8",
        "indicator--92784b2d-5321-4179-a815-6dd0f16e5052",
        "indicator--58e8b0b8-1b81-4188-94f6-d6c0784590fd",
        "indicator--4a37b7e5-1aab-44d1-9f4f-ff6237c8e21e",
        "indicator--678dc12a-22ce-4f7d-bd97-17fe9997db8e",
        "indicator--8378a1c3-ac1e-4332-8a6b-d3609f44404b",
        "indicator--378310ac-cc42-4994-b75e-74557937c06e",
        "indicator--6ee27039-63d1-4fa9-af28-69a5419627e3",
        "indicator--6acafd50-51f4-414e-b1a4-f6c1a020f0ae",
        "indicator--048d1db3-e15b-4676-bb2b-af1626886e8d",
        "indicator--78d48ccf-3469-49ca-98d3-505b301374ef",
        "indicator--cd344406-80ae-495c-b1ac-088397ff3a91",
        "indicator--b60c4593-2b36-4fb5-bec0-99e21235d8a2",
        "indicator--e4822d4d-639a-4341-bfc6-d4f106e4b469",
        "indicator--ecd95a0f-7153-4b54-9ddd-4caf8613184f",
        "indicator--6e94842c-9408-4dfe-9ad4-5d977d74b58d",
        "indicator--6c32a000-467c-4a60-984f-61e5aa218d44",
        "indicator--0a9b0d7e-5b06-40c6-8202-039d3f25145d",
        "indicator--d9338a73-c514-4c69-bcde-98f629992c56",
        "indicator--1dfd02ec-4786-48df-a892-cb452b3d3a7c",
        "indicator--653a046c-050d-4855-b05c-5e7f8fdb5282",
        "indicator--cfe0fb65-1599-40b9-841d-ea08ce348667",
        "indicator--5e86bf0d-2422-4a44-bc7a-dbbcc57f7f37",
        "indicator--ce9ca5c4-f767-480b-be36-8906dde7cf17",
        "indicator--2beafb57-d228-4b76-9de3-43a2bb257206",
        "indicator--a8404862-26cf-44b5-9e40-3813c14b1cbc",
        "indicator--5e181fac-3d9e-4561-b56b-1ef240f74949",
        "indicator--2b71caa2-046b-4818-b7d2-875947da1b5f",
        "indicator--49c4953e-b0e9-4f87-9671-3a78177ce59d",
        "indicator--510d13ce-f45c-46ac-90c7-f47368e759e7",
        "indicator--734b011f-75c5-49b1-bfa6-8f8051d752cf",
        "indicator--7ee49255-dd72-4d64-9ca0-81b255a99fe9",
        "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
        "indicator--7ba0f6a1-5fe1-479b-adc0-342138601235",
        "indicator--23e88d5d-b7c7-4702-b188-487badaeb9b8",
        "indicator--3b5efd30-e6b7-4f7b-8120-d95cab574cf7",
        "indicator--31b9caa8-8410-4eb7-afb2-29bcc64d79f8",
        "indicator--e423ddee-1a00-4100-b04d-38cdbc30189c",
        "indicator--252d284e-65c6-4306-8637-95a54a76c5d4",
        "indicator--b9815a5d-0c7a-4854-a7ae-069269cac28a",
        "indicator--c3140961-9191-4059-9455-baffc0d30f8a",
        "indicator--c6fbd370-fcac-4eff-b97a-bf965897fcde",
        "indicator--eee7b9cd-9775-4a7f-b38e-a252add2c1a1",
        "indicator--4ff70dcd-5e2a-4e74-a971-5ad51fea380c",
        "indicator--439c502f-126d-4d81-b4a8-d32225c25e4b",
        "indicator--c01af967-beea-4bd6-97af-0a888cc29f68",
        "indicator--8e740351-7e85-465a-85e3-348f8f20fee6",
        "indicator--99954f96-e84b-4d60-aa76-bd34d8389206",
        "indicator--e030fe62-d618-4920-8f30-38fdfb3989c2",
        "indicator--21d17b11-47b7-4647-b031-41b95b0efab9",
        "indicator--bbade563-2dc8-438d-8a4f-c545f721d69f",
        "indicator--2947b3c9-f6ad-4c55-9676-26c0ddc7ec45",
        "indicator--47abb98b-3e30-468e-b0b9-82f8e18e1def",
        "indicator--a8951c50-8414-4e6e-a7ed-8754d96195d1",
        "indicator--72bf963f-58f6-4651-a928-d87ca9791623",
        "indicator--d657d789-80c3-41b1-bf11-365d9fe962ac",
        "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
        "indicator--a3c84a51-df14-4953-b935-150fb4b3b180",
        "indicator--7be03097-2cec-403f-abb5-617330e1ae50",
        "indicator--ae3fe226-9e25-4f11-9f36-a69292b25aee",
        "indicator--10961372-a463-4deb-a6be-68057033713a",
        "indicator--f0748849-658e-4bf7-bc48-408dc19ab6da",
        "indicator--1b7264d9-bc20-4d9b-bc52-19cc4b656da4",
        "indicator--2236e247-6347-4f90-9760-68c9868a777c",
        "indicator--cdc03754-4d3b-4a85-b974-8d094a7adf0b",
        "indicator--4a4ffe4d-9613-4bf6-940f-83539c5c1dbb",
        "indicator--75f66ae2-0f2c-46d7-997d-2f19298d09ba",
        "indicator--71d13357-f7e0-45d1-b0b5-24a3701afe14",
        "indicator--34448fd2-97db-4dc8-93d2-8ca5b84fbe63",
        "indicator--02b561bd-cd8c-4ed5-aa51-16adbd93f4fa",
        "indicator--61abe61c-d7c8-4c24-b061-fe6897f8a110",
        "indicator--3b1f1acb-9a86-4538-aef6-e5653c715f41",
        "indicator--ecb68190-210a-4170-a432-72106eda54eb",
        "indicator--2ce6f439-b59e-4578-b12c-62c8bc9ba473",
        "indicator--3f780a4f-bb95-4143-ae99-c546c9dee662",
        "indicator--8d3f3b83-70b3-44bb-bf22-f08a009d0ed5",
        "indicator--9f710bbf-1b98-43d3-a83d-751aa1966496",
        "indicator--76d16c67-87d9-4520-8041-4680150cf303",
        "indicator--68b55e35-03e4-4549-82bb-163b2b251319",
        "indicator--b26951bf-f97f-48fa-bd38-0b1b51d54686",
        "indicator--ba79c6bc-c539-4fc2-be5b-c2b52d2c8281",
        "indicator--b8cf2cd4-940b-469e-8544-7b1db4bb9d43",
        "indicator--e7ff4d17-da19-4232-9e29-e5d0d4248148",
        "indicator--54e8ace5-66f1-413e-807b-8164bd5971f3",
        "indicator--75ba27ff-d0db-448f-bcde-2ee004817cdb",
        "indicator--73618724-b303-4dc7-a7cd-8cb3aeedcd17",
        "indicator--5284e861-ae70-49ff-b828-3687e08385e9",
        "indicator--e0cb8a6b-c1c2-468e-89d0-1adc44d2b610",
        "indicator--2414dd7e-ff90-4d7c-b699-0f14db5af2b8",
        "indicator--c046778d-3313-4599-bd8c-a7665eca08e4",
        "indicator--e0376fa5-6a8a-4aad-a8a6-ee02e78abad6",
        "indicator--cd8cdb13-f822-481d-a672-6e77fe22a1eb",
        "indicator--175a7ac2-7d2b-4166-92de-2166f9995fd4",
        "indicator--3edb8c59-23fe-4366-8639-40173e30cc23",
        "indicator--d4d2d010-d546-4266-9634-71c46fecd6c8",
        "indicator--f949b02a-8da3-409f-85a2-28ac47138245",
        "indicator--258b4091-8c64-4cb6-9634-395f508293b9",
        "indicator--1c5f3e8f-92dd-4d94-a03e-9c515f511092",
        "indicator--cf0bc264-fc37-4ff7-9434-bcc4334baab8",
        "indicator--000e7147-b14d-46bc-b6c4-dc91a4511b64",
        "indicator--3e0129f8-5efa-4de1-9aec-04f56c1f36ba",
        "indicator--cdeb1449-bd38-479f-b813-bf264641be84",
        "indicator--1ec6b7d2-2287-4f2e-9166-a8e2505353b4",
        "indicator--1aabc80e-0d81-404f-8791-0241c6be49d7",
        "indicator--0e3a72f9-4251-480e-8c04-9011921e2c06",
        "indicator--1ebb64e2-8bf5-4838-93c3-ba652ec1cdbf",
        "indicator--2f5937b2-b984-4c17-a562-0a7388fc1f80",
        "indicator--0b2ec72e-b29d-4e79-adfb-368dad3585ff",
        "indicator--2dc950cc-2456-4638-94c8-2d349f7bc1b0",
        "indicator--5f8710b4-d55d-4db1-83ae-653144b8c8cd",
        "indicator--73f0407e-9189-4fe7-b485-a3bcbf8999bd",
        "indicator--d5bce797-55a8-4964-81c5-a87616743e02",
        "indicator--ab8cc3c2-f709-4eb1-a925-6975597da342",
        "indicator--38185fa0-626a-49e0-85c0-5f9f2fcf1abc",
        "indicator--c4143c81-ca52-4a5e-b429-ebc75490dbe6",
        "indicator--32cc76ad-90fd-4039-b719-0dd7f0573996",
        "indicator--515bd823-4a4f-4fa7-9f75-522433cccf85",
        "indicator--5203c22e-a03f-41b7-b7d9-07ff6b7cfa1a",
        "indicator--a8e34f7f-cc92-4175-be97-598ad0dbbb3d",
        "indicator--54997895-a903-4e1d-a3fa-4d770f6fde15",
        "indicator--94ce3fdc-03ba-4fb3-86f5-9e575211baf0",
        "indicator--d2880846-a4a1-411a-8adf-3c1d2394f426",
        "indicator--6db4cfac-25af-438b-9b25-6db787122fca",
        "indicator--69a4e2e8-e081-448d-b867-ef148fcbbe91",
        "indicator--946057fd-49f3-4d44-b69a-fc0aaa252b90",
        "indicator--c187ebe0-ed98-466f-ab6f-ed3abdd47f08",
        "indicator--21e6f3cd-84af-4861-be6b-e490bd51ae2f",
        "indicator--3526a36d-fc6a-456e-9a33-e90118034c06",
        "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
        "indicator--f87cbb16-908d-470e-ab38-6e54f9b68dde",
        "indicator--fee3b844-e0ff-4f00-a50a-de39a83ca50b",
        "indicator--050a5304-0715-4091-9e48-b6d2b33abcaf",
        "indicator--e7b60f2f-e5d1-4d87-96d8-0a4957937ce2",
        "indicator--46ecefa5-ea10-48b5-b73d-59d94c9205a4",
        "indicator--42c7b512-c14f-49e1-a66f-47427f965acf",
        "indicator--88c5c34f-570d-447c-9f62-978a795349c7",
        "indicator--95053c99-e110-45f9-b28f-95102538951d",
        "indicator--b90218c3-2c29-4db2-bcfb-87f11ce5f824",
        "indicator--97c841d5-9a19-424f-926f-7fca01106312",
        "indicator--9133bb7a-3fdc-4fd0-be55-d5f9ef46471b",
        "indicator--c0bdf5da-4a08-430e-bcf2-cfb34950e254",
        "indicator--c56dbf3b-46b6-4fa6-bbd5-66483ac3633a",
        "indicator--f926ee41-9643-424b-b253-4cdf7ebba7a0",
        "indicator--a5d16a08-5c0f-429c-9d46-b3948f11b275",
        "indicator--2c536675-133d-4c66-a940-cd5cb1ec00ba",
        "indicator--535e7574-02a6-471c-ac07-f140d84fb061",
        "indicator--c30edf42-d9b2-459e-9ccb-953fc68570a9",
        "indicator--f8a3d1bf-aeea-44f7-aaa7-6ad34a4c213d",
        "indicator--62e3c9d0-e6b6-4ff8-8347-2824d01ddb7c",
        "indicator--8a4edbf8-2b33-4d16-834e-41cc5349788f",
        "indicator--7b8d96c0-2dd2-4ab3-9edf-98be1e44dcbd",
        "indicator--f4d89026-7423-426d-993a-04736a6aeeac",
        "indicator--bee55ddc-e79a-41e6-a2f1-6b1f28de4176",
        "indicator--da9e30b3-f140-4e59-8f34-31f785e60fcc",
        "indicator--0c474e9c-adca-4422-aeda-0ce4b404f9f2",
        "indicator--80a81e52-7c3d-4d97-ac2c-0fec7cf52961",
        "indicator--6df485d9-c5a1-4a6d-ac49-93c2b1dcd892",
        "indicator--f06f068c-aa66-465c-b1d5-98251e0cc42b",
        "indicator--0d716378-bd35-4af0-bb53-8c16cd96b7e4",
        "indicator--337003d6-58fe-4dd7-9979-7bcae10ef315",
        "indicator--0eca8bac-067d-4365-88ca-d22fd41b64f0",
        "indicator--da042559-9f1b-46f9-b704-bd5ee5d18c1f",
        "indicator--d6e414cf-9fd6-474e-99b2-2dc5809c91ec",
        "indicator--9af29618-46f6-4364-8fa4-0c542724fd7f",
        "indicator--2557b3f1-5eef-407e-8df2-d3aa44ef980b",
        "indicator--d4225d28-8876-461a-88dd-495a045f11ef",
        "indicator--e09fa7cf-c404-4c30-84c3-0bb61e7aef37",
        "indicator--addf46aa-10e4-4dd1-9098-427afdb9b722",
        "indicator--b5b40168-9f56-4c5a-bcfe-09ed319d0234",
        "indicator--704a5706-f717-4dc1-b6d5-c4fd9c7ee53a",
        "indicator--ddabe150-d5ef-4d64-8046-8804ab9a46f2",
        "indicator--bb051d08-854d-4939-a022-ac4a1b5f9dee",
        "indicator--16823d29-3a0c-49b6-ad85-a0eca21976bc",
        "indicator--31749a30-ec0b-4f7d-adf1-c39f64eac6ae",
        "indicator--904ff349-5cb8-4e26-a7a8-d339bef9bd15",
        "indicator--13e6a3a9-c439-478d-89aa-82878a59f709",
        "indicator--bc22c27a-db6c-4400-8f95-486111e58a9a",
        "indicator--63aa6367-bb2c-4c4f-9bf0-cf15ba0fcf2e",
        "indicator--28505e21-022e-43f0-8b55-6b886ae2ced0",
        "indicator--0ddac989-6d0b-46f6-92b8-0bad5df2d96e",
        "indicator--23b7ace1-b291-424e-aefc-399da70bcfb2",
        "indicator--3eb925bb-85cc-47f1-804f-1207e98bc219",
        "indicator--e48dfab6-b6ef-449a-b00c-bb44bfe86533",
        "indicator--98545668-c8dd-4373-bbb6-8cc58c55190f",
        "indicator--313935ac-f98f-46a9-ac63-2f19fd9394a5",
        "indicator--f9c4c21e-2b2b-4f21-aa85-e734a1c82232",
        "indicator--1aa812d8-e164-42b7-8a0c-7852f468f9d9",
        "indicator--b14d71db-65fc-4a86-a62e-469c0f1f367e",
        "indicator--3d9735df-879b-4019-a3fb-d2c966e4099e",
        "indicator--ef130b56-9060-487c-b4dc-4a7a6bd6e568",
        "indicator--390bcfd4-01ce-4c36-9645-210285ea704b",
        "indicator--a9a6b920-36c9-4f66-8990-8c3bb10c9269",
        "indicator--8ae986bb-bcf0-4a2f-bf53-edf47951fffd",
        "indicator--0fa2c768-e83d-4109-929a-c34f226230cf",
        "indicator--64f1ba26-6cca-46c8-82b6-63a3fae9d5a7",
        "indicator--305bf0b6-974a-414e-a967-57b61403f65d",
        "indicator--d1d0d699-e6cf-4155-9f60-fec036734202",
        "indicator--004562f3-3435-4d02-9220-c40e55934492",
        "indicator--52ab71c7-7685-4b56-92db-506419c2bf48",
        "indicator--4d13c442-990d-4be8-b657-b2a9d26f312e",
        "indicator--8d2a103c-5682-4d3e-837f-d82afaa82669",
        "indicator--17b1ab4c-6c96-4b12-8f27-b4104f2dc17e",
        "indicator--d67a795f-8060-4cd1-a86b-9543d29b287d",
        "indicator--6dde5d5a-b490-4e3b-91a6-78c8c7cd309b",
        "indicator--0f2fadc4-7b39-4db4-b42c-1b49830b43de",
        "indicator--7c8550e4-1c8a-4d87-9779-5d245e2e7fe3",
        "indicator--2373e69d-4f11-4936-8b4a-c952a2eadbf3",
        "indicator--5cf49f30-b480-4e30-ad7c-e3df116c9c65",
        "indicator--46dd60ae-a47f-4156-99d0-2d82bcbc7ffd",
        "indicator--5195ed3a-cff6-450b-92f0-2bd3d183ebb4",
        "indicator--4edd22f2-8006-4f3f-8327-1b93a0217c39",
        "indicator--1e0f5250-f41d-4d03-a948-5a86869e63f6",
        "indicator--118cd920-24be-41a7-883f-522bfdb9a379",
        "indicator--c416fef7-aedd-45a2-b3d0-a6b308e9d54b",
        "indicator--3b1e46d9-c0dc-43a7-a2b4-90d30354de4c",
        "indicator--374e45b0-11b0-4e40-8691-80a67a7be5f6",
        "indicator--6959e400-0705-444d-ad11-ec3a3c6d00ef",
        "indicator--590b73b4-dd15-4a87-9406-641706d3f8c0",
        "indicator--12bd98b8-cd71-4816-958d-cd3269eac782",
        "indicator--00e0796b-2a6c-4225-9c31-efc3d90634cf",
        "indicator--3fb40a97-9a2c-447f-953a-5d1ac7f1c146",
        "indicator--11f9966d-0067-4c9a-98a0-9043e024b578",
        "indicator--a60879b8-e50c-415e-a618-7293a59e5851",
        "indicator--16094e33-2657-4334-9039-03ee4f15fabf",
        "indicator--e9c4e704-f86e-4305-aaff-aa6d9d1f022e",
        "indicator--61c93b75-50e2-4fdf-9a93-f10b6adee763",
        "indicator--4fdfae32-d0d0-44d6-89f5-2d84da730ff3",
        "indicator--56634424-cd22-4931-821e-da0de5f0db65",
        "indicator--cc6491d8-0559-4dff-a957-e3c4bb669919",
        "indicator--f068493d-a98d-4322-9b87-191fbf433eb6",
        "indicator--5e57d16e-4452-4173-82fc-7c9ae870f37b",
        "indicator--eb22821b-3c61-4380-ac88-60144b32fed6",
        "indicator--b4557a04-1d90-4372-aca2-f1a7c56de17c",
        "indicator--22ad65b4-2c52-43c5-8ba5-ddd798d7b34f",
        "indicator--5f5dbcf9-8b0b-4e5e-9c5d-0d9337a4091a",
        "indicator--b20958e2-4027-4d27-8fb0-82c6b564c2c6",
        "indicator--a8c9321f-7eac-4fb8-9f97-fe3d52d04f6a",
        "indicator--16abc16c-f0b5-4704-920a-9a2c134f6f9f",
        "indicator--23ab66a7-03c0-4814-96b3-bf950f70441b",
        "indicator--a20382b2-3f70-4073-9735-a6e3e1690f3b",
        "indicator--27d141f5-f73e-4495-b48a-dc7874ef529d",
        "indicator--30495c3a-2adb-4faf-9a6e-9bc24570cb7d",
        "indicator--ea02492e-c870-47e4-8e89-17c350503060",
        "indicator--36e19497-dce2-44be-b352-95a1a977d843",
        "indicator--0b9771f5-71e5-4bee-96b5-8351bca4d662",
        "indicator--f2737a3f-0b49-4028-b557-b1aae9d5519d",
        "indicator--3b00b6e2-0e43-4150-b667-0d4a2ddf8da8",
        "indicator--f601b9b4-54a4-4c7b-aaae-567ff011efd0",
        "indicator--037a4e7d-a916-42b0-9612-c9afa6b990a8",
        "indicator--ba1b5491-87c4-4750-bac4-c7e775e3dd0d",
        "indicator--e7242b5a-f37e-4bb4-984c-8136717cfffc",
        "indicator--02f6bcbf-349f-4417-9f44-555fc7ed6bbd",
        "indicator--b7a0ee0d-85f4-492f-87b9-2922dcf053b0",
        "indicator--3406db07-3d24-4ad5-9b8a-04e6fc81769f",
        "indicator--5e984d25-6348-4910-808a-cca6609e518b",
        "indicator--379ec286-cdd8-4064-9779-e6b64e30a848",
        "indicator--b41e2446-83bf-444a-98b2-ae52fd64bdca",
        "indicator--1951893d-25d6-4ebb-89af-637c4781093d",
        "indicator--6ed26003-7b29-45b0-bd11-9c3ae28cc49a",
        "indicator--f2d6a06f-9bc4-4bbd-b06a-83e6e42a4c7e",
        "indicator--2285828e-4193-4039-878e-7d699650fc3b",
        "indicator--080f21df-63b4-4882-aa0e-ceea87060111",
        "indicator--9e1fef11-dd1f-41d1-8c11-eae1813c555d",
        "indicator--362d3eab-27f8-4e56-9e90-58a91da54f08",
        "indicator--dadcb280-1753-4a2f-8851-d9a69be9214e",
        "indicator--b0634c89-15fc-4acd-9063-c6e957c589aa",
        "indicator--88e35513-2d9c-442c-93a1-46388196abc4",
        "indicator--992badb4-63b6-4474-a7ee-fac95ca5f33d",
        "indicator--6acc7cb9-1fad-42c3-b853-a95e591e4e55",
        "indicator--79d7ef26-7e9e-4895-8f8e-3ee35cd32adb",
        "indicator--421347ab-464a-4066-af9a-9175c58032ad",
        "indicator--7841b8ed-f6cd-49bb-919a-360c2d2d2182",
        "indicator--6b1ae9cd-a71a-42d8-8320-7d130e0ad585",
        "indicator--e3eac159-e134-4d73-87ac-5de1cd1421e2",
        "indicator--c3f121be-a9de-4b53-a70b-146cba2e270b",
        "indicator--34364df4-4f7f-4cdf-9dc3-71931343f705",
        "indicator--38aa17bd-8421-4852-9ff1-d9deb69f27d5",
        "indicator--a1da0dfc-40bf-45af-b6e5-4972a0cd1d2d",
        "indicator--4ef03f7f-702e-4e96-83b4-f56ecd153b8e",
        "indicator--c1692b65-bf34-44d4-93b5-430fc9d1ac3c",
        "indicator--20febe91-7a46-452c-b4a2-06275097b146",
        "indicator--a7ac40bc-3bee-44e2-a006-e68884418e21",
        "indicator--608aa186-fa1c-4238-a7dd-48f5742f5268",
        "indicator--cd7d4bcb-b7c7-450d-ba2f-a362f233186e",
        "indicator--eb2a90a2-7117-4543-985b-5d8c6fcd0a32",
        "indicator--8129fd44-1a43-4cb6-97c7-ea070cb10d98",
        "indicator--7fba62ec-2391-4521-a935-2e38c2c9e87d",
        "indicator--f45fb02a-913e-4578-9591-e9c819228dde",
        "indicator--ceb654d2-c613-4bde-9889-32b51993d9e4",
        "indicator--24040bc9-bef3-433f-ae10-664dc14bf7dd",
        "indicator--a4e9b574-4116-4f92-8132-42dfabbbcc03",
        "indicator--52853ab5-d030-45f0-90c6-d421e8d15812",
        "indicator--0a246e32-97f1-44d4-91ed-6782e97e8e57",
        "indicator--d361d59f-97c3-43fc-af84-ac116505bebf",
        "indicator--61c2212f-108f-4a6e-b8ba-9092470f5423",
        "indicator--81bdba31-0b41-4a5b-9c0b-02c150d2ad36",
        "indicator--dd1ce91b-6ac5-4ecb-80b2-35dcf87857f6",
        "indicator--73729bec-1df6-46c5-aa3a-5f2e526b1da9",
        "indicator--f8e50c96-2a9d-480e-aed0-99cbc70a11a3",
        "indicator--59d0c0e8-beeb-4a1c-97c3-0825593b66fd",
        "indicator--27eeb943-8c95-497e-9235-50a3bd3c042d",
        "indicator--8fd21909-c647-42a0-a462-90492e5b6720",
        "indicator--38794f59-cb2d-4ce9-9754-b99f9afbba78",
        "indicator--a8167127-6968-4b59-ad74-08cbc1b95f8e",
        "indicator--56c03186-8669-4d4f-9209-1998613e2a30",
        "indicator--63cd76c3-211f-4eae-ac7b-9f5dd025105f",
        "indicator--881c6b24-0b62-4c5c-98e7-15e340db8b4c",
        "indicator--c76d1003-a410-4cdf-986e-a1047f8adf2d",
        "indicator--d0ea144a-e6b1-40b4-a591-1aca6384e1b7",
        "indicator--c891b496-4be8-4fed-9752-f1126aa40966",
        "indicator--f264d500-ebb1-4d9b-a4f4-4d2c7862c86a",
        "indicator--ee777362-bd00-43e3-ac34-a16c28b079c5",
        "indicator--8d7f7203-ab2e-4612-9154-650365a5cb74",
        "indicator--3f140f19-559a-4c05-83f3-c3da953835f3",
        "indicator--77d4c99b-71cf-41e8-b80e-d044be8632bb",
        "indicator--a08a34de-f116-47e9-9d9f-1e20ef5e8661",
        "indicator--2e64d3f9-52d9-43f9-817b-76f6e783b9e6",
        "indicator--28ab6522-cdcc-42f8-b75a-c7d3109c444a",
        "indicator--ddd7899a-9225-421a-a69c-1b53bcd96955",
        "indicator--6f5cb645-96c8-41a3-86b9-6da24a526628",
        "indicator--cc3f1449-6f86-4262-89f9-ab018fc35b0a",
        "indicator--386cf182-2efb-42c2-8ce7-6ba1d4666901",
        "indicator--84673100-fe63-4f33-90f5-d8fc49e6e87c",
        "indicator--3c21a198-3c92-4bb8-98c8-c947fbffd2ff",
        "indicator--ede496af-59dd-4f20-9331-55355ff36af5",
        "indicator--eef77270-587f-479f-9491-eeecd5173dbe",
        "indicator--15082ad7-7bf4-4fcd-b9c8-4cfe0c06ea4b",
        "indicator--2ad58026-4ca2-4923-8036-693595f138a7",
        "indicator--58493d6e-2892-4915-adc5-4fc05f1590ec",
        "indicator--935c3150-38c5-4aca-a775-e1934018100a",
        "indicator--92278272-050f-4d41-865f-8fdedf17024e",
        "indicator--d577b099-401b-440f-bbc8-cdc3ce426d2f",
        "indicator--73ea3dfa-d6b0-492a-bc15-b6d17975f1b0",
        "indicator--8a6f50e3-6997-44f3-aca3-b462d09823df",
        "indicator--a7d6f833-8280-4315-bde4-4b2d42a047c0",
        "indicator--5c77bcf6-73b0-4c14-aeb7-5aa9e816486d",
        "indicator--c8c53bcd-e40e-4272-ba00-35f53e3956f3",
        "indicator--f3708dc9-2302-4578-a293-17022aac772f",
        "indicator--b6a1419b-2902-4dc2-88c2-53dac36502e5",
        "indicator--6f3c4981-ae5b-40bc-8492-747f7176c3ef",
        "indicator--d353fe94-a4bc-46e9-8384-30ca34c9685c",
        "indicator--fd64300d-8c7f-4014-b084-27140dec0255",
        "indicator--12002d78-5c2b-4757-9277-cef4b16fdcc5",
        "indicator--60f18ea4-21bc-48f2-97d3-0fbf52eae044",
        "indicator--2dec6829-c6c3-4147-8ed6-d99d28dea3d9",
        "indicator--6f429b06-49d6-428b-b954-9998e48b9068",
        "indicator--cccbcd53-3e90-41c5-9523-0225d6dfbc3d",
        "indicator--472d226d-6fe3-4b32-ab45-09a57940b599",
        "indicator--3c6050f1-6d32-42cf-b4d8-6c5db49f8583",
        "indicator--38d0c43a-c431-4722-a354-a0602351dbee",
        "indicator--93335f29-35c5-47d4-a5bd-26457c2dfea8",
        "indicator--2897a318-904e-47e0-a984-402f673db94f",
        "indicator--4fef8ad8-7a42-427d-8229-29ea8a44d45b",
        "indicator--859fd1ce-487a-4c5d-9329-b22cd0f47e43",
        "indicator--cf760727-b4ce-4b3b-8386-19fcc468ad8a",
        "indicator--ede10cf7-1a72-4f5e-bf63-fefd21c9c21d",
        "indicator--4b470ff6-5a84-40cb-927e-77b150bd1b70",
        "indicator--952cf9c5-b789-4379-953a-5811333ad34b",
        "indicator--5cc1278c-7066-4df3-80c6-74244f649152",
        "indicator--8af1def3-9811-4242-8a9f-9112c7e43593",
        "indicator--b94fa017-1310-4bfd-af46-b118a85163f2",
        "indicator--3d7a849e-033e-43e9-a34b-49dcd26c69ee",
        "indicator--cc2e04e8-5c89-4a15-b3aa-1b94ad7fc52d",
        "indicator--af7e1982-56cf-4a72-9976-0244bc0f0ef6",
        "indicator--26fc687d-6a09-4e01-a57f-ac147059322c",
        "indicator--c1bfa54a-d1e4-4195-881a-3c025ad29b30",
        "indicator--52c6f886-76ad-4163-b08e-0af4cf6ad2ec",
        "indicator--dd2e9b5f-d944-422e-bb79-6b94ce459a64",
        "indicator--521a3dfc-5644-4e4e-93af-6ff0bbe5d1fe",
        "indicator--ab0a2458-7b56-476e-8a7b-9b0d9bc41d82",
        "indicator--c3a88bcc-6e74-4da2-9d0e-cdd6e15367fc",
        "indicator--b0525028-ca2c-42bc-bfda-ed5d554d9ec9",
        "indicator--39278a53-a6c6-4eaa-8ab1-8016e4513bad",
        "indicator--e1311563-edb9-4519-bd36-16daa4824cab",
        "indicator--8751e5b4-0265-41ee-bd2a-5a0500235ce2",
        "indicator--bfd5923b-deca-4065-ad3e-5ef510c5b16f",
        "indicator--01963713-dcdc-44e6-b3ce-18722a038cae",
        "indicator--69a73c4b-4549-497e-9d9a-8ddebcb237b9",
        "indicator--ebc52efb-6d38-42c9-93d9-5149bc10c37b",
        "indicator--6ba70776-03b0-42f0-b5c6-ceb76a96d698",
        "indicator--dc76aed1-03ee-4785-9924-94bf0efd003f",
        "indicator--645c4c73-b529-428b-8cc6-f85ae705b280",
        "indicator--1aa1874f-7bb8-4af5-a4aa-9c9b70964bd8",
        "indicator--315833d5-a406-42af-8658-37a838c393b9",
        "indicator--c567e8f9-4c05-40d2-a42b-b0128cc5be5f",
        "indicator--c5b15c82-1448-4c1a-a74c-483e45a50bdd",
        "indicator--3a40e319-d787-4696-920b-101e41ed2cb7",
        "indicator--041d756c-b7d4-4998-abe4-7a475699ee3d",
        "indicator--4519b041-a404-4c40-8adc-5fcbc3173540",
        "indicator--7a74cc2b-4584-45a2-8f05-6f422a90525b",
        "indicator--ed6b80c8-3d13-48ef-a445-b93137e7094f",
        "indicator--55247113-2db0-4fbe-a0ce-fe12fca9ac6b",
        "indicator--d1e11f36-aee6-4792-be3a-3a6565e40801",
        "indicator--278d8cca-c6c4-4771-ac8e-ee050e618953",
        "indicator--1de6f33f-12fd-4fab-aef0-027ce7b4560d",
        "indicator--560c5f8a-49b7-43c0-b405-ac06ab4ddb41",
        "indicator--19205eb5-efb0-4c3c-a2fc-e2deb6d171ea",
        "indicator--be03f6d9-2b6b-4ccf-a170-c64ae267536f",
        "indicator--d71609d7-f3eb-4667-9d54-4aa5787ae17b",
        "indicator--c79c2f54-bd7a-4554-93e2-376f800ac00d",
        "indicator--65b3e847-71c6-434b-b34f-5868bba83447",
        "indicator--e754f851-6e1e-4c5c-b4bf-ec3e5071baa0",
        "indicator--cbb446fc-1cec-4804-a33f-c433459f8369",
        "indicator--c365669b-847e-4443-a5f5-7bdf84348084",
        "indicator--3e449657-f615-4042-b4a2-ce840092a748",
        "indicator--fd72bdaa-f2f0-4f78-8981-62762a7eda76",
        "indicator--bb6ab765-c241-43da-a27d-c26a40958c64",
        "indicator--a3f6cd8d-1163-4b8e-8c88-1130252612f9",
        "indicator--0a1e389a-28b1-462e-8e6e-1e11d692b361",
        "indicator--56932fab-13e2-4b6f-ae9e-35dbff8542a2",
        "indicator--6c25824e-3516-4248-838e-d3274433dac2",
        "indicator--c6107b64-91c9-4830-a0f4-40a07202f2ba",
        "indicator--eac84cb7-3712-4468-9d75-fa152d7069c2",
        "indicator--0e40264e-a4e2-4e74-8781-902a2ee8f52e",
        "indicator--51a3a0ee-3538-47e8-a9a7-4ea747a781e8",
        "indicator--7a990a90-5c65-4a83-97be-8f59206478c2",
        "indicator--79c43c0e-9ddc-46de-b39d-947fa573451e",
        "indicator--8dabf845-53f3-46d5-919f-ede9202c8113",
        "indicator--3f18d720-6cd9-4fa2-971a-c63a31c797f9",
        "indicator--9b22ac02-f537-47f9-9010-b359e367a50e",
        "indicator--d9e29ad3-f735-42a3-8e80-cd8b23d35a9e",
        "indicator--baf4989b-1487-4b02-94ae-82be01128105",
        "indicator--dcfe6656-768d-4c56-9e12-d96eea2148d5",
        "indicator--8b91aaa6-35ff-4658-ac01-61cd23d6bd5f",
        "indicator--59686c98-85fc-443e-90b0-170afb311323",
        "indicator--35fec062-9956-4b7e-956b-dc267f94c481",
        "indicator--c86ee2f4-5b3d-49a5-b4eb-8c848f25425b",
        "indicator--c2742e6d-90cc-4f12-a356-6d84e13a97fe",
        "indicator--e31c1121-1cc6-4ed1-9054-f162c1e29cd6",
        "indicator--450703d3-974a-4790-bdd6-c455f68bc5c8",
        "indicator--a73a6e5a-fa71-4cbf-b9fb-f1f3655f85ca",
        "indicator--9b6a37c7-af7e-475f-9dca-9818144d6be5",
        "indicator--8b26d3ab-bea6-4346-ba6c-887889b7ebd9",
        "indicator--8dad4109-4a58-4fd8-b61c-b863b34d0373",
        "indicator--bfcab118-2576-4fa4-9b4a-650e84e9f910",
        "indicator--f3937848-59e4-44a9-b026-05e0f3264bdb",
        "indicator--7be4aff1-a313-4d25-8a1e-17864131e173",
        "indicator--0270d6f8-48ab-4309-bb4c-b61d4cff34f1",
        "indicator--bf0c4cd7-af15-4b13-b3ca-58a9c2ca178a",
        "indicator--af4f2696-1a16-4b6e-b6c1-c553a585e1af",
        "indicator--2e56e713-808e-4145-b06e-502c6bd8d5c2",
        "indicator--009b15a3-f8f8-44e0-903a-aae71f239220",
        "indicator--8610047e-fb6d-4b81-9a69-c000ad285f1c",
        "indicator--23b46439-abae-4263-8949-0fa4e9c38b96",
        "indicator--36ac13db-e398-4b8e-bacc-128de61d3aa9",
        "indicator--a424d316-6a1e-4a19-a1c8-eaa200b08ab1",
        "indicator--bf7f2092-b360-4dee-8567-a96c01fbcf1a",
        "indicator--229cdc07-2f5d-44c3-861f-53cb4c55caf8",
        "indicator--f282d46b-622e-4cef-a06e-799383c31e12",
        "indicator--cea0b897-cf35-4972-9962-cb4d798b3a0b",
        "indicator--f4e1e380-a605-4743-bf4b-4d833a460ea5",
        "indicator--607ab60d-17e9-43f3-a319-386b18f60357",
        "indicator--fd6d040c-5687-4315-a660-4514deeca53e",
        "indicator--d4b09e04-caf7-480e-a8f9-49abdb8a4691",
        "indicator--cc7d0f4b-8119-4cff-b155-e178271f306a",
        "indicator--e6881181-1188-43b1-b558-5bb3a6023906",
        "indicator--52c37982-8a44-4444-80d7-cd6d737fd7c0",
        "indicator--bdf7395e-1f6e-4079-b840-018d9cd938c5",
        "indicator--8435a3ee-1f29-43fa-9c94-33373083a1dc",
        "indicator--7697e62e-a969-4209-8c8b-330ece866aaf",
        "indicator--a065ef79-cee4-465c-a186-ea8e64e8178c",
        "indicator--57b3ab54-d736-4011-92a4-472e61dd752e",
        "indicator--d5e8562d-0380-4f21-afe0-9f8d56433f0d",
        "indicator--ca5edfc5-af82-4119-b433-55c45af1807a",
        "indicator--270c40cc-f5ac-4750-9f66-820206e498f9",
        "indicator--d5c2182b-ac91-46bd-8590-6b06caa10bc9",
        "indicator--8e41d9b2-93d9-4577-8993-a51158e8a5a7",
        "indicator--c9e0c578-d6fd-4320-ab9a-61e92227eabf",
        "indicator--63ba1563-0192-4ad2-bf58-775e51faaed6",
        "indicator--dec30938-e6b8-4b91-9ca0-a4feb7194710",
        "indicator--ae768871-1162-41cb-8b53-014c3caefe01",
        "indicator--ed4f0900-0600-45dd-83ee-8853ddf7524c",
        "indicator--02d9c94e-04db-4a7d-b287-8178791749dd",
        "indicator--e0d616bb-fd10-4a69-ad2a-0dbda0149f5e",
        "indicator--78ba5d81-a8fa-4dc0-ab2c-0f8309fe0029",
        "indicator--6678ee79-6a8c-4669-9096-83a1ab858198",
        "indicator--1be61a35-b056-4a27-b355-fa7ab9db7b80",
        "indicator--2beee95e-816c-4e65-b57e-70bf7bad908b",
        "indicator--4b0f2092-8f41-4af5-8320-e8ff0cdfb99c",
        "indicator--961607b1-4073-48e8-bf6a-c2092811b0a4",
        "indicator--21bb8cf8-d10a-4fac-82a1-0af617830393",
        "indicator--4debd4c0-8377-44d7-8cae-979157a915a6",
        "indicator--46cabebc-91d0-4144-8f34-f429f119499b",
        "indicator--0f7ba2b2-e6e0-4985-b360-02a71d31b9f1",
        "indicator--c7b2ee07-cbfd-4831-9683-3fc72c2a874f",
        "indicator--106bcdb7-5795-48a6-a7dd-57db3edc65be",
        "indicator--2b0650eb-2606-4157-8118-5676e989b32f",
        "indicator--77bfc5de-12b4-466b-a425-ab701a63b2e9",
        "indicator--3ac9a8bd-fa11-4425-ad5c-96fc6c31f986",
        "indicator--7e4ea8a0-f535-44cd-8ef3-f4e4e3126f25",
        "indicator--2072499a-0f1b-4c9f-b702-1e5451be53dd",
        "indicator--5ab202cc-13cf-486f-afab-5b20c8390854",
        "indicator--ff037d07-844b-47be-b291-d7c7f1bddc3a",
        "indicator--a66e6794-e476-4334-beb6-e8dc11595635",
        "indicator--6d9dd2f9-0e07-4e94-9d97-1ba9663792fd",
        "indicator--0987008c-b7e3-41f3-9a41-d696bb0915af",
        "indicator--6c9df060-0bf2-4be6-afc3-40fa8dbbf5a0",
        "indicator--661341d3-1d4d-4278-ae27-648f0213988e",
        "indicator--bdc7e7db-62f4-4a8f-8b2e-ee7699da190a",
        "indicator--38cc0b6c-b763-4328-874d-3264851438a4",
        "indicator--7f6297f8-46b8-47bc-8edf-dceab9aaaf92",
        "indicator--b9fae1e7-6d8b-4dcb-abbe-4b80f7df0eba",
        "indicator--08ed93e7-a460-453a-9cb4-ae6203341db5",
        "indicator--5e38d25a-585e-4a9e-87c9-beaf27dd1761",
        "indicator--cae8fe7a-3b3e-4b2a-8df3-55230fdd7b2a",
        "indicator--85e28a75-dbb2-4252-a376-2dc7b3548338",
        "indicator--30e13408-4fe1-4e4c-bdda-57af9c02b497",
        "indicator--8cf3c6d6-8bb2-4041-9a36-97c3581a58df",
        "indicator--e427e6ec-d148-4662-9265-8cc572bb218c",
        "indicator--f4a6c531-6bda-4b41-820b-8c2282740d38",
        "indicator--ccc19c63-f46e-4212-86f6-c400def2d729",
        "indicator--310be03e-b28e-4b90-9c09-1cc94858f60d",
        "indicator--22b810bf-02ae-4eb8-8718-855f9b73752b",
        "indicator--51a11212-f8af-4d53-b169-000f985493e4",
        "indicator--5445ce49-e724-40a6-8fc5-ab5931e1ce60",
        "indicator--f37988be-490d-4538-ae82-ce3d58737933",
        "indicator--ad04e58a-fa0a-48e8-abd6-8b2d05c1a291",
        "indicator--38079a31-1976-41da-8b19-0a85d823b168",
        "indicator--a577d2a6-c223-4402-9b79-37e6f3554d05",
        "indicator--b670054a-aa88-4967-a59a-4c398f668ef2",
        "indicator--79fe4638-aea9-452f-9d3e-e73147e9b242",
        "indicator--09b3b58e-80c8-43e3-a9c6-5d0d36ff2237",
        "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
        "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
        "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
        "indicator--3379f0d3-1e36-4fcb-843e-12bedab70bbb",
        "indicator--836055fb-a07f-4d63-83fa-3e8d255b3823",
        "indicator--87efe5c6-4732-4c81-ac88-d175444e88b3",
        "indicator--5ba16619-00b5-4137-89fa-b06319339c20",
        "indicator--6b207d61-854b-4e7e-807f-af435357af2b",
        "indicator--389be42f-4bc3-420a-90ef-09430921b11d",
        "indicator--ee2c3a0e-c36d-416e-af85-dcc715a7fc29",
        "indicator--58f24a98-902a-4329-a454-530e763d9056",
        "indicator--6935c409-0b00-472b-83a5-5cb0755912a4",
        "indicator--a4bd9572-0ceb-47cf-9aa5-495009525146",
        "indicator--d34bd504-f6dc-432a-9f4e-851b440814f3",
        "indicator--add26371-178d-4f79-9275-617082baaa37",
        "indicator--111fbc77-6388-4bec-bbf9-9f8f6e713f40",
        "indicator--58187403-a370-4c16-924f-5088f8d7dfde",
        "indicator--a7578eff-b769-48a0-9480-e1f2f1a5e2ce",
        "indicator--69023526-e231-4f9a-baac-63fad093b612",
        "indicator--a4f545ad-f1fc-41f4-8308-f9ab7277aa25",
        "indicator--9e6dc2ad-21f2-4845-a148-d9c57ac4e871",
        "indicator--ba290b14-f9ae-4fc8-a1c1-5f1667f8a495",
        "indicator--d13c17cf-33d3-4434-86d3-276cac1c36d4",
        "indicator--cb3e5c57-5376-47bc-95ae-8ec1b2e9360b",
        "indicator--2eacbe48-7679-4004-8c07-9a9cc5cd3903",
        "indicator--5cd40293-4795-4828-84c0-08dc6ca01e78",
        "indicator--6e163ad9-dfd2-489c-92fd-5a6ff0550a90",
        "indicator--1f3d9f59-5bc5-40e8-8258-cacd3e89da5c",
        "indicator--7aa70d56-3546-420e-b2c6-fa89c2dfe127",
        "indicator--53f1a4f6-5e54-43e7-8f28-fe0a9f4b8a48",
        "indicator--07bdd816-23a6-4333-9dd0-3c0706108cda",
        "indicator--5eebbaf9-731d-4248-80e2-e7770cf27c2f",
        "indicator--2f0c4569-32dd-4e90-b293-4c695f41c38b",
        "indicator--5ff5af9a-143c-45a0-81c9-858b85bd6fdd",
        "indicator--e915d137-5f1d-4077-bc84-9a85e4a5d185",
        "indicator--791e714e-eb8a-4df4-9267-890922c11ad1",
        "indicator--4dd252d9-9881-4ec0-af5f-89051bf7a8ed",
        "indicator--c41c80b8-3047-4f71-af7c-70aa12964791",
        "indicator--e6ac6255-c853-4fc2-ad91-9547101399ae",
        "indicator--c2bc506d-5df2-45da-93fe-6f90149b380e",
        "indicator--7e097f91-2e79-45f4-a676-889a8d735450",
        "indicator--413d48df-bc90-4792-b49d-b5be73fcb447",
        "indicator--d3f5a9e8-16e3-403e-b603-bfe707f67634",
        "indicator--18b20513-66bf-4f88-84f0-782cc9fc1a6c",
        "indicator--8bc087fc-c72b-4bc0-8d62-252decc42bdf",
        "indicator--145b541b-4da9-47a9-ad78-bc0e3d43480e",
        "indicator--0851f372-8846-460a-9057-68f6eb28e6ed",
        "indicator--8a05e51e-6d61-4322-b1d2-2b41392cd96a",
        "indicator--cbd5f3dc-6cea-42b5-8162-b8278ed70850",
        "indicator--0658d5ce-eae6-4c43-b482-50e966f571ec",
        "indicator--24a6390c-5162-477a-9f91-e66182b2d6a0",
        "indicator--c1e3a8f7-5f48-4f68-9fcb-3b139e65e5bb",
        "indicator--a7bd9725-e481-43b1-ab3d-db6e21486ac1",
        "indicator--b116bedb-421e-4358-a00f-6ec37f44844a",
        "indicator--d5171751-2d2f-49dc-8586-673f7597c0f5",
        "indicator--5e7589bb-d1ec-4e7b-bc42-ab34bc3fa405",
        "indicator--bf9bb0f3-8531-4c23-9627-9f4b0edc829c",
        "indicator--cb05e5fa-16b2-42c9-956f-e1b9b87e2ee4",
        "indicator--f283819b-4218-43ea-b25a-ee3cf21ea3a9",
        "indicator--57af062d-57ae-4612-a9af-588bd4f25dcd",
        "indicator--d6f86214-7923-4642-8e2c-a560f4e90cb9",
        "indicator--b6208cc0-e3e2-4cf8-8408-be9fe67170fa",
        "indicator--c84aee27-4b2f-4850-9e8e-acbea4f54f43",
        "indicator--42f96bcc-7e87-422c-9c7c-06bb10d3b3a1",
        "indicator--f57d1641-f1aa-47e6-98d8-166b2a1ec6f8",
        "indicator--0022e6ee-e565-4a79-add6-23e76f6e42c3",
        "indicator--20878be8-78e9-4a2a-b258-45d3319d36bc",
        "indicator--187e6dc2-fa3c-4957-b37a-70888ed774c9",
        "indicator--828737c0-83f3-4b3c-add4-027169ef55f9",
        "indicator--ed4be67b-5aa4-4190-a299-347b419740a1",
        "indicator--94a17d3a-e1f1-48ae-9b9b-ccd3a781a501",
        "indicator--cccaaa2b-77d4-4b42-a62d-08d2925e601a",
        "indicator--d3ef6778-5674-4368-9965-3f9d32149a81",
        "indicator--58190f8f-1f6c-428a-aacd-9c32a24ef51b",
        "indicator--e00c70a8-ebc1-40c3-b1e4-e98ffee72f22",
        "indicator--5aff98ff-04f8-4107-913d-1b6384a1330c",
        "indicator--56c9e47b-4704-4c5f-aae8-f2f441bcf74a",
        "indicator--0fe19022-8a21-4162-b980-9ded0d33b49d",
        "indicator--43a23d69-8701-47d4-8d86-8afaea18b436",
        "indicator--c2631f01-843c-401a-a981-18dea6d07732",
        "indicator--35954e15-acd4-47c0-a8fd-2ec86b1193e8",
        "indicator--b2c288a5-3948-489c-a234-1a86eeb17e48",
        "indicator--ce6d399a-1cbb-4ad6-bc7e-cee7b5ced971",
        "indicator--1b096290-cd30-4bf5-982b-5f61b05af088",
        "indicator--9c860a57-7fe0-4f1c-9ce5-b71bcec4f913",
        "indicator--3ec9416d-ab49-4fda-9a9c-799a3dd3a940",
        "indicator--9017e891-e291-4a9a-80c9-6c0622c9d899",
        "indicator--d961ad73-3e44-430c-9477-97f83ee8a4f5",
        "indicator--5af52d50-f091-4491-aa16-f1c2598114c8",
        "indicator--0fc7ce3e-53c3-410d-bfd3-26e524ad9978",
        "indicator--36d64754-476b-4f6e-b2fc-8f792dadc109",
        "indicator--374fef9c-9004-4a6c-ba14-649b1a9a98a3",
        "indicator--fa3f2e63-6c7d-45a9-986a-985940e1eb2b",
        "indicator--b26dfec4-95d7-4455-a68a-126196e0a000",
        "indicator--fd5d9742-6cdc-44b8-8bec-27a53a9828fa",
        "indicator--c00cacde-7369-4eb8-80c4-1aca3ffd16c8",
        "indicator--b7a8ffde-aea3-44aa-8d21-2de8a9b2c887",
        "indicator--76fb6e5d-6db7-49fc-a0a0-142a012452f3",
        "indicator--a2537d33-5997-4c97-a37c-6d3591dd0630",
        "indicator--3ed08db9-7404-4d0e-a375-e119159182b2",
        "indicator--6efdcd75-78ac-46dd-af89-c2b7b9c905a3",
        "indicator--675cdc61-ed5c-48ca-b2c1-54870eeb9dd9",
        "indicator--81e6c608-c640-4889-9b5b-971c1f84efee",
        "indicator--069d55f9-6e06-4cbf-9a79-4fbc3e506f00",
        "indicator--b691384d-d5f0-4a12-bc9f-c2ecd320f104",
        "indicator--d8745463-e457-4163-ba71-32a59c41181a",
        "indicator--372863f6-8781-45c1-9163-64032e9c06d7",
        "indicator--fc9aaf2e-3a49-4e39-a37c-2015917f6627",
        "indicator--bcc091c3-abea-425f-99b7-ed9dda4e8a81",
        "indicator--513f9437-af24-44a7-a944-a41905ef9bff",
        "indicator--dda73ac3-543f-468f-976e-26b36ad5ac2f",
        "indicator--4c6cdbc8-a164-4dcf-a731-377acf8050e0",
        "indicator--49fc3109-0d70-4008-a8cc-9fdb57d86cba",
        "indicator--5721b29f-ef1a-42cb-9193-7c1ac0bd23bb",
        "indicator--b893af61-73ff-4657-b74d-c8205a2d167e",
        "indicator--1de4305a-38f4-48a4-af7e-7b41dd16ffe4",
        "indicator--c3d8d1ce-a0c0-460f-a17d-9cfc952f0517",
        "indicator--ca47286d-ff4e-40d3-a7b3-65c8197d9e99",
        "indicator--75705452-f167-4299-980e-f7907bf85953",
        "indicator--c6ff102c-8a2a-4cfc-85c2-0aaaef68cd30",
        "indicator--1b9e17a3-df54-4a27-8745-731349645ad9",
        "indicator--de1d2942-72ed-47d7-981c-6aab37a13614",
        "indicator--ab8eb317-13f7-481a-8e8e-6e8cb98811ea",
        "indicator--37a9df55-5e14-4c16-8a6e-f538dd931289",
        "indicator--0c8314f3-3fac-4bfb-aa36-3ef5431cc985",
        "indicator--b49755f3-a6dd-44b7-bb20-fb4d3b2940d9",
        "indicator--ebfa5bd8-c82a-47b8-a69f-4e637e296b33",
        "indicator--12c20578-a011-4206-8ecb-e6e3c84f597a",
        "indicator--621d12ce-2b89-44db-a011-b35305010428",
        "indicator--fa958367-38ac-4285-846a-a5ae69f82d49",
        "indicator--7691e129-a0b0-4068-a18f-1e1c56c3fd5a",
        "indicator--38557c5c-d103-4a02-8a82-ef90e2e480a7",
        "indicator--67d763e3-9f27-45a7-bce4-01960a4324cf",
        "indicator--c639fdab-c6f2-4625-8b1c-bf61cd17fc2d",
        "indicator--890051f4-374f-4c56-bc2b-14b4fcd29caf",
        "indicator--ee64faba-7c43-4a34-966d-9344f890084f",
        "indicator--b3472130-03ed-4fc3-b561-3032a5744011",
        "indicator--04356b0d-5e50-457f-887e-2b2c069a2534",
        "indicator--da28c18d-7945-4740-afab-59a731599a9a",
        "indicator--fdb08c00-79af-4bfb-bc54-c71b7998353a",
        "indicator--6bcee5a6-4285-47cb-a806-f40faf5c24bf",
        "indicator--82054ee2-1ce8-447a-97b7-cbb63cb441cd",
        "indicator--32564c07-3418-4663-a9c5-ccb99a1f7500",
        "indicator--ff6e4df6-08d3-48f3-9854-edb941afd985",
        "indicator--23a478de-4e02-4b1f-b562-94621c2574ec",
        "indicator--fc7cbb89-38a4-409b-9a9f-57e8c06659cb",
        "indicator--a7f56ae3-12e9-4a6f-a517-7942ad1c9feb",
        "indicator--41e011d0-e77a-4fbe-b4f2-750239068a23",
        "indicator--bdcb32ab-e241-489a-839a-1a867de2f0b2",
        "indicator--8f2fd020-43b9-4482-a72a-2ac184317c9c",
        "indicator--bd39d215-3961-41bf-8a41-9365f7f22bac",
        "indicator--f4d87608-362e-41bb-b36f-f198f6ae45f9",
        "indicator--4ee15f1a-4b6a-414e-8728-6fee95844db0",
        "indicator--85d1793a-8ccf-48c5-8fd6-ec87668cb5c6",
        "indicator--aeaf2718-9e7a-42cc-a66e-86433e03e9a4",
        "indicator--363e2e2f-29d1-4d6b-a815-5ea746c4d656",
        "indicator--18b6c72d-64e1-4a0c-a34c-2e30622f6eea",
        "indicator--be77fbdc-6f06-475d-8b8e-7332bb926f8c",
        "indicator--9317c893-9a9d-4618-a6d5-77c8f7272ba9",
        "indicator--ccb36dea-ed2f-45d1-b145-95237c1e76f7",
        "indicator--f35e8439-88fa-4461-891c-15c6eb5f8608",
        "indicator--98337031-14c1-4462-b635-f1bfd65869ce",
        "indicator--4cfa3a91-ad2e-4bcc-8187-d006728b1a86",
        "indicator--773fd411-7959-4871-8664-09670643de89",
        "indicator--77f29de8-e787-495e-a61c-7ce452a57e3b",
        "indicator--3b10489e-34bb-48bb-877a-2c43a97c3e6f",
        "indicator--72429d1c-a622-4185-bea7-93474cc6ca84",
        "indicator--58049f56-30c8-4afa-ab5c-128f67584392",
        "indicator--d4cac16c-b003-483d-852e-ce93090386fe",
        "indicator--4c4721e2-33c9-42f7-a573-47989e468cfb",
        "indicator--e1737cbd-37f3-42f0-ad29-c1c2ce70e0d9",
        "indicator--6e7804c3-7e7e-4456-ad21-997186243d76",
        "indicator--6ad90062-bb88-4500-b96f-49049bff1c81",
        "indicator--45b78157-e265-4d33-ac8d-f5145da29266",
        "indicator--06cb38b8-dd93-45a8-9334-cbda7322de02",
        "indicator--be4f1d22-4742-4b33-a1b1-be71cac258e0",
        "indicator--8d853cce-6dd5-4bc1-a87e-1cddc03a3eac",
        "indicator--fcea88ab-2f7d-49a6-b299-668ecb11eace",
        "indicator--138281f1-d114-436a-b568-de8c046a4ad3",
        "indicator--16d9a54b-80a7-48f4-b8f4-096bfefd4123",
        "indicator--76f47aca-f8d2-4dbb-9d43-af2b9e54dd1c",
        "indicator--e42d9735-7b25-4c78-9565-e8daa1bd46fe",
        "indicator--6ef7d5a0-6ecb-4ae3-855d-099a92d6da1c",
        "indicator--5e43bf18-83d5-48aa-b3d5-a283eef48005",
        "indicator--baccd5e0-89ed-41f4-976b-c7ac71e0d4f9",
        "indicator--0bbef10d-9c0a-4dbb-878b-54930a46a96a",
        "indicator--15ee9d51-95d2-44dc-a9ee-94a5abba7226",
        "indicator--d505132e-b053-45fd-be90-8d43b9105d0f",
        "indicator--cf829500-cbc2-4117-bacb-278f57e18f09",
        "indicator--629427b8-a26b-479f-9c1e-d246f39c4f95",
        "indicator--088d17d1-aa19-4426-9c32-ec89ff04caee",
        "indicator--b44753b8-5efa-4c27-8b4c-971fbd2004d7",
        "indicator--80b4fcd8-0078-4118-b101-5e48c27dd86b",
        "indicator--f1b05f1e-87cb-4006-a843-0639f6f199ce",
        "indicator--2aa5574a-99f8-4617-9811-096e71d37fab",
        "indicator--b3702c86-60cd-4f7a-9a75-36a4549b61f8",
        "indicator--9bdb4de3-243b-47c3-b1f3-19e517eb795b",
        "indicator--1c5e352c-49d6-419f-96e0-2f3fc50255bb",
        "indicator--72563dd9-6b26-4e65-b996-2fa13ddf39eb",
        "indicator--aaf1b8f0-a615-4167-9abf-beb63cb38938",
        "indicator--668fd350-714a-4324-84bc-92edfe0a52af",
        "indicator--4ad24fb0-c143-47d1-9106-25188217aae8",
        "indicator--997f6d04-72bb-4341-811e-060898241047",
        "indicator--5f77d29f-082c-4771-94c2-6393c9aff696",
        "indicator--46c7b2cb-223d-4367-9283-dfb5bfc840f0",
        "indicator--fde35f30-1f7e-4c1a-bb8f-9ae98fb599b7",
        "indicator--bcbe362b-5be4-4c63-9083-722f2cbd9160",
        "indicator--4ced63d0-cb6a-497d-a149-b7ea10c7545e",
        "indicator--d0405b62-cd26-4aa4-836c-0e58d6675073",
        "indicator--02a2b7e3-9f6a-4916-a100-56936b4f7dc2",
        "indicator--4d2b306b-24f7-4d70-a730-13120db63d1c",
        "indicator--33382c3d-b62d-4091-9f5c-72ba0eecbb8a",
        "indicator--c92212f1-7b7b-4699-a6a3-3168c91c599c",
        "indicator--63460c25-d545-40a6-998d-8965ace79acc",
        "indicator--54d7c922-5a31-4553-b45b-dedd022b2951",
        "indicator--dc01f7ac-fb03-4d1b-a8e2-27371d09004d",
        "indicator--9883e2a6-7747-460d-92ef-c14a48ef434a",
        "indicator--20cc4717-9812-4c72-9cdd-bdaa68747638",
        "indicator--baa5b08b-1efb-4e7c-bc79-09a1e074b675",
        "indicator--ca58355d-0aac-4627-a4c9-d870c4d8fdaa",
        "indicator--abbc4722-dd53-46d6-be46-4ba4042e3769",
        "indicator--6aff7db0-ada6-4b13-82c1-a4cbd087f13a",
        "indicator--10bddabc-7e35-4385-969f-de3d98c64177",
        "indicator--23dc2c85-5c80-44eb-98c7-ebb171a119c5",
        "indicator--a93ed2e2-466c-4fce-906d-05846901d2fe",
        "indicator--20248ff4-f894-4afd-bc72-dab1c68e61c8",
        "indicator--817d15e6-f492-4089-aa82-851062c9e2a9",
        "indicator--077cb72f-5896-4c4f-a462-7af8034c8c5d",
        "indicator--cedeb147-d28f-45f6-beb3-c6652e0d7d74",
        "indicator--65bc2448-8189-4ef3-a3df-c75b49fc9848",
        "indicator--a5dd2709-52ee-4aa4-bc77-9e457dccb28e",
        "indicator--bb735259-c370-4064-8160-d91a35b839ac",
        "indicator--4c7b6ad1-84f6-4628-9e9c-c5f414580201",
        "indicator--098a2614-5df7-4dcb-824b-332ed009893b",
        "indicator--4d7cf024-3cdb-408e-9f97-bbe7f0aec93c",
        "indicator--39ef9c9c-db64-4af1-beba-fa69caabdd47",
        "indicator--9876322e-f4e3-4f50-94da-af6b2191a40f",
        "indicator--7df881db-6828-40ff-bfa6-f8dce3e1de9b",
        "indicator--03016241-daa8-448c-ac58-07377ac37816",
        "indicator--013b2660-5841-4f1f-a2a7-3ff46aa1589d",
        "indicator--9301812e-c7ba-4ce3-8ed1-6eb4f56382f0",
        "indicator--56bf828e-348d-4b65-bc18-6e01f28501e8",
        "indicator--0cdb2f1b-6794-4f0d-b847-622bcb2b6ad4",
        "indicator--2d4b8455-841f-40f0-bd04-28519034dab8",
        "indicator--4f1f5a17-3e0a-4ac8-80e4-28b4dc3fe089",
        "indicator--a0697d65-baea-40d7-abd8-02c19ead10bd",
        "indicator--dfbf5a38-3589-4646-80aa-86ab04cb9a26",
        "indicator--cfdf52b8-51aa-46ce-9225-b2f5e5b61693",
        "indicator--a7b0757d-da13-4dcf-873a-ffec97ecea1b",
        "indicator--c36731c9-8695-4959-8982-d59148d5f41a",
        "indicator--66b23e1d-6b6d-4919-b59f-9fe512dd7e03",
        "indicator--4b16db4d-6848-4343-a4ac-c507370f1fe4",
        "indicator--9333d311-e661-4c8c-82ef-ce5a9822ba88",
        "indicator--8c1d030d-1074-495d-a9ed-e57d52068278",
        "indicator--9c2e5d1f-3ee0-4eef-891b-58d1fc6b852e",
        "indicator--25151733-9d89-4349-a88e-7be542acf5c0",
        "indicator--240febd7-adf6-4ddf-bce0-357b5b1f8cc3",
        "indicator--ddbf3a12-5570-4fa5-a1e7-097dbe456546",
        "indicator--ed1796e8-29a0-401b-9a01-9f9d83f63502",
        "indicator--54bb277f-35c8-4724-b5c2-9ec5571ea036",
        "indicator--393995cd-0951-4657-a8e4-f22cbbf7ae05",
        "indicator--8f260af1-f0d9-4667-95c4-05c4cc4998d2",
        "indicator--fdbc00f7-7c1b-46ce-bdc0-fc0ec5fcc9ff",
        "indicator--eb2a9d43-30d8-4197-bd84-9fd7cac9f431",
        "indicator--fb47f37c-9cfc-4478-b278-41b09b70bb16",
        "indicator--b3c83928-f38e-4dd4-a0b4-d93793c398e2",
        "indicator--5d3cc13a-5dcc-46d5-aead-f966ab01025b",
        "indicator--e91110c1-47b5-426b-ba82-731109a8dcff",
        "indicator--b57a84c7-b815-4c90-add5-d9bc20735584",
        "indicator--7a0ca15a-909f-462f-a47f-6c03bc5aeb7f",
        "indicator--3f162a48-7156-48b1-a632-1bf368f9d06e",
        "indicator--1b4c831a-e1ec-430f-9cea-3a807a65b540",
        "indicator--c9865826-b781-46b2-b5f1-327509fea110",
        "indicator--4108158e-9447-4204-82de-6d01a925d97f",
        "indicator--889d01bc-c7a5-4179-be83-7022715816be",
        "indicator--362f8de0-9a1b-4482-88e2-502291374c6a",
        "indicator--a2bdd847-2076-4735-8f62-a95777353d6c",
        "indicator--3ff3b9df-2f08-433f-8902-ab07b25a3135",
        "indicator--cec97e65-8ece-4c2b-8fd3-1028851bb0e0",
        "indicator--8a71205f-a273-4754-83f7-28ecb4f59991",
        "indicator--2e20e28a-9c92-4758-a4e4-eac8d68595e7",
        "indicator--af4440d5-1f02-415c-ba5c-c44077728985",
        "indicator--2d2a464d-ab91-413f-b5e5-15dbc08a3314",
        "indicator--89947802-d6b3-4a7d-8ab6-3510a848ac73",
        "indicator--053ddf32-2e9e-42e9-9dbb-cb59f0b720b1",
        "indicator--c3d6bb35-ee22-4c55-bc2c-0fb668790fa8",
        "indicator--70687746-088c-4769-a69b-5d70cb92226c",
        "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
        "indicator--d1de4275-fa25-4bff-a718-97502f11a16d",
        "indicator--dc19e10d-6d32-47e1-b8f0-e3306ad1d0bc",
        "indicator--e424c86c-5411-43d6-acd9-e422cdc42b70",
        "indicator--9a1848e9-e412-4a58-8b52-62ec68c13075",
        "indicator--16f3aaf9-d233-4398-a747-a30123dbf281",
        "indicator--8d48bd37-a962-41fd-89d7-5ce020fbb87b",
        "indicator--7a3e261b-ec71-4751-b3e5-fcfc11a3b518",
        "indicator--f97165fa-d4a2-4965-9109-ae98f2001817",
        "indicator--d7920f85-8b2e-475a-96ca-7a8e9c0ad125",
        "indicator--9e01c6a5-4f51-44f7-827a-8cb302680a81",
        "indicator--ca07831a-ebff-4518-acfa-9954d1e10360",
        "indicator--b43b791e-2e32-4190-91d5-79255d346e00",
        "indicator--949054bf-4ff1-4cfa-922b-e20185ca6b57",
        "indicator--5d9dff7c-8d36-4dd1-9dac-4433c7acb147",
        "indicator--b4e11170-7a01-4df6-bd3f-130ce09744b1",
        "indicator--e44ba671-8e20-4856-983f-6fb416831236",
        "indicator--b20700c5-6615-47af-8918-2033e885f58e",
        "indicator--bf4a1301-79a3-47e4-b2c7-1603c06e215e",
        "indicator--633ba613-4a8c-48c3-ad19-dfd1b4a61f91",
        "indicator--5ef8438f-309d-4629-ad1f-f6cdb085c0d8",
        "indicator--0a0f090b-f676-4c7b-a214-0620e45c28dc",
        "indicator--3ed94e72-0d58-47d8-ae39-1d24cf96fcc8",
        "indicator--11e3e12d-4dfa-4919-a7cb-64188b29b465",
        "indicator--7099a337-5598-48fa-a5b7-c698e3a382fa",
        "indicator--0049f615-f877-4afd-afaa-4d7522e162c0",
        "indicator--5285c58d-b092-4d2b-869a-0bd1c7c1c6ce",
        "indicator--c8896f87-5745-457d-9ad1-ae5718fee0c6",
        "indicator--f5a06fcc-bba3-4b3d-a529-d4720a9c6fab",
        "indicator--325fddc7-011f-49ee-aa15-c130bb02207e",
        "indicator--dafe0464-c7ce-4d58-8d55-e073a4d1a80f",
        "indicator--da3447a2-14fa-4232-98a8-54e69f69c0b8",
        "indicator--fabb36bc-93cf-43ff-975e-7419f9f5a17e",
        "indicator--40763366-70bb-4c51-a48a-c34eaa98dae1",
        "indicator--0a41d434-f23a-4046-a897-0f7ed805d9f1",
        "indicator--e36b21c5-7a3b-4b3d-abba-284b510f9484",
        "indicator--3462b620-a325-4579-b51d-38ca5b68f17e",
        "indicator--46e3af23-6b4c-4d28-bfe3-9f36a63faa04",
        "indicator--1aafc808-9da1-42ac-bd2f-8d2e40ad0e42",
        "indicator--5ccfc3ea-8b68-4de8-93f4-550d9d1a829f",
        "indicator--468230a8-b0e8-4d72-9d14-8c2853f5ae88",
        "indicator--158531ed-9619-477e-90e1-66127158bf07",
        "indicator--f64b6857-59ec-4ea4-a450-60b7d1a4f04f",
        "indicator--7508e95f-f80a-4d10-8f23-c31a2a16eecd",
        "indicator--3828d96f-95cf-4adc-acf8-bd4c4a77df6a",
        "indicator--c6938fb3-1578-4159-8909-59dc4df77689",
        "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
        "indicator--88a3c04a-4bfb-4335-9a5e-04768294b846",
        "indicator--76c5992b-4aab-4ad6-ad10-60fbe8b214d6",
        "indicator--7f4cbc6e-6665-4c22-9c0e-d4e701e01200",
        "indicator--dd8df2d5-77b2-44db-be8d-d754bd3c1cf6",
        "indicator--fc5db8f4-1799-49c0-8656-66591f3b814e",
        "indicator--be50ca16-c407-4642-a89f-9128f7ee4be1",
        "indicator--03b98991-e9bf-4f35-8db0-acbe8f310415",
        "indicator--cc08972b-addf-4820-95d3-5f97c0c709a2",
        "indicator--5b10eeef-ca17-49cd-be39-2598a1f97fbc",
        "indicator--0e4ac8fc-c3ad-4b13-bd20-575c96e667d9",
        "indicator--434b0670-e0f8-47bc-bb69-e033e9d1e175",
        "indicator--1c861f64-cc95-498c-9e02-fe6dd51bba87",
        "indicator--8d6cb90a-561e-4dad-873a-6b7ef768d103",
        "indicator--5624d1bb-cf2a-42c4-9cfd-08f73d505765",
        "indicator--8151a4aa-f311-48a9-926a-2aa3eef85eee",
        "indicator--d9617e34-5827-44f4-8aa1-75cead576862",
        "indicator--5857a75f-3118-4f2a-a53c-86668fe0c4b9",
        "indicator--4a515adc-7d11-452f-9e9b-0e48d350490d",
        "indicator--dd0671dd-6966-4a79-866c-d1ae4b671ff5",
        "indicator--ba84a898-f6e3-4066-aa48-4ae1fe351fb0",
        "indicator--24ed83da-f670-4036-982d-ee370734be98",
        "indicator--847afd42-e46c-4ed8-9c42-26fc96c780f2",
        "indicator--27e07d84-342d-4f27-8832-38f3ffd8cec6",
        "indicator--29c6ed06-b3c6-4846-bbaf-eacc53b42361",
        "indicator--198fbb68-e263-4aba-9982-41fcc994b4cd",
        "indicator--f827acf2-e0b6-4f72-9c69-9bf3e03ad8a2",
        "indicator--042c07c1-734a-4d03-8b17-e2ffe654fa38",
        "indicator--9e1b3628-a8c3-40b6-896a-0620264db1ad",
        "indicator--10669b83-ec11-4068-af6b-bca494f21f50",
        "indicator--5ff21e6a-52d6-4748-82ea-bf56a5ad5f99",
        "indicator--301a197d-04fc-4522-b12a-615f0d910271",
        "indicator--8c06ea27-5fae-4a80-8f15-2e2acc40bdf1",
        "indicator--b0ade785-344b-424f-9d5e-d1ded8521103",
        "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
        "indicator--9114b2e7-c9dc-4eb5-a856-445c919b3157",
        "indicator--a748fb2a-4226-454d-8aea-26864112328c",
        "indicator--4eb028e4-e044-4345-a873-e05d2ee74cc8",
        "indicator--7f163fed-1065-43e2-acde-77fe2cbb7ba0",
        "indicator--07243cf2-0793-4c7b-baed-4152f2fe4e80",
        "indicator--f7b8ac1d-5a21-4a22-9988-218a0abd1ed9",
        "indicator--861ff1e3-56f2-4780-93ed-038e6980407a",
        "indicator--f71198fe-8c56-4461-974b-dbf8205e321d",
        "indicator--a83a0439-eb65-4e73-99e5-33f4af2ba49f",
        "indicator--d319f6d4-058b-43df-b8f5-7ba253d4990b",
        "indicator--c8d7f83e-5f8d-42ba-99ed-cdb3b5ded5c8",
        "indicator--303e6e8f-c086-4fbf-8042-acae685db941",
        "indicator--8d79a158-db27-4057-9e4d-23d2458a3adc",
        "indicator--8e9d20ec-e251-45a9-8a9c-d0b67a5112b4",
        "indicator--1d5ab50a-eab7-4a01-bcbe-3ec36f0d7250",
        "indicator--58380ad3-990b-4ef7-8040-db18613ff1df",
        "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
        "indicator--e59f510b-fe26-4319-8c74-d2e41dd9c182",
        "indicator--ba025811-759b-478b-a6dd-7634fc5fcd65",
        "indicator--586e039b-0cbc-4549-b6c4-a3481cf654fc",
        "indicator--f363d783-a3b4-4c6a-88af-9d9ae232d031",
        "indicator--617f859a-a521-499f-8112-c8412cf17d8c",
        "indicator--678649ff-6223-4a6b-8ab8-1958b48017b0",
        "indicator--a404e100-f078-4909-a9b2-09e26881a7ab",
        "indicator--76d32724-83ef-4d68-85b8-95d1c7866946",
        "indicator--1f34b5cf-a162-4576-b885-abc844c2fbdb",
        "indicator--27d0d07b-efce-4d5f-9197-ed61a33d1509",
        "indicator--d35036a6-8ee3-45a1-8e69-e95977175e92",
        "indicator--89a035b6-b585-44a7-9b6d-006fe315cc72",
        "indicator--47809d0d-a27d-40b5-ac10-f585f5a3ef3a",
        "indicator--5ebab2e6-de34-4fa2-90d7-7b767497d328",
        "indicator--446dec01-9dee-4151-b9ca-0bd1cb49ad1a",
        "indicator--b17c40d9-5365-40e6-93f9-bb6b7c481630",
        "indicator--93835160-2876-4504-a46e-0e2e334da0e3",
        "indicator--c5919236-d97c-45b3-ae42-4f52ae483551",
        "indicator--3e58c6ca-89f7-4ff8-ac7b-c98c016e557c",
        "indicator--68f252f0-17be-445d-a309-03203504ab55",
        "indicator--401926ca-dcd0-420c-ac22-c8e81741e17f",
        "indicator--0658dd9e-1bd4-4053-95de-56a916788f86",
        "indicator--318f6c56-7c57-4445-b287-423becdd160c",
        "indicator--9f723794-98a4-4c92-a62e-88e321430ace",
        "indicator--c5fc6822-3375-465c-bad6-e7d57b4e46a0",
        "indicator--7b1e92fa-319d-4247-bf00-b2dc3747621c",
        "indicator--460c5cc9-c807-47c9-ad2b-b849cb6196fa",
        "indicator--d45a4c58-5456-45ae-82ea-1a9113b6697f",
        "indicator--397a401f-c34c-490d-a02e-5c18e8a216de",
        "indicator--409b7e88-af8c-4075-8179-62492ba1b5b7",
        "indicator--2f2352f5-39a4-44fb-8402-818449665b25",
        "indicator--865cf892-ae10-4755-b6b1-2c9dfc7b2ffe",
        "indicator--15387033-bb07-4aed-bf18-39b0054597cb",
        "indicator--943d2793-f4c3-47dd-bcc5-e9935d95e5ee",
        "indicator--00321099-af7d-4ff5-a15b-1a0208a9d736",
        "indicator--75ae9606-d947-4ebb-80f4-0c3a205826bd",
        "indicator--946e95d7-f9b3-43b9-acc9-38ee8da4e55e",
        "indicator--7a4fc418-eedc-457e-bf5e-919b834b651d",
        "indicator--29db4b55-b44e-4747-b955-4c1e26d8a1b3",
        "indicator--14960a28-91cb-4642-a46a-11344338fb16",
        "indicator--4a987030-a535-4a33-8224-1860ae2245d3",
        "indicator--9d34902a-5153-4077-80e9-b895d1e8eca9",
        "indicator--5410c856-bb8b-42d9-8ca2-86a97bbeaddb",
        "indicator--f93f9315-b387-43bf-a9af-1a246fe05f8a",
        "indicator--c63ac833-6f36-42de-b4e2-e92a2c70b3a4",
        "indicator--10a906ba-a63f-4ce3-b210-e5fdf5f98fba",
        "indicator--ecfa1d54-b0f1-4c11-8049-a0c173eff712",
        "indicator--37aa5987-f497-4377-a4e9-52f3df383359",
        "indicator--6864b9ee-54e4-448b-b19f-bb3fa17dc7f4",
        "indicator--b54be057-c1fe-4993-a49b-019a698dea4a",
        "indicator--39915cbb-6cca-4de6-bee3-a6d0e318602a",
        "indicator--e3b8ad25-0046-479a-89fc-f40280b3a778",
        "indicator--edfc4b81-981f-4e1e-8127-19cc6dca0a1b",
        "indicator--93611194-09c5-43fb-b156-6effa7adcc3e",
        "indicator--ffd88ad0-addf-4144-9bd1-7c5e826c0957",
        "indicator--e3c54216-51cd-4f4e-9823-3343e7e69501",
        "indicator--f7993408-54ea-4751-ac4e-7260ca17aef3",
        "indicator--d971a37f-d44c-42b5-8b9d-2f549d063384",
        "indicator--c2935550-a027-4ec4-94f5-eea90eec905b",
        "indicator--8b5b33cb-a955-40dc-aaf2-16876a3dcefd",
        "indicator--f6abde93-ed8e-411b-baf1-9956bab3aba3",
        "indicator--8812df52-8d69-4973-ad40-f988b7833ad3",
        "indicator--d7bc47c4-2a33-4e3f-a0bb-9f085c5ae4a6",
        "indicator--0551705c-3001-4c23-88d0-a99a9f7afb3e",
        "indicator--07b6b110-3eca-4d19-87d8-77747bbf9901",
        "indicator--fc5d39ee-a92e-4c60-8978-bef312d55842",
        "indicator--a2f0fc74-a7a0-4bba-b051-98de09ff0574",
        "indicator--0adf6614-10c7-4240-bb1a-ecd413073382",
        "indicator--e8c2a11c-46ec-4cc1-8d3b-58018c61f615",
        "indicator--c79e3b78-8f61-433d-9902-0afcb3de3004",
        "indicator--d4953601-b317-486f-a4e6-009c3d5acc1d",
        "indicator--2bda168e-aea6-4247-9295-2d8d6f572d41",
        "indicator--9f574f68-79a8-49d5-afed-86387179b7a3",
        "indicator--c0444c04-ef63-4163-b56b-cf7f211a9a62",
        "indicator--9106a385-945e-407c-8d5c-f52c985e6a8d",
        "indicator--3546e5fa-3a66-4252-b531-d36fb91dceab",
        "indicator--259e4a85-6656-4139-81af-35224358aa39",
        "indicator--6b16db1f-3932-43f1-acdc-51a4017c7e42",
        "indicator--29b8742f-ff34-4d4c-9624-a7ed040889d2",
        "indicator--5ba4ec8b-f30c-49cd-bd74-2f6e8ead9120",
        "indicator--17e1fa2f-36b0-460b-ada1-fe74eccf0a93",
        "indicator--e99dff4f-9596-4644-9582-27853c15cb9e",
        "indicator--9814f9cf-f86d-4925-b107-3705dfa8b1f7",
        "indicator--5ef7dc6c-7c5b-4dc3-af78-3a39bd3e02fe",
        "indicator--1ab672f6-6ba2-4587-a61a-9b2e2a2a2338",
        "indicator--c752faa9-6801-4120-8ff1-1477c5649c11",
        "indicator--df7bd0dc-4bda-4692-9a20-f86039421d6c",
        "indicator--5da8dbf9-78d7-430c-ba6c-576433b98d24",
        "indicator--a8bd60c7-e36f-4358-aa09-4a1525bbdafb",
        "indicator--54b5358f-cffa-45d8-97ad-c3aa442d48cd",
        "indicator--72d5cee0-2389-456d-82b8-8e7cf10a6a68",
        "indicator--d2533351-c9a2-4280-9356-8d3520b37e4a",
        "indicator--5963635c-4ff2-4604-a6d5-2526ce7751a5",
        "indicator--57e0f552-bf94-4410-b365-9c7cee38b86a",
        "indicator--53f224d2-b906-480e-810d-070b298dd493",
        "indicator--7e1ce357-d873-454d-a0f0-b26be50481fc",
        "indicator--13d9f24a-7772-40fd-bf1f-6a4e85cda9cd",
        "indicator--bc0c9f7c-2dc3-48e0-ba8e-f5a2d78cabf6",
        "indicator--4bb6e4a6-0294-4aed-b654-39cdee82ff48",
        "indicator--8c1385ee-b2e8-442b-b7cc-49bbf70871a5",
        "indicator--9e492ce3-e965-4d19-84d8-0f4ff4a7df27",
        "indicator--bcb427be-e572-4809-837c-cd919bf0c4cf",
        "indicator--b4753967-22c0-41e7-b24c-8917ba82717e",
        "indicator--08934c6b-322b-46c1-bffb-14f7f949d41e",
        "indicator--b971620f-972c-4e93-8c54-90e106fa2e1c",
        "indicator--2c69a6c3-48d8-4b7e-9c86-d063bb0dec8e",
        "indicator--c424eba4-a62c-4ef1-bf63-b3366c1b3f0e",
        "indicator--19b52180-7892-453c-864a-39448b5175b4",
        "indicator--3c120958-be82-4a17-b3eb-b6c595f40c3c",
        "indicator--967935a4-df34-4825-bb4d-65e1fd354936",
        "indicator--ce8e5246-2474-4f38-8fc3-2879ecfd935a",
        "indicator--a669c7fe-1a8a-4f41-867b-dda677353edc",
        "indicator--9c5fb789-0593-446b-9eed-613dcd292a2b",
        "indicator--620a7fb5-bf0f-483b-8b05-b8cd3f5e3eb2",
        "indicator--bc8d371e-1c78-4ed8-a1c0-2166b67b947a",
        "indicator--e3643939-c485-47d5-a3ed-9ebcee65c7fe",
        "indicator--78db4083-d425-4963-ab2e-5167a40cda22",
        "indicator--a0da60fb-bcc2-472d-97d2-3f112cfa7469",
        "indicator--7d9333c8-903d-46e9-91d3-05c1cca47927",
        "indicator--0b744a64-41e3-4c09-b2af-fff41a483b83",
        "indicator--fff4a3d9-3694-4f5a-8738-72d29230568d",
        "indicator--9eebd927-1199-46a2-a527-bf9016cab00a",
        "indicator--d9e28219-548f-4612-b0df-14d5945cea6c",
        "indicator--f52de28b-f222-4526-942d-a5a5567a1326",
        "indicator--708d24ce-b8dd-4dcd-b2ea-4bdb59acc96b",
        "indicator--d9838051-4084-4e02-a21c-762101ad6c97",
        "indicator--bd6ce9eb-c453-4473-95ae-ccd4b86a3e30",
        "indicator--0a4d0c5c-bd37-4476-af71-851ebab2f19c",
        "indicator--22ef7c46-aa1b-4b43-809e-421cf751c31d",
        "indicator--639c03e5-f9ac-4ca6-8be6-b5eb568cde0d",
        "indicator--a2f6cc02-b477-4aaa-91c0-5318a669db37",
        "indicator--25fe4e08-55c1-4981-b4c1-4c0f6929f87f",
        "indicator--0fcc8154-0860-4a25-8aa7-0bf4a5b8d6ef",
        "indicator--8eb307cf-afce-4a77-9668-8d5059db3c36",
        "indicator--cdd937f7-8779-4139-819e-001ffa3168d3",
        "indicator--53bbe547-7ee4-497a-8f10-10a992031738",
        "indicator--c535049f-8eb7-4c25-aa45-57cc4f90bc17",
        "indicator--95756c28-9039-4b1a-8c8a-447aa6d6cc16",
        "indicator--1dcca188-908c-49ac-819f-b5aca15167a1",
        "indicator--04f52c67-5935-4f82-b206-38d9f264e33c",
        "indicator--279776ff-3c2c-45ab-8646-962403c7ee75",
        "indicator--f68032f5-cf86-4778-869f-3c13bf1e5b40",
        "indicator--04ec0675-2aea-4af1-ad48-924dcbad7108",
        "indicator--00155eb3-a736-4c9e-92ae-f1d6f9a46a22",
        "indicator--aca1091e-e6be-4bba-919f-394445734bcc",
        "indicator--e85a5a5c-45e2-4b70-a659-f56e02a5fb13",
        "indicator--acab9001-2f30-4b32-8530-05afa2ef877f",
        "indicator--6bcfb678-d402-4a1d-a2b6-b44170404cfc",
        "indicator--0f7e4217-e18b-4921-b9ec-d74dbed56159",
        "indicator--04a2af52-5952-4c43-ac5b-28be72de0564",
        "indicator--0cfac61a-7b2c-448c-8445-8c760a7b97c1",
        "indicator--0e417471-8b7b-48e2-a9f9-c4cee45561be",
        "indicator--295b5b99-373c-419a-8381-4a2a6ff4f57e",
        "indicator--553cf8cb-4aa3-47c7-a414-46d8c5403f3c",
        "indicator--6baff7a5-be3d-4b50-9e69-d2a84b29f9ff",
        "indicator--b1b7a042-142f-4a00-9add-64d8d0342a37",
        "indicator--6b5353b4-1850-4470-b071-46723ae6c30f",
        "indicator--245a10d9-6b11-4127-802c-5f35a4e18b44",
        "indicator--dd1df446-a6ec-4f8d-b353-9ab4ce885420",
        "indicator--ef768eaf-2b17-4307-8a1f-e8c7cd3c1f58",
        "indicator--de385e9f-d19a-4adc-854e-a7c9f686e942",
        "indicator--a2fcb351-7b30-48d5-b5e3-9a748b7f9de7",
        "indicator--9f3a0b66-1936-4a1d-b007-3ae4740aed1f",
        "indicator--307cf04e-988f-4114-b4aa-6cf434d788cb",
        "indicator--ba055a24-b02e-436b-bf10-0cc1ef996124",
        "indicator--94c9cd16-d414-441c-8b2c-c16188ba4a7b",
        "indicator--0a6c3239-a05c-47aa-8400-dfefea0e1e83",
        "indicator--4b392d72-1c7f-4ab3-8c8c-07031119a4b2",
        "indicator--662d4a4a-3e13-4337-b2ec-bff62bb66149",
        "indicator--a8b86056-3f7e-4be1-bda2-9e07937afee8",
        "indicator--f3289284-7d0e-426b-818d-d6afe00286df",
        "indicator--28be3811-4af4-4fd8-be98-1def5a169fa6",
        "indicator--92ef170a-8c57-41bb-bf64-fc8475325de2",
        "indicator--081cf61c-8a6c-42cf-b500-ecc3c6d20b7e",
        "indicator--7767e18f-6e03-4153-9b33-4f527c9d6708",
        "indicator--9483e81b-db6b-4346-b130-62e8d5d256b3",
        "indicator--0b35184c-3cc1-41bc-8207-c323e880bce9",
        "indicator--c4d05620-7bdb-4e9f-ac54-c2be5da3ba5e",
        "indicator--cf119544-23e4-4d2e-9b31-17f0ce7c118c",
        "indicator--c0f19adb-12e7-452b-94e8-291e51b6b589",
        "indicator--d407ba1c-ee99-45ea-85c3-c06ff1d8919b",
        "indicator--96d51bc3-c04f-4980-9730-936a7273149c",
        "indicator--5fa2e4ff-dc72-4ac5-a91d-2af73ec98722",
        "indicator--96199207-705d-4f19-959a-3d53c9a0a8bf",
        "indicator--37f34a47-2655-4512-8595-f8a36ef57e3c",
        "indicator--167ea377-be13-4be2-9604-8c4c38bf9696",
        "indicator--2f0b1494-8be4-452a-9009-2bb2d178ed35",
        "indicator--9dbd23d1-43e6-4105-a635-d98fc11c3ad6",
        "indicator--921f65e5-9c81-40ba-8fb9-817cce242cbd",
        "indicator--930e6fde-d931-404d-a526-690edf3a7de4",
        "indicator--52fd2c3f-0552-4f45-810a-79716ad92904",
        "indicator--b59de13e-7640-4ee6-8b7f-1b6ab30e572b",
        "indicator--be8e35c3-fcd4-4067-981a-e5725e0c3588",
        "indicator--8ec72244-f4ad-4405-bd30-41b8a266680e",
        "indicator--44e15be3-1a3e-400d-af4b-680fbb551e3e",
        "indicator--4d0121f3-73e5-4a07-ba12-faf0f8313983",
        "indicator--391bf55e-3166-44c3-823d-ff2c96e09f10",
        "indicator--1910728e-b527-47f5-81d1-383f8b4a1cdd",
        "indicator--e1c00159-feb0-4c74-b24e-088fe9839e21",
        "indicator--c0f3dba1-643c-45c4-8f52-e93d09580ded",
        "indicator--353a7e16-0871-4ae9-8c81-64699438257e",
        "indicator--164c359f-966e-4df8-ae3c-600cf131ecb4",
        "indicator--f45f6134-ac16-4551-9136-4aa6d166fe8b",
        "indicator--7a0006bd-c9e1-42c3-a0f6-a5d677d8b1a9",
        "indicator--1c778c44-03cb-4009-806e-5e95cdc84cbe",
        "indicator--1acfd67c-f4ea-43ca-9a29-3c62ac894f8a",
        "indicator--390ea71b-063a-4ebb-b53b-99b8970a6b72",
        "indicator--b877f502-a85f-40dd-b0ab-482f3399a22a",
        "indicator--3bdb222b-d635-41b5-9b3a-a60e00532a57",
        "indicator--8d3e4b62-1063-4c97-b6aa-ce0390ba3e36",
        "indicator--46fb3d34-342b-40d0-aceb-c87e5ce325b5",
        "indicator--f42f9d03-fa53-494c-97e4-1c2797fe154d",
        "indicator--618334f8-f4b8-4722-961d-3b1b3f892c97",
        "indicator--a683db53-99a4-495f-93e7-9c5a648c6251",
        "indicator--ca292ef4-d975-4b3d-a77e-043e838be33e",
        "indicator--11b43278-a96e-4ea0-8ff9-bde9b062a075",
        "indicator--38f16557-c30d-47f5-a100-2407378fdc9d",
        "indicator--d336f1f0-a3cb-487f-9e02-0aca4060251b",
        "indicator--f6b10150-9292-4d01-8689-b1df72b4191c",
        "indicator--3b345870-2f37-468b-86ad-ed9175c93a62",
        "indicator--3e2c89ca-335d-409c-b635-a4b4ec70306e",
        "indicator--9140320e-3c05-487a-bd87-5f62ffbff325",
        "indicator--91abe904-a74a-4fa2-86bd-7d94128c9186",
        "indicator--65fa5799-287a-471f-862a-031671125eff",
        "indicator--f0a2b573-95a3-4823-b7cc-0718d01533e0",
        "indicator--d567a83d-ba81-4a01-a4a9-3d477135dcfc",
        "indicator--832bdd36-f53c-4ebf-a8a6-9dd508b2ad65",
        "indicator--832aa1dc-a33c-460e-846e-e8b1bf22db66",
        "indicator--4c1d554a-b440-4cba-97b6-8f5d590837db",
        "indicator--554ed8bb-4014-402c-87b9-9dc71f24a578",
        "indicator--5348185b-646d-4b14-90c2-15a6f79c61ec",
        "indicator--5fb0a10d-98b1-4856-ad81-da062b34abec",
        "indicator--da8632f6-38a2-4705-ba2d-92c943ac3b28",
        "indicator--728fbee6-0704-40ee-9b09-ca2c2d99ad08",
        "indicator--e3ef5f53-b2d5-48fb-8720-68faaba7bde3",
        "indicator--0b941f9d-076a-4fd0-9664-79149b4a0c61",
        "indicator--e9df8461-52ba-4965-be59-9a8217b01342",
        "indicator--2249068a-b560-44ad-a864-cc10b38986f6",
        "indicator--4dd84991-ef34-48cf-82c4-ddaad8fc81fd",
        "indicator--f0d1a70e-b01d-469b-b532-2e0a9ae5081d",
        "indicator--7330c72d-a585-4b4d-848a-f43b86826036",
        "indicator--6f170d19-b760-4fd6-851c-0901c289fefe",
        "indicator--49f5baeb-5c51-49ef-a970-f1a75bf5b47e",
        "indicator--10687ca4-59c7-48e1-a65f-66b39ec1e41f",
        "indicator--f5796544-3100-473d-84f5-75d5b77e5a3b",
        "indicator--34502983-4b02-4b1a-835a-3c4a12e131fa",
        "indicator--d29ea6fb-039c-430a-adbf-8f2b7d99ba0e",
        "indicator--0548eb24-fdf0-4c0b-8d71-4f12927cdcc2",
        "indicator--749fd5c3-d88a-41b5-b394-e4a98592edd8",
        "indicator--53d17ed0-bea3-43a7-acc7-c51f9191933a",
        "indicator--a00ce505-5f52-4b3f-adee-37c4364ba5b8",
        "indicator--c6648356-d3e0-4f45-8d5f-f166044c564e",
        "indicator--7b0bf389-5edd-49ed-91f5-6933d2f66b4b",
        "indicator--95f30e5f-86e4-472f-bc4d-f1416c758ec8",
        "indicator--610eea6f-7b4e-4ad4-b9c6-f0d2bfcef174",
        "indicator--bd368653-9758-40d3-a424-f177c62d7600",
        "indicator--0f9ad332-84d4-4202-811e-12767118af78",
        "indicator--bb0afc63-7e8a-4ef7-89c7-ea123c581c68",
        "indicator--87f696c0-d7fb-4a22-98ff-baad3862f1fe",
        "indicator--5dc1076b-c099-4acb-8031-22246e358b6d",
        "indicator--28a7418f-7529-4008-8c32-872163704a4f",
        "indicator--1a9c75e0-f5bc-4d49-a2ae-4008e07c8df5",
        "indicator--b4266fea-5e24-41e6-b4e4-9d75c9a1d8c7",
        "indicator--cb8dd650-c2b1-4ccb-99f7-002fb2bba4dd",
        "indicator--b76f7624-cc90-4350-9daa-5efbe47b093f",
        "indicator--e1e6e3f8-e643-4a87-b715-35187adcf16c",
        "indicator--466c702b-674b-49f4-a269-73f6ccbcc2f2",
        "indicator--57f2c39f-debe-4cba-9bda-1931064157cc",
        "indicator--62701cdf-aa89-4d1f-a0ab-119b1c294d39",
        "indicator--9e376067-677e-4ac3-8822-335a76c8baf5",
        "indicator--cb5c7e53-f8f0-436d-9d81-80427400823d",
        "indicator--ab896f87-10de-4245-af16-f38c99ee94d6",
        "indicator--a1d7d8f5-5a93-4b23-8d4f-c78ab4cd26f8",
        "indicator--1406f9b1-5c62-40f3-997e-a70ca6e808f9",
        "indicator--8f84d249-f150-4d33-bf2b-110bb71a4cee",
        "indicator--a223ab13-2558-4c14-96ae-68cc9a8f37e7",
        "indicator--9dd1d4bb-45ed-4f3b-a214-db2e8c12dd58",
        "indicator--2825a5be-e878-4737-bb54-724a87c27600",
        "indicator--e4251a95-ca85-43ef-a738-6c4748ce64f5",
        "indicator--8dd8c9c5-1aa1-4987-8efa-de51a738f475",
        "indicator--667ca896-67fa-47ac-9bdb-6c82d6f20ca9",
        "indicator--fd0d6262-9c42-4d9f-9f40-46c62099a1a4",
        "indicator--02bec273-c43f-4178-8de8-66894786a296",
        "indicator--f6069f7b-736b-40f9-b9b0-45af81ba76ee",
        "indicator--9b5b60b6-ede7-4c44-9503-bb869105dd56",
        "indicator--560064df-2cfb-40e2-8af8-bc86df615393",
        "indicator--4224f695-37a2-4bc8-96ee-dcc6de3c8a3b",
        "indicator--8d9d5657-6a90-483c-bd1e-91954b8b35ba",
        "indicator--20ef3851-86bc-4061-9465-43c9b3c7ea5b",
        "indicator--0f56676c-4612-4fe7-8ef9-89627400d239",
        "indicator--93e08838-a06a-4a1e-8f29-2a7473d5ec7e",
        "indicator--9d7acb73-4b06-4f69-b6a8-ca543aa17cae",
        "indicator--9b78cb97-9204-43f6-b635-430089279553",
        "indicator--56474382-41f2-495c-b9f8-6a3a1f1044a5",
        "indicator--06bcbd4c-a92b-463a-afd4-ef8878557588",
        "indicator--301aaddd-2b77-4bbc-b06d-aeafd97c8fbc",
        "indicator--adaec145-0f13-41a5-bfdf-c3055fa493e0",
        "indicator--807cebde-32e3-40b8-8a17-5d4b64293ad6",
        "indicator--60e6dd63-225e-474f-9c8f-d6c574edd192",
        "indicator--096fd641-1529-4971-be0d-a1de640e09a4",
        "indicator--ff7c6c6c-6f15-4a73-b045-61340e4fc2b3",
        "indicator--282142fd-f5a2-486b-ab39-4a7219dfdae5",
        "indicator--e071440a-7205-475a-9b33-a727cbc610fd",
        "indicator--b255294e-bac8-4602-b935-ccffcb1c32e1",
        "indicator--df970ce4-fa6c-4381-8f23-d41abdece00c",
        "indicator--6cb93448-e7fe-4497-90ca-09aaab290332",
        "indicator--4322b169-9b5f-41eb-8c99-62a071c3322a",
        "indicator--87e86e53-f0c1-4d33-9599-9c5619def54f",
        "indicator--db787301-9c02-42df-ba2f-67af6f8de11d",
        "indicator--1623e66b-dd4c-434b-8049-e98573450f7f",
        "indicator--8337d2c3-6ae8-4261-8bc7-226e63a09452",
        "indicator--8f0d84b8-0692-4656-96b0-20ad9ad95692",
        "indicator--b1c59f00-25c1-486d-9da6-df9ab1b3227d",
        "indicator--2189844c-a6b4-48cd-bddf-d32ae1f43109",
        "indicator--ce6ae76b-3571-487b-aa0c-86d327ad2725",
        "indicator--ec0a70c2-78db-410d-af97-3ab7a95ec4f0",
        "indicator--da585f28-7473-4102-8035-e88fecb29aa1",
        "indicator--bf1982a2-68f5-4451-ac53-9b4898247edf",
        "indicator--791305eb-d1ac-4570-a465-c27f829ebebf",
        "indicator--c317f5d7-ab95-4320-a10b-36b4b51e4c16",
        "indicator--707c6c9a-a87f-448b-bea5-a45ae8828abf",
        "indicator--6d22ab3d-9c64-4ee4-a0bc-34a9fe0ccdac",
        "indicator--1846902c-f7f1-43d0-ada2-7243894a4996",
        "indicator--0dcae8e0-b3e8-4816-b423-ebdf80923e6b",
        "indicator--3577dd40-9127-4ff1-bbc5-9ca1553a8b91",
        "indicator--11f89c53-590a-48cb-a8ff-11615816e110",
        "indicator--3f400e42-cdfb-4150-b6d4-fb109eea3ba8",
        "indicator--4fb48577-725c-4400-8ae9-9e92240bb10e",
        "indicator--b33d09bc-de36-4972-b152-c665f1c76e02",
        "indicator--8e6bd8cc-11a0-431f-a5f1-83011bff30e3",
        "indicator--27e317ab-5210-44ef-a722-843f1b8da34e",
        "indicator--c9d3951e-90ca-4598-a563-b89c91277187",
        "indicator--633b0b50-3a79-434e-b01a-3f6bc37c76f8",
        "indicator--8f008bfa-530b-446a-a01d-68ed411cf885",
        "indicator--72ca4efb-ddb0-42c6-89f5-edaee13646c9",
        "indicator--589ffdb5-39d8-41c0-adbb-49ca0cd31d28",
        "indicator--33a69046-6ce4-4719-9ec2-031d2d1d8bfd",
        "indicator--6fe425a5-f90d-4d1e-a537-778ec3a9d290",
        "indicator--1154af21-0d58-4e7e-8eab-66573f8444e4",
        "indicator--b7c0864b-d865-4970-9b4e-b29e427869e9",
        "indicator--47bf310b-f3e5-4fb3-a8da-50161c230025",
        "indicator--6ce34661-942c-49a0-9521-8240d851047e",
        "indicator--62927db6-1af5-48f4-ac83-97feade90ed8",
        "indicator--8f6b965c-af31-4fee-b31c-bba76dc58c8c",
        "indicator--d7dc1d65-d30f-4ecd-91a6-728945586548",
        "indicator--b1b266b1-3eda-4984-894c-1b85edd1d9e7",
        "indicator--eb901f3c-ab7f-4165-ac2e-80735d7f4c17",
        "indicator--fe1984dc-ba7f-4e6d-a39e-901d993cdeb3",
        "indicator--2941c7e9-6756-45d7-93bf-c6b05ec74e9e",
        "indicator--e842f894-a7b1-4f0a-9169-f36c3d55bc7f",
        "indicator--5c0d0049-2f2b-4a54-b9af-d757e34ce2e2",
        "indicator--318dbfe1-22d4-42c9-a30a-fd79831183ef",
        "indicator--72128195-3309-41b6-890f-d4ed47669f04",
        "indicator--26406a51-9c03-4993-890e-0a6ae256c54c",
        "indicator--08e66a45-a46e-496f-be58-01b6c990d8a8",
        "indicator--3feb860b-cb87-4465-8720-3cd87626ab45",
        "indicator--7cc62970-103f-4a25-abdb-459f2c0cd356",
        "indicator--b45bebec-9855-4ced-a7d3-c364bc7b7b5b",
        "indicator--0d05a0ae-143c-4dd4-9c28-6a9518333e93",
        "indicator--4def781e-6398-46bb-bc5e-7ac737da1d1a",
        "indicator--e06cf1e6-471f-4059-aa87-495db52bc0d5",
        "indicator--aa00ea58-79e2-491d-b551-65a80a85c2f3",
        "indicator--877cee68-ca39-4816-8089-73f9dbe928f9",
        "indicator--39af5df3-ec33-4bc1-b0da-1116934d1da0",
        "indicator--c4215424-5d7e-492d-8316-757aadceb639",
        "indicator--5d79dcae-8b27-458f-b95b-7f18539aa950",
        "indicator--7d7343ed-c8f5-4c8c-a7a1-4d3c06699b6f",
        "indicator--6030dd0e-b1f4-4972-a141-bbc10d3a5f58",
        "indicator--1ff91c20-404d-4fab-bfcf-5e1283a1f954",
        "indicator--4a9323e5-6084-444c-923a-2d911f55d826",
        "indicator--30f94b75-da7a-4498-b5c1-f29968bdc7d9",
        "indicator--a3ea5869-f62c-4910-8c48-f795fd702909",
        "indicator--de0e4dea-7cc7-4aac-8a77-1d76e7681836",
        "indicator--00a7c61d-26a1-4417-8356-04ce7fea6b54",
        "indicator--1df5d378-ca0a-4644-9d74-5a07c7de2a0b",
        "indicator--5fc66f32-87c4-4aeb-8377-3d196fce3ccc",
        "indicator--045dad7c-abb4-4e62-aa28-c7578bea0638",
        "indicator--39bb51e8-9c01-49cb-a2bf-52c608a6f5f5",
        "indicator--9a3fd2a5-9cfa-4041-bb46-d8342029c01a",
        "indicator--b6786729-b884-482e-bbda-51fcb3c6c682",
        "indicator--91a9bf27-5b4d-4dd7-a89c-10a95d06d5ed",
        "indicator--7fd38837-1cd3-443d-9517-dc9c3ec2dfac",
        "indicator--8609c944-5451-40bb-88f9-3f47fb2a205f",
        "indicator--57bb14ad-ec8b-45ab-baa2-78d7be1c3093",
        "indicator--98a1b2fe-6712-471c-b517-22dcd2721616",
        "indicator--efef27b4-42dc-424c-91ab-bc7f5f59ea6b",
        "indicator--ba4d4eb8-ddb1-4297-b141-1b18c886e0f9",
        "indicator--9dd6c369-0412-4753-bccd-6141cec33fcf",
        "indicator--3c4b993c-52a5-42c6-bf90-6615408dd724",
        "indicator--5525d8be-337b-40ad-9d4c-26fbd9be54ad",
        "indicator--935837dc-8d07-487e-b21b-fc397251296d",
        "indicator--684271b7-ee1e-41f7-8857-0c07543c78d0",
        "indicator--8b552010-1b64-44a2-a8b6-61719bab0833",
        "indicator--a0edfc85-4282-4f97-9fac-e6526083ded7",
        "indicator--9d693495-d29e-49e7-8445-6cd18a0732e1",
        "indicator--5cdd0a97-7dc0-4555-9776-fbc07235f429",
        "indicator--68ef53ee-dfe4-4442-8bde-1b81e1f101de",
        "indicator--bc13c9bd-1c41-4fc1-98fb-6853a9ca390e",
        "indicator--55a96ce6-beee-4af2-9679-a4b95c2d0183",
        "indicator--4cd2e8b7-767e-4d7f-83da-cddd3a08af1f",
        "indicator--f39185a8-5b30-4a0c-99e6-37f4106e2a5b",
        "indicator--77866f86-b553-4864-9d8e-caa1f1848b10",
        "indicator--d2a9b7d8-c22a-42e8-a155-99d0ed9dab29",
        "indicator--5c3f30b8-f55b-4d57-bd4f-15f40343c3fc",
        "indicator--fcdd1432-eca5-4b3a-a8e8-61893268c1ca",
        "indicator--c1ecdc01-23c3-4730-82fa-0d49feca56c3",
        "indicator--47289d23-f5fd-4328-b6ba-a1baa23ebe02",
        "indicator--000c089b-f943-4d68-a9f1-a16a60aab744",
        "indicator--b4a575ee-b702-47fc-92c7-4c1ee2f9a092",
        "indicator--60b7d436-d4cb-4634-a555-39729a921e50",
        "indicator--0573dac1-2730-4e14-bc3b-fd68fe6274a1",
        "indicator--6c5dce6c-ed19-48f0-92b3-9a1367d426de",
        "indicator--dad65889-cdfb-4ab0-810f-7b8f3d3be04c",
        "indicator--063373f2-1573-4e8e-ae68-b4e4160d5c40",
        "indicator--6b5c1e40-25d2-459e-ad3d-efdc94a446c8",
        "indicator--8b9ca2f1-23c5-4a2a-8678-a2fc18dbd232",
        "indicator--d9a91763-b7da-4df7-9a6a-20df13d88e82",
        "indicator--8a98122e-4948-4378-beb0-c6a216f1800f",
        "indicator--b04c3d60-79f3-4d9d-8a42-9ced19181e9e",
        "indicator--42c4b1e6-fcb0-4fe6-b6ca-129b3c9f0e22",
        "indicator--568d6fd0-0c16-494d-9205-3633aa52369d",
        "indicator--9496902a-2171-4488-aab7-d77ce34fee6d",
        "indicator--343c7799-e390-4984-a710-6dc6c1b5dfa9",
        "indicator--48ad0cc7-526e-4b94-8eb4-ae230a8d1f30",
        "indicator--9115b390-35cc-40a9-b021-acdf738f363c",
        "indicator--e822f189-7b10-494f-bb70-5fd6bffda2b5",
        "indicator--fcffa55b-f9fc-4d0e-af0c-2b1b703dbc09",
        "indicator--d8724057-32e7-4cd8-83a6-3684eda92d30",
        "indicator--d15aea6b-5253-41da-a6e0-57ff323a85f2",
        "indicator--b3896636-1d0f-4369-a647-ec03d7df3638",
        "indicator--423b9d04-ef92-4aef-a3b2-fae5551cec86",
        "indicator--b6af5e0c-4fd6-4cc9-af48-611b2e5b58af",
        "indicator--830b36aa-7eef-41f9-987e-0002b8d1cd71",
        "indicator--4df895d7-0578-40b3-a24a-f942cb555f2c",
        "indicator--70a2b555-6af7-43c1-aba3-0471fbc6ed7c",
        "indicator--84b03f10-f707-4076-9b4f-5b3440814918",
        "indicator--01d3b55f-7885-48ba-b062-e60105c03ee5",
        "indicator--74dec2d4-43ef-4811-90ae-2375a8bf9891",
        "indicator--9e78babd-4f5b-45e1-a38d-ee1ca16e38e7",
        "indicator--614227ee-d9e0-40e7-8a03-2d88fb3cdfa8",
        "indicator--fd154c0f-25a6-4451-b516-ab4e9e2c6d88",
        "indicator--79bcf8db-4605-4c86-b914-d46ac37831c7",
        "indicator--36cae8bc-0042-4d75-b092-294178f6daa4",
        "indicator--b51a42e4-0c0d-4d04-adf6-189b2caf15ca",
        "indicator--87886f6e-7f78-481b-aa17-3efd1c16f85d",
        "indicator--990f098b-121e-4267-9334-3ba0dbcc02c3",
        "indicator--b809088c-08e3-424a-89c9-f483aec52431",
        "indicator--451ab3e1-17c7-4a7e-a3bf-6a87f2b418d9",
        "indicator--d9f7d2e6-3ac3-437a-bd30-0fd7b1378c35",
        "indicator--d626ca69-f55f-4074-b0de-ec5b705fc004",
        "indicator--7409454e-3e88-4350-87ac-57c8c40425e7",
        "indicator--2475f5a7-2a2c-49f7-8a01-22c61059d4ce",
        "indicator--28be7fb9-762d-438d-8ba8-a4d0577da6df",
        "indicator--af1499ce-d040-4078-8642-8877c1cdd697",
        "indicator--a6e78f25-fa22-43b2-9f3f-6a43014cd7cc",
        "indicator--7c32d52f-9ad8-482e-a036-f3e9035ad89b",
        "indicator--882751c2-5e7b-4c7d-a7b0-8543bc4064d2",
        "indicator--7507639c-33d0-465e-8bd7-68c9775a0079",
        "indicator--2a72af84-3711-44fb-b8cc-5b98c8063ca2",
        "indicator--2732fda2-26e7-40bd-8f9d-858941b662b8",
        "indicator--4c7c73b2-07cd-4408-afa4-95b59526e248",
        "indicator--b46035c9-0d66-41f8-9868-78a91aa23331",
        "indicator--a6e40527-8541-4ab8-b86b-2066b57bf643",
        "indicator--c5cd7111-fa91-4bf2-80c0-71c49aa8931f",
        "indicator--37a9e7d9-8c47-4386-a8e0-d6c674bff0a2",
        "indicator--120a2b53-3849-4645-8945-f9272b91e848",
        "indicator--9acf0621-787a-4d38-963d-2e770fc39f86",
        "indicator--b2a0ad21-69b9-4e36-8309-79196c73a947",
        "indicator--7afd4a07-3bf0-4a68-bf29-6c58d6b230cc",
        "indicator--758f8b14-2650-4131-8e33-1d14d3f221ba",
        "indicator--9b2d164d-caca-4bbc-af81-b85903a50970",
        "indicator--6fea9e9d-19a7-4869-bc60-8cac28132de9",
        "indicator--7529c801-4aef-4c3c-b42c-dc64d1eec10e",
        "indicator--f966f8e4-4141-43d0-9ba7-4dca435da7d2",
        "indicator--9b6f6355-c381-4621-a7f5-e5c2e6f1d017",
        "indicator--f400af7f-72aa-4946-a704-e8443a9a80eb",
        "indicator--a250062a-b8f0-44e9-9c6e-3237ee5b3be7",
        "indicator--616a9cd7-2b74-4a37-afc0-5c704fdcbce3",
        "indicator--061e7652-6eb6-4e2f-ad80-71297eccf6fa",
        "indicator--f342f73a-f217-4bf0-b841-d69ad407b78b",
        "indicator--78e11f5b-fcf1-47f6-9148-3e32a8175819",
        "indicator--29cf73a4-b3cf-4936-b5e1-a1e068a31328",
        "indicator--213bb2d8-8c08-47d7-8ec2-8c323dc58436",
        "indicator--b72e163e-47b7-452b-a95d-bac0dae4e816",
        "indicator--81d1b6e4-c80c-4407-8766-384a433bcdf3",
        "indicator--85b48f09-2185-484d-b332-9f99756b1dbf",
        "indicator--3122564e-bc6c-45b1-b89d-22183accbf3c",
        "indicator--d365dbb7-610c-4c87-90db-3cdc164c9a96",
        "indicator--7b658355-6d92-4ec3-80d5-273f72381969",
        "indicator--fdd85d94-7e3c-426c-add8-5376f216722d",
        "indicator--cd4db4c5-cded-4c33-9eb6-b7dfa2674841",
        "indicator--bd421caa-f48a-4e06-94a9-91e19015cef3",
        "indicator--7bff46d8-27a9-4d78-806d-4cf80ea7695f",
        "indicator--1b4378b5-66e8-4c97-a578-fdbacc82618c",
        "indicator--f2e0d695-1efb-4872-9903-6dc590872055",
        "indicator--7d7eb444-26f7-44f2-9212-ca11b12cd54d",
        "indicator--02885978-a19c-4db6-98a1-0f157b114e37",
        "indicator--95407864-e789-4ad0-8a28-c2503bc1a807",
        "indicator--34cd82a5-cbd4-4e10-ab09-059a08b6ec70",
        "indicator--2bde93f5-4714-464e-9722-76fd178018da",
        "indicator--8e511bfb-989f-4beb-a541-4a0e9a298315",
        "indicator--8db61f6e-a370-42ea-a79b-e250bdcbf4fb",
        "indicator--fbd2accb-3f1f-4ac2-97a8-d57ed26464f1",
        "indicator--e7fb201b-8b16-4aea-ab3b-ff37b3fb2ea2",
        "indicator--969cd2e5-02e6-4d76-a751-0be1308e1f06",
        "indicator--c71345cf-c6c6-4515-920f-07778643fabb",
        "indicator--e866a615-a212-4b50-9366-62ecfb06df53",
        "indicator--960063cf-1cd5-49ee-a0bb-2c098dc3813d",
        "indicator--7a6535fc-5488-4288-837e-e7d60c64b336",
        "indicator--73dbed65-1937-4cbe-98de-b237dc96ea04",
        "indicator--1044156f-95b4-4660-ac57-d92384c378b8",
        "indicator--181372c3-7040-434e-b0a6-b6f4453d962a",
        "indicator--8855f29c-44c9-4bde-b0ca-2a87fd457c6a",
        "indicator--8614dc55-98db-4876-885a-7402ad6558a3",
        "indicator--d4a40752-eb63-49fa-ae5a-d869efbb68c6",
        "indicator--5e8438bf-075a-4f62-a419-c14e2c055c34",
        "indicator--b33add81-207a-46f6-92f7-21a9b4676226",
        "indicator--ab142a1f-7145-4b0c-ae95-dd9e38c62489",
        "indicator--b766f486-71f1-43b8-86cc-c5642409d334",
        "indicator--7ebc6322-452a-410c-ae99-a6cd506eb5bf",
        "indicator--485cff79-30c6-4952-84eb-27a0a4785105",
        "indicator--fa7bf9a0-136e-4a4a-b671-894b05844784",
        "indicator--e7669f59-b43f-47ee-bb88-7d45f9832ef4",
        "indicator--d97ebeb8-e914-461c-be76-4f00b30719aa",
        "indicator--f5f6d043-2a62-486f-a235-95fdc9487cdf",
        "indicator--c9505ccd-2729-468c-b079-3e997ed5a662",
        "indicator--20377878-bc65-4184-9d14-b9a1578fa742",
        "indicator--a5c943ca-c13e-4a25-8fad-38d293738cce",
        "indicator--201b1b96-020a-4910-831c-cf8f145796f6",
        "indicator--b703f211-3618-49e3-ad07-d83355f6ce45",
        "indicator--56602ff3-6054-46a4-b9c7-7d3e0dfc9e39",
        "indicator--ea496ba9-5681-49cc-8b9a-a66caea6130c",
        "indicator--48badde7-7e31-4d0c-b047-f2516fd432bc",
        "indicator--4bc2f410-824a-4734-aa39-c6ff63ac496d",
        "indicator--15e01aa9-ea1f-4e0b-b7ad-c6ac82499f4b",
        "indicator--95be4e32-ffd0-48e4-9a19-9a5c7a7c6055",
        "indicator--8affc0ed-f9de-4f59-bbfe-a93757c915ba",
        "indicator--60b2bc53-ca8b-4f74-9c43-a2e3ecb34f79",
        "indicator--97e70874-6076-4627-844b-4f214a7d0e58",
        "indicator--8bb3732b-822c-45c2-8f24-64fc4bd71509",
        "indicator--9c4956d4-6724-4f8e-8d4d-86bbfd1af58e",
        "indicator--4c6d1150-050f-4c21-a29f-29979327d32c",
        "indicator--99428503-b124-44da-91be-f61c089a3a18",
        "indicator--31b81483-2128-4314-ae71-65ca834cca8e",
        "indicator--c343e197-c3b8-45fe-8e53-ea3be6be1abf",
        "indicator--3cadadcb-19af-4d34-8c40-b3fbcdc3c947",
        "indicator--520382f7-8d3f-40cd-800c-0470bb02fb6c",
        "indicator--6dfecc37-c91f-4c7a-b8ba-57ab139542ec",
        "indicator--16876d5a-4180-437d-b737-b0753aa0c562",
        "indicator--f8126f9b-dc50-4b2a-ad96-e5aa891ac5e4",
        "indicator--7e8cc4f7-521e-486e-9786-f88c41417ba2",
        "indicator--58a1cee7-e7c0-489d-b353-cd2ebe756aec",
        "indicator--0a076f6c-c7c1-49ac-91a6-1b16c21ef992",
        "indicator--17fab2c0-c0e8-42fd-8f67-c56e76a2449f",
        "indicator--32e53904-b6ce-4e3b-bb02-6435ec13bc9c",
        "indicator--bff4c7ab-8f61-4122-ae3c-6837dce53e5e",
        "indicator--2e71e016-3a57-421c-8129-7739a9e3d31e",
        "indicator--f38d7fe0-f202-4339-abbf-5c8f96bd04ce",
        "indicator--8c75bd43-73df-45b1-a14b-4bcd37800d36",
        "indicator--495e4692-5043-4b44-a343-2eabc6f48026",
        "indicator--53ce8a51-b71d-4411-a28e-0fa1c25a858f",
        "indicator--e5bfa6c5-d81e-4f7c-91d3-7eb9b86e0f4b",
        "indicator--bf6766f0-4d9d-4558-be62-06231f0e3e45",
        "indicator--c8ce7a9e-11d2-4642-9a4e-98d93c39112d",
        "indicator--8e2cfd3e-1117-49ee-b326-635fe7201d2e",
        "indicator--f89f61d1-3222-4314-9dce-643cd598b89a",
        "indicator--4077f294-2b00-432c-9d30-ed0acb56b856",
        "indicator--8f6f3fcf-8b10-4da8-a40f-bdb9273240bf",
        "indicator--3a7aa0a2-5f86-4e2a-864e-32d193954e01",
        "indicator--4487d9c8-da06-4066-a8ce-bc9b90c93bd7",
        "indicator--86e892f1-3380-40f2-baa3-70d7cb83a292",
        "indicator--e395f3c8-2007-493f-838d-24d66bf4b019",
        "indicator--f77331a4-1317-44bf-a471-b9269c8f7f3d",
        "indicator--673d0431-3522-4d2c-95db-417ddf34bc12",
        "indicator--2addf4d7-8a01-4726-a08a-0dba8bb04504",
        "indicator--585de1fd-bdf2-4f51-a722-6d2fa72157c2",
        "indicator--c3fc4835-4417-4089-9fd9-ef8647d513d8",
        "indicator--1e2d4eed-c22d-4eeb-aff7-b6998ec9f49a",
        "indicator--2c286635-4ac9-4ef1-89a1-7c921cf1fa73",
        "indicator--fecefb12-a96e-4a51-8f65-66185673e353",
        "indicator--45ab3b90-033f-450a-b0d3-4cd2600d275b",
        "indicator--7876cd51-7f7a-4b07-adb3-dc328aa3b523",
        "indicator--fdb51c51-6884-4945-a242-a80b680cac89",
        "indicator--d9a400c9-f679-429e-a8a1-f51e520a683c",
        "indicator--f46d730b-99c1-42f8-82f4-5ec2d2ba9c1e",
        "indicator--900a1b90-c38f-41b9-bb28-a0eef43e905b",
        "indicator--5ae7d2c1-3f4d-41df-87a1-3dc605f40aeb",
        "indicator--e64b603f-e851-4603-aca2-20ce870b09f6",
        "indicator--bcda6eda-cba1-4347-ac1b-cf184eadfed7",
        "indicator--74d4d780-60e9-4989-9ef2-2a11f5895e1c",
        "indicator--73f7a24e-d960-43e5-80e0-210c1ab6ce35",
        "indicator--bb178bda-c25c-413b-b641-fd73b3fb13b0",
        "indicator--b8794f97-2071-4c95-b50f-0b9785175733",
        "indicator--496289d2-79f5-4904-961e-d3e03b5549d8",
        "indicator--9776beb6-7b91-43e0-b5f7-aac0ae4b162a",
        "indicator--37223960-29a8-41d2-a0de-3d50f5fdefbc",
        "indicator--29a9c63f-0d7b-46ad-8ba4-a9adf2f6097f",
        "indicator--5ed391d6-686a-49ec-b900-de578c232106",
        "indicator--4b0444f0-4858-43de-a53f-4cd1e8f0b136",
        "indicator--e517a848-c5f5-4c34-a915-10d941bb0de9",
        "indicator--74181c4b-3826-4b90-9f62-dc037a0c0fb8",
        "indicator--b287e798-0363-4eea-a389-a0de67314c95",
        "indicator--3a7c8631-a04d-4b6f-bead-23f21a724ea9",
        "indicator--59ad9476-4aa1-42b4-88cc-b349bab83244",
        "indicator--f7a2d96d-04dc-4da5-8dfc-03029bc8e794",
        "indicator--e7d99d17-2809-4aa4-b36f-6964e18e3bd7",
        "indicator--c3713c0f-6a6d-4429-b360-6784fc07d96c",
        "indicator--3f72eb9b-f12b-44b5-9139-69450bcbbda0",
        "indicator--71a33d9a-ea64-4c76-94f0-c7f09a27c746",
        "indicator--d1043822-6afd-484d-9873-d7c48108682b",
        "indicator--e3893a71-8c21-4b8f-946d-c420fad96a86",
        "indicator--2f9cd963-1ca1-4aee-87fc-e6b1a25b1551",
        "indicator--f9339b89-773d-4823-bed8-ed832d937dc7",
        "indicator--ce810f57-9c9e-4e1f-9c14-df69c1906a18",
        "indicator--8b69c0e3-52f8-4664-be44-9521a768150f",
        "indicator--35a1abc8-454a-4cf2-83c7-16d755efa18b",
        "indicator--41915bac-7ca4-4f77-a7db-b1577738798a",
        "indicator--87ca6ef3-59d1-4432-bb8d-4065e5a8935e",
        "indicator--34a40395-f1c2-4540-866b-6ddacdaa5cc4",
        "indicator--86afdaf8-2fb2-4316-82ff-7ace04dd6b81",
        "indicator--4072bef7-9900-4fec-9671-5f667f7b029a",
        "indicator--e4fe58ec-d6e7-44d5-9baf-901e7c62b1eb",
        "indicator--eb9a35a4-209d-4688-bc03-92105c073af5",
        "indicator--de599150-ddb9-4e4e-9028-67b1bafe6d5a",
        "indicator--f009e501-5d49-4932-85dc-ed620b490a88",
        "indicator--f40042e4-3a6f-4bd8-a7e3-fd7fdb4c6c36",
        "indicator--5b16f8a9-fc9f-4d22-9d72-12d680d78b98",
        "indicator--e4253d39-5664-41af-8a5b-1f0aaeeab9f0",
        "indicator--627a9897-3e98-4193-a431-a5a459263607",
        "indicator--4fd07eb7-d4fa-4903-90f9-c4ddcd1a0f28",
        "indicator--cf9957bf-c06e-466b-9d56-e786af86f2b7",
        "indicator--028ab0f4-a750-4b1c-b980-ca10116219aa",
        "indicator--45eb9958-29f0-4cd5-9885-ee201f49a9a8",
        "indicator--fc733ad0-906a-4e2a-9a90-70e2190d57c0",
        "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
        "indicator--70af2251-9d2b-4721-97a5-d86fcda4eaee",
        "indicator--4c1378f5-e430-494b-b40a-86e0e9e5463a",
        "indicator--331692a7-07f9-4d57-b65c-9ae79eec2918",
        "indicator--f862750a-1364-4ac3-8d4a-d0cb0fca9f7d",
        "indicator--3a5c4bff-63fa-4134-8d3e-0731f1ba8a1e",
        "indicator--08c6497e-0dea-4bb8-b268-a93fcfc634a9",
        "indicator--9b50d258-edf8-4ee6-bac0-8d0d895fa033",
        "indicator--b31aa61e-a702-4aa5-ab4d-de4f4535c2ff",
        "indicator--16759fcb-5786-4a98-9eec-ef2781531012",
        "indicator--51133b72-ae9b-49e9-a894-4893e40a069c",
        "indicator--b52430fd-ff91-435c-ad8b-0791ea446816",
        "indicator--59b569f6-8aea-4273-b078-ca35699bbc35",
        "indicator--7faab1fa-8822-4d41-82ce-6547ad8e6aa8",
        "indicator--28be8f39-fbe7-49b9-986b-13a7c6a5bff9",
        "indicator--28bcfac4-4f03-4912-a80b-82641d82a08b",
        "indicator--3d3252e4-26e8-4999-a79c-8eeae2d7e5d5",
        "indicator--52560c72-a07f-4e21-bcfd-b0da6a81a7e2",
        "indicator--56a09db2-bcb2-4926-9403-bc627cdeb01d",
        "indicator--2bd45788-a204-40fc-8333-8582f6d91314",
        "indicator--4107480d-6c65-4246-83b6-b69afe399b53",
        "indicator--560d6c2b-3943-49e9-8f6e-7123986b3078",
        "indicator--d2b2b82d-975c-4223-83cb-d2466d555d6f",
        "indicator--c119702c-2f0f-45f3-a635-2f3a618375b3",
        "indicator--964f8e6b-a4e8-42e2-921b-70af00cbe8d8",
        "indicator--fed758bd-83c2-47bd-b7f0-5c8e92e8791c",
        "indicator--1a05bd00-fa1b-4855-a16e-ccd8c27eb39e",
        "indicator--d31f1b3f-9489-4dc2-a5a0-f4bb2e28fa55",
        "indicator--4bbe1f8f-e066-4c59-9d01-447e001d14fe",
        "indicator--36d64297-2bc6-478a-ae34-b56629ae488c",
        "indicator--8945da1e-ec06-492d-891c-0caf72c5e4e2",
        "indicator--ae8f8890-dd62-4e35-b954-ffab9c7631a4",
        "indicator--1d232ca8-16da-42ef-a66d-da6f38e7b655",
        "indicator--2c9dde4a-5ba1-4b84-bae7-3a5d0d44e170",
        "indicator--a4d7eb29-14ea-4a84-b059-e52785d0575b",
        "indicator--4c312572-2a16-405d-af3b-35b6b6813037",
        "indicator--5831a180-2afa-4668-a6fa-5705fc2440d6",
        "indicator--eb0dc6be-ddcf-4c1f-97f3-132846a95056",
        "indicator--833c2cfb-d125-4cc0-b939-49c78df478bd",
        "indicator--33bd6af4-924c-4ca1-9916-f921bd2759d0",
        "indicator--129cf914-e1b3-4a25-ac48-8feefeae8f81",
        "indicator--eb7275d4-2761-46df-9543-97ade062d365",
        "indicator--897fe569-f9d1-400b-b0ae-2e35791bf228",
        "indicator--2e378204-6fde-4271-b5ef-51d3d33242ff",
        "indicator--31a0ab3e-13ab-4450-860e-4d403ca48a8e",
        "indicator--7364d9ce-f4ef-4b8a-b570-6b01fe682cc6",
        "indicator--1db4f2c7-16db-4ba1-bc7e-2011c1f4f2b1",
        "indicator--a94432fe-add7-4b52-9c9e-e8c8fe447d78",
        "indicator--fcd39a87-d1e2-4924-bfd9-05ae1fcf616d",
        "indicator--378434d0-c1cd-4d24-8f21-fde2dcdbf805",
        "indicator--5323ca11-2fe6-4e7a-adb4-7524e057d3d0",
        "indicator--fc2f47ea-db0e-4f12-8882-62aaba300053",
        "indicator--227b22b5-9221-4cd5-8720-2577f62696b5",
        "indicator--afbc3863-70be-47b2-8e93-178f5a0a970a",
        "indicator--3eed06f3-2fa4-41a5-89b3-fb65ed50f475",
        "indicator--7d377912-d211-4ed5-991e-eb1270b01c8a",
        "indicator--8008d310-191d-4ad6-ac1d-9623bd0fa539",
        "indicator--e4dc064e-0c84-4744-9fb9-98914006340d",
        "indicator--33a262c0-73c6-4d4d-8fca-0c8a15f1d822",
        "indicator--60a96be1-8bc3-49ec-9e30-8241f7247dfa",
        "indicator--66479083-91c5-4452-9f17-67ffbd000f45",
        "indicator--4a16580f-1cd8-4b29-ac2c-c385f827e070",
        "indicator--70930973-e77c-4966-9dc1-680a07104b4b",
        "indicator--60bfa7e3-8ebd-4188-bc02-ae055eafee3b",
        "indicator--d76abae8-cba0-47b2-beb8-28fa18183250",
        "indicator--9751d611-45f6-468e-b8d7-6af3b36b2484",
        "indicator--78a39a2d-903d-4db7-b557-aa56d2e3d254",
        "indicator--a8661e6f-167c-475e-9e2b-ac76b81e5b54",
        "indicator--2b114142-0c42-4a9e-9cae-019580230676",
        "indicator--3815644c-6f31-4907-bf58-601ce56940f9",
        "indicator--5356ac4b-8208-4b40-b2a1-b031ab2066f6",
        "indicator--8c4cb910-9a56-4f6d-a25b-0c8cfeed0f31",
        "indicator--f41364bb-ad08-4672-a3ce-db472a94b7a6",
        "indicator--dd67f146-9fab-4b29-b178-3f9d94ac550f",
        "indicator--1e8979c2-5808-4f18-9abc-0a89caf84de2",
        "indicator--5b3bf0c3-91cf-4cf5-bf81-a08a11be79db",
        "indicator--c794f9b1-188f-4c36-8c38-ffdddf38c9d6",
        "indicator--c4f260b9-2c5f-4efa-922c-7a782538c0da",
        "indicator--99d791ca-d767-42e0-8328-310559b3f317",
        "indicator--ca601999-ecc5-4cbd-9d13-50aaa8665547",
        "indicator--446ccf76-fe21-4bc8-a471-52e3c266b06d",
        "indicator--2a636acf-5514-4b14-9091-f83d77085cdc",
        "indicator--6b84815c-28d2-41d0-b297-88812757222f",
        "indicator--73aa9c21-9399-4d8e-afb4-9b4ed1c67d6c",
        "indicator--38453f77-9097-4aad-a13f-77a21c90d2ab",
        "indicator--940613ac-f6b0-4b36-bdac-b73178d827ff",
        "indicator--2ea6b2d9-f65a-41c4-b148-588f4ce0b6a0",
        "indicator--0b72d7b1-d807-4668-a76a-9a33b4f0d957",
        "indicator--d3c53a3b-c95d-417d-820c-bc6ed85d8839",
        "indicator--0566bbe9-da0a-4c85-95f8-d224f83debbe",
        "indicator--e56c6abd-bfb1-4b11-9e55-b9400fecbca0",
        "indicator--88cbd794-02a3-4f00-9d85-5cd2e36e2228",
        "indicator--0aa6888a-0674-4664-94a0-a3414c1d6bcc",
        "indicator--1d9a5340-4b2f-47c9-8660-94021a4fe837",
        "indicator--e882458e-b812-4802-bd3d-f847611050c2",
        "indicator--355b72bf-26be-48c3-a722-5b0c0349ff89",
        "indicator--ac82624e-f0e2-4abd-8822-cfaeff7be655",
        "indicator--f981f679-7d7e-444f-96cb-ca2add7fed3a",
        "indicator--a31b6d67-ef2d-4fcf-8e4f-e6deb065abf7",
        "indicator--f6f6a105-2860-46d8-8c7b-c21e76afd043",
        "indicator--d1ecc734-6e5d-45c7-af21-4c9ef521712e",
        "indicator--2654d5f2-1c5c-40e0-af47-7cba998fd0ad",
        "indicator--a4d2fa03-2b68-4f75-bb8a-3f7640dc9373",
        "indicator--61f99a6e-60a6-473e-9001-2794dd19d509",
        "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
        "indicator--8dc5bd1d-74a4-475b-9bb6-e4e5cd85c1c2",
        "indicator--a936ceca-9813-4121-ac03-af1614205c62",
        "indicator--3b1d14de-7eec-4205-afd7-cc9120453e62",
        "indicator--0e9f34b2-da10-4853-abe5-b3e0b39c3829",
        "indicator--1e5fb95e-a4a5-48a6-8ac0-3567964dbe77",
        "indicator--d5f66a89-aae9-46c2-9ee8-b2606a72431a",
        "indicator--00121278-9a11-4ceb-9f47-3a4470f83ae1",
        "indicator--54977b74-c8dd-42c9-a4a7-99200e40c324",
        "indicator--df9b3e2d-7d8b-472e-b74b-b52f674a8ee8",
        "indicator--a869a5e0-8ee6-4e39-a1f8-6cdc2f7bc111",
        "indicator--ea0dc298-b1c3-48cd-8bc0-02b0f436bdf8",
        "indicator--b944679a-9848-4865-9e69-504803914620",
        "indicator--6ddfe3e2-638c-436e-a070-ba31e3dee516",
        "indicator--a44ba225-3e52-4357-9d75-f5dcd6045e4a",
        "indicator--fc9fae7c-bfdd-4839-988a-34e1b546c5c0",
        "indicator--1937c082-f160-4301-9200-7cd564736055",
        "indicator--5cf04554-302d-4154-97a4-863cda5f28c1",
        "indicator--d1f7f89b-6e3f-445b-8839-0b4d3db62f75",
        "indicator--03f75d29-f9bf-47f9-80ce-5e973df350f3",
        "indicator--7d68caaa-c6df-4beb-be83-178bd38832fa",
        "indicator--bb1a1ebd-7b65-4b82-a44b-83d0452499a3",
        "indicator--54f6595f-b10c-4c98-95fb-b9479eb14bf0",
        "indicator--e8cfb470-8823-43c0-bc89-cb068afa9063",
        "indicator--dfb7b648-32bd-4dfa-80cf-ca98480f5822",
        "indicator--ab432192-90f4-4470-98a3-be601834c84b",
        "indicator--d1a10d69-ac42-4e8e-a4c1-13442e067802",
        "indicator--9f598fb9-5522-4f2d-a914-a95abd6f04d3",
        "indicator--99d8773e-c1ef-49ae-9f17-992a6e20bb06",
        "indicator--61a40e57-20cd-46a5-b550-c45c66a13fe4",
        "indicator--b0fed5ea-9d3e-4d16-a32f-b1faabcb592c",
        "indicator--b9e6416b-7984-4389-baca-d0b564e5bdd5",
        "indicator--7ff3f7ff-b831-429e-be90-1f08cd5fde2b",
        "indicator--33f8c1e6-ce59-4dc5-8bf9-ca5d4eec9548",
        "indicator--618a0144-d5d5-4538-b42b-cf3b8353a16d",
        "indicator--103d22d4-78c0-418c-9093-e427d8bbf901",
        "indicator--f79cd7a2-2cda-4252-b476-a733bc6a8451",
        "indicator--6075b5ca-762d-40ac-b862-3045d87e08c1",
        "indicator--fa3a2920-2d85-4fd0-8788-03eb3602cc0f",
        "indicator--d230005a-d76e-4cc8-8f93-74081079eddf",
        "indicator--1d6f6776-7b87-4b90-9f56-977ff79332e4",
        "indicator--8e40d7b2-206c-46e0-9c18-6cc2c52475ea",
        "indicator--7508e8f5-990e-4868-ab18-07096e99fee3",
        "indicator--0adc0819-8280-4c42-bb3c-f09e817d824d",
        "indicator--d5c4705c-c0c6-47b3-9669-6290bf4888e0",
        "indicator--ffbc4f27-88ca-4ada-a070-69105441b2af",
        "indicator--838ab9d6-891a-4006-98e3-128cd8eededb",
        "indicator--80f736a1-6157-4602-8750-678449006c6d",
        "indicator--75dff00f-72c4-44d7-9887-7228de34b441",
        "indicator--1badad10-6d46-43b9-8cc9-c6054907ff25",
        "indicator--02cb716d-9f53-4192-89f2-d1dc6eef00f0",
        "indicator--aa6ad04f-efae-4382-ba7b-4da0d44646a4",
        "indicator--ddd49b1a-926d-4d41-a3da-da26b6e976c8",
        "indicator--740a5e4d-07af-407f-bbd6-2be8d0a5d756",
        "indicator--0e62dd35-61a9-4824-ba8c-5b1c756a125f",
        "indicator--38971095-3b51-4c99-bf05-5036f1c7160e",
        "indicator--04bd3901-330e-4693-8ffe-beab8a76c1d4",
        "indicator--da42b936-880c-4b46-a4b3-0979246c3d22",
        "indicator--726ef3c2-49c3-48e3-b2cc-c7d0dbfbbbcd",
        "indicator--06889dc6-e5ff-4bef-ad1a-0cd122891109",
        "indicator--3cdab93a-a535-49f6-8e33-e6d104324680",
        "indicator--91dd2e82-abc0-4bcc-a2bf-1cc7c324695b",
        "indicator--94a7dd90-10e5-49d3-ae27-9773d94376f0",
        "indicator--84d28b5a-f1f2-4f20-8b9b-ccccbc051048",
        "indicator--ac019416-600f-4085-8baf-baa45c2f782c",
        "indicator--faacee42-a7ae-446c-b773-e3e44df021ca",
        "indicator--2fabc3f9-1f3d-463f-8de1-16d6251c6f1c",
        "indicator--a68e3c4e-e20b-4fd1-9fc8-b4e4797c6611",
        "indicator--5fc1307a-fec1-49e9-b6d9-6accec05049c",
        "indicator--92c1ebb7-43b7-42de-89ca-c917542dfc9d",
        "indicator--101fb7d8-7726-41b3-b694-45f6d7039b2d",
        "indicator--e4c9187a-d97f-4a16-a3c7-43142d47c545",
        "indicator--df776ede-e287-4408-ad8c-6a064c63244e",
        "indicator--d0e2f365-cef7-4804-b01f-c0892d684a06",
        "indicator--a27d0e8f-bb93-4c4a-b43e-d8763ea58027",
        "indicator--ea0a4f7e-90ea-4bfd-a802-0549eb2b040d",
        "indicator--06af4496-5008-4ecc-92eb-47a15f5c7740",
        "indicator--2469d6c7-8e68-4c87-a330-9fe0698d96ba",
        "indicator--3561d52e-fe4a-46d6-9806-3bb06f997135",
        "indicator--c65c31e2-a033-4b29-96f0-2d67a4304158",
        "indicator--993fb19b-b458-4071-a280-efe98b61b964",
        "indicator--4bde9cb0-44dc-495a-85c3-d9fcd913b946",
        "indicator--9ba9737f-816b-4dbd-84ad-b88e03a357b0",
        "indicator--e8f818d4-d7ed-4fd5-b703-5e32971da862",
        "indicator--e3b5d309-c4a8-4333-90a8-53fb1ec1baf3",
        "indicator--5ae53706-44dc-49d6-9e35-548981f5bfad",
        "indicator--fc33409c-63fb-4019-8000-c30cc5e8aece",
        "indicator--a576b5d6-435e-40ff-b182-2296995bfb95",
        "indicator--5e8460a3-c77a-4390-a3b7-b02d5b8846a7",
        "indicator--fac6e0f3-5c9f-492c-8b83-8148f95e01a2",
        "indicator--2167f337-296c-4efd-a52a-310b9d994f16",
        "indicator--f3135852-7ad2-4dab-89ae-f501a23a8133",
        "indicator--5f430470-e844-4823-bd8a-85f00462ac5b",
        "indicator--c0b1475e-3dc1-4f76-ab3f-9b1aa7f19300",
        "indicator--28c5a086-71d1-4240-ac47-76937e821297",
        "indicator--b1bebe09-ba39-45b7-9394-6e456148cfbe",
        "indicator--dbd9aa87-3993-4562-912f-78d8e86d130e",
        "indicator--27aa797d-91e1-4343-b2ac-ae290b3c715b",
        "indicator--d87ef18d-68ed-432f-8384-6a28ed0a5073",
        "indicator--4030ac0e-49b4-4854-9981-a48c7878c084",
        "indicator--ef1735f0-49cb-4dc7-a344-d169cf45a6d9",
        "indicator--cf01ef7f-97ec-40a1-b1d1-fa16ad9dd286",
        "indicator--881aace8-2c43-4812-b44e-6fe1747d6215",
        "indicator--f1543d17-f754-4d20-9ca4-f6645b6d02f4",
        "indicator--6bb36654-f424-4617-90de-ff9d4f63a5f1",
        "indicator--482dd06d-1e15-4c94-aa44-f287547d49b3",
        "indicator--ca810941-3e7d-44b8-befb-368bedb0a526",
        "indicator--21a1f1aa-8f1a-4186-b5d8-64754807c750",
        "indicator--86002e49-e8de-4bf8-af2d-aed4efc58f09",
        "indicator--23001317-fcc0-4bb6-b527-fae95d992dc5",
        "indicator--83ab7bbb-c093-4812-911a-5939f7b7aa92",
        "indicator--e2428eab-0542-495a-addd-c3f1cf8c8257",
        "indicator--8a3a13e9-0c16-4c96-bf54-7c434467b63b",
        "indicator--c9757b0c-c0a3-4331-be96-d5bc24cde493",
        "indicator--c1583308-06cb-4745-83be-7630f1bcb62d",
        "indicator--c3dd1678-86b1-4216-b1cd-4d3f61b9c6b5",
        "indicator--05e89785-9259-4965-a22c-d7c701cc8664",
        "indicator--81aff6da-6d83-404e-82a5-759315ae51f1",
        "indicator--0cef2854-3b23-458c-9d1d-9c5b8a9c8273",
        "indicator--f04f5c44-9d83-4dc2-8548-e0f2d72827b9",
        "indicator--11519f3e-2f61-400e-94c7-132226b5c570",
        "indicator--cc9a5999-b6b0-4d06-92ea-9db7bbc9b02d",
        "indicator--4cd1a94b-69a4-4adb-a6ae-9da6b159310e",
        "indicator--bf94618a-7774-4c75-90aa-1c5914e34e14",
        "indicator--cb084b89-1001-47ea-9d04-d004a697f1e5",
        "indicator--ecd3a7b4-e85e-4e0e-828e-88c5c22c365d",
        "indicator--e3f12d52-cebd-4cc1-9a03-7643cfe833cb",
        "indicator--0bee385d-ec88-4879-bdc3-61737e9cefad",
        "indicator--f99373f9-e55c-4e3d-bc27-c7956e517813",
        "indicator--c69652e8-ccb3-46bf-b7b8-0ef969d2fc42",
        "indicator--9736f0c6-a888-422f-a9c5-1f381e316495",
        "indicator--b6bbe81c-0827-4bf5-8abf-2a759837d861",
        "indicator--6325b1c7-a114-4c42-ba1b-bb177cab7084",
        "indicator--289ab197-8ee6-4241-8422-6702cd0e112e",
        "indicator--0736f829-40da-45be-a194-c3e1828a4089",
        "indicator--47aa09e6-ebc7-44e2-9503-5283cd5c8edc",
        "indicator--a0a67e5e-a24e-4879-9bfd-75d95ca2bf1a",
        "indicator--d09439b0-ae44-436d-b54e-3076961a672e",
        "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
        "indicator--6f78f905-65d0-4084-b436-6607f125bb0e",
        "indicator--3bbf89d2-406f-411a-b151-2cad493fc752",
        "indicator--a4cb8b01-0110-4d04-ad92-0bfcb1f708f9",
        "indicator--da553492-e2e2-40ac-a481-9535cbb3b14b",
        "indicator--9d4c18fc-d661-4db3-b3e9-fd644076dc1a",
        "indicator--5ef70a52-39d0-4097-9295-1bcf3c3c1f82",
        "indicator--405e8435-d142-44e9-b42b-a2b0b4f1f14e",
        "indicator--98ed9db0-fe3d-4edf-8740-fb420b703476",
        "indicator--f1cd8000-861f-4d8d-afe2-526b559d5ba2",
        "indicator--978f7e33-ed82-4416-ad01-8fde504d1f46",
        "indicator--e53abcb7-75fe-41df-ad17-7848919b7b8e",
        "indicator--f77678c8-a4c2-47c0-854f-d1a4bc53eaaa",
        "indicator--bed5c006-4742-407f-a99d-b7e6fc9cc18c",
        "indicator--eade05ca-73e9-4d2a-9923-0d0f3857aa80",
        "indicator--c1745d6e-492d-4319-8c7c-321bd57cd65f",
        "indicator--508c86fe-d0d4-429c-aef4-931a6911118e",
        "indicator--f0dd478a-74db-4f67-a823-e04f6d4b965f",
        "indicator--45b95fb3-bc2f-4b01-87e9-daa5cc92a5c6",
        "indicator--36afb7da-5833-4a6a-8edf-b24fbdc03e1e",
        "indicator--3f9bb0f1-69af-47ee-9736-6f39161e4fcf",
        "indicator--2b574a94-0e49-4aa5-9acf-6aa0a9dfccf4",
        "indicator--733909ad-e7b8-4f1f-ba12-9c6426b45650",
        "indicator--93ff68c0-c378-4373-a486-fee68457e4a8",
        "indicator--f14b01bb-c6b2-4487-aac1-72b36bcf2938",
        "indicator--12b3ddb9-0575-4366-abe6-8b02a43f01c3",
        "indicator--81562848-f6ca-4b21-85f7-04bf39ced5a0",
        "indicator--24821e57-4519-4cab-b912-4ff1c39d429b",
        "indicator--366fcfb2-1aac-4d2a-bf4c-f03f882c942c",
        "indicator--6ee23d63-dbb5-480e-bef0-8e769b803fc7",
        "indicator--2d38ddbb-02c5-4285-a139-1fc91253bd03",
        "indicator--54c90c04-669f-4601-a4f0-2df55d462d42",
        "indicator--f289614b-d0b3-4e10-862b-e1d5f7c29a87",
        "indicator--8815c1db-2b24-45aa-ac71-ac66f8ca8e23",
        "indicator--80015fb0-d1a2-4728-987a-9d12a1c853e8",
        "indicator--bf38fdc8-ca15-40cc-9cf4-36735dce4cad",
        "indicator--5776b50d-a525-4bec-8e10-2b61c7498fb2",
        "indicator--f0c1d63c-aa3f-4bca-b37d-e16453a4da87",
        "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
        "indicator--1d4d9506-5b80-4513-84fe-9bb65a55280d",
        "indicator--3af0758f-eccc-40b0-b4d2-048430c3b060",
        "indicator--db15ff1a-d808-43aa-99c4-55a0809dcaa6",
        "indicator--d81624f0-5f4a-486c-8863-b475b2aa1fbe",
        "indicator--21729182-c601-4e0a-ba02-7bdaf29757f8",
        "indicator--01652781-f791-46b2-a1b8-6b57df3dfb52",
        "indicator--e5e5052d-0315-4903-b94f-5ec61348d147",
        "indicator--7a8bca9e-496c-4bd7-a506-ff4d4d188ed2",
        "indicator--2f70001c-d492-4eb1-b8ef-c39e39bdc2e4",
        "indicator--32e95d2a-13a6-456d-94b9-1586826f518e",
        "indicator--3e9c3e17-e322-4b18-8d47-25723e044447",
        "indicator--99d4358d-1325-4028-8858-f67c6f4d2e1f",
        "indicator--bb041d3b-cc8d-432c-bff0-309071c26eb5",
        "indicator--7f6d7fe2-4a71-476e-ab55-65bdfb58b266",
        "indicator--0f188af2-6634-44c7-99d6-853611309c91",
        "indicator--1255fbba-f5f8-4511-bdd6-18c6ee39f9a4",
        "indicator--a4911c2d-1bf8-49a5-8983-db9e2f80d674",
        "indicator--e214f286-71ff-4637-88b2-1991f9c857dc",
        "indicator--62b59177-89cf-4234-9946-e8ee6be5b412",
        "indicator--a3c503e3-4130-4191-a369-8c93155f0a09",
        "indicator--d9bb60f7-517c-4ccf-bc16-467f6c66ae5f",
        "indicator--a1a35f5a-2d1f-4272-83aa-6f2a76909cd0",
        "indicator--fc0aca0e-1bf3-407c-addc-249377a97203",
        "indicator--32e45485-ab47-473d-93f1-c315594f89ea",
        "indicator--35d543d4-e1e5-4c34-ac92-71982a623775",
        "indicator--298f543f-6eb0-448c-8e89-298ac1ed2348",
        "indicator--28ec7662-2b9e-4bea-9d47-eecc6de14ada",
        "indicator--5ddb96f9-07fe-4a64-90c6-3c66f97ce512",
        "indicator--685d94ae-f5a2-4e77-8e05-ec5e8a40d5e0",
        "indicator--f84edf69-ae27-47fd-9013-954a6f53caaa",
        "indicator--0a770863-a4bc-4bcd-8bc0-c437858c7895",
        "indicator--ce0df446-ca6f-4afe-80b8-99510c8b364d",
        "indicator--afc6b207-6083-49f1-b61b-262f098ff38f",
        "indicator--71a665a8-3386-402b-84ce-5e09fab795b0",
        "indicator--61a51444-cd3a-45d1-8a89-8026dac2340f",
        "indicator--c0eb9284-fba9-453a-9d26-3825a33e8e96",
        "indicator--0b3291a1-ea84-40ad-aa8e-777658085622",
        "indicator--d407c5fc-20c5-407d-a347-070afde72149",
        "indicator--c0e0e109-fa01-478d-a2d4-601a955fa114",
        "indicator--7485b147-372d-4d48-9a70-0bc527f122bd",
        "indicator--f25c684d-326b-45e0-a36f-8f2ee7c113be",
        "indicator--fabacebf-9e69-455c-b78d-2c3673c0e81a",
        "indicator--352f86c4-ff1d-4b61-b70b-23f02691b87e",
        "indicator--b916e990-c267-49a4-998e-8bc443da2938",
        "indicator--25fb015d-797c-4192-9a99-531d9c514e27",
        "indicator--6ee17b44-f996-4c7c-a4b4-4cb82b21fe03",
        "indicator--3ecf65f4-bf3f-4ae6-b0d3-553273186838",
        "indicator--34947a51-ae4e-4362-80ab-f1e0f10e6267",
        "indicator--321d2d80-3db0-44a1-b032-5412b2237d2c",
        "indicator--ee789d8c-e31d-4c39-b530-b7da74dd83b7",
        "indicator--9ef7e4c1-b31b-41c8-8139-8e4c3ab95c13",
        "indicator--068dc4f0-830b-43b1-899c-f5fcca2027ce",
        "indicator--5d9c40d2-5046-45c9-81eb-3ea47d03235d",
        "indicator--977a9583-a161-42c7-a6ef-76129d024424",
        "indicator--fcb7e56d-5451-4583-b0a9-0f9e783a1c77",
        "indicator--61cc588d-7279-4ca5-886c-62b0ea7dd23f",
        "indicator--1dc8028e-25dd-40ee-ae78-f166ded2da26",
        "indicator--bee020cd-fe0d-4e5b-87ac-6dfc34ac5804",
        "indicator--b5d9d7e9-6dfd-405b-9373-d88235cf6a03",
        "indicator--2c241a12-956e-455a-810b-134cd0e9fc81",
        "indicator--f9d1705e-b050-4967-834b-86bfb313a3f8",
        "indicator--64dffaf1-4a1a-4c00-be3e-b835d0f95302",
        "indicator--dd2df1a0-79f7-4a0a-af06-bd9b096e9d25",
        "indicator--93e1dbbd-2a9d-415c-b664-09329a9e6cdf",
        "indicator--2da68240-ffa9-449b-9ebb-eea9c233a87c",
        "indicator--4b801a0e-f39f-4165-9780-9faf50f25d81",
        "indicator--c2ef6f68-7805-4eb3-9675-4cdd32e39d66",
        "indicator--62e26d2c-7296-46eb-a095-c0da579038a6",
        "indicator--719367e2-a0e2-44d9-bc36-eaef04be074a",
        "indicator--78cbf299-d66b-444a-a160-dc7a67c20c06",
        "indicator--39daf3e5-1325-4ee6-a828-8df44e70e204",
        "indicator--1fd57377-fcf8-4faa-9f72-ba5a9c13ac3f",
        "indicator--140e707a-2ad7-482b-b80f-f13cda41250e",
        "indicator--01db9e4a-fd0b-445c-afd7-15ebac6dee2d",
        "indicator--d85f8f93-648e-4f08-80e8-a653d16a567c",
        "indicator--7e131b56-c30c-42f7-844d-9829130bde7a",
        "indicator--d69a1006-afde-4881-bd71-efd1dfc70e60",
        "indicator--835d82ca-db37-403a-82a9-512a70b6b5cb",
        "indicator--43781f39-7cce-4f2e-80d2-132b48186ad2",
        "indicator--19ae090d-6c93-484e-bcf5-f68a527c7633",
        "indicator--61b4f97f-0dd4-4358-b138-d76bbe9f83e6",
        "indicator--ef153c1c-afbb-4d91-a4b1-44327b577ca0",
        "indicator--6f089220-e160-419f-9154-281c53c214a0",
        "indicator--917355fe-5f38-4b46-8f63-ddc8e417f93d",
        "indicator--6f782ac9-13af-4e09-bd15-cd135c30bc3f",
        "indicator--24c5c7e5-eb0b-4490-8994-bbd89cc79e68",
        "indicator--5a367d86-294a-443e-abe6-b872688efb2c",
        "indicator--0be3703b-6b95-4c5f-8025-3b1de55c703a",
        "indicator--a0ca4e84-5b7b-4a9c-84b9-4772cd5e0c50",
        "indicator--3ad044a6-0629-4806-ae92-1a2ece6f696b",
        "indicator--b899efe0-0ce6-4280-806f-3648cee4ef1a",
        "indicator--565d2590-eb63-429f-9b08-f79845f1af40",
        "indicator--4f74df4f-f50d-4ba2-bfbe-09f4fcf49d6e",
        "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
        "indicator--b82ee419-404e-4abb-baa2-f3312c627278",
        "indicator--d0339af6-18b8-46be-b1a3-2a92a75a7e99",
        "indicator--99c29f3b-fcb7-429e-ba40-6a125cd5591d",
        "indicator--e9d8cec7-0a8d-4551-8d8d-8af360aec934",
        "indicator--8292c505-0652-495c-9e58-6f56cf87c142",
        "indicator--21950104-d0e0-49b5-be6e-65cd710f3f2a",
        "indicator--7736ab49-b026-478d-a487-06710a98d92b",
        "indicator--265baa2f-960a-4be6-9870-85d3453c57eb",
        "indicator--98ee8471-a8b1-43f1-a553-64e1df1622af",
        "indicator--c2bcabb6-41af-4789-b8f7-3ef5228baa95",
        "indicator--ad3fa7f1-9904-49d0-9d02-2a4e8fb812b6",
        "indicator--0dcc83f0-947b-4cc1-b916-c28a5b4edd7a",
        "indicator--c6d3c120-9920-4145-a08d-f9e037dab1ff",
        "indicator--ba231d03-ad27-41ba-b4a8-4189252ca0ea",
        "indicator--0009b5ee-7c38-4316-8184-946a596ad208",
        "indicator--f81806f2-aa62-40d8-8949-86e48664e7c8",
        "indicator--4216f86f-e279-432e-aad1-d68537c0eee4",
        "indicator--8cd0a9c3-4839-4107-9de1-4c188663a4dc",
        "indicator--a787b73c-0f97-43ba-b238-2d8815d3fc1a",
        "indicator--dc110ba1-851b-4da2-9974-8505722a56ee",
        "indicator--5151c88e-fde9-4fc1-8fac-7de6d835fdb1",
        "indicator--006ac6d7-d206-45a7-9291-9846d9b7e022",
        "indicator--f1381559-e52b-4710-b0c5-d53912475ca6",
        "indicator--9c936ead-5f5b-4243-8e59-43b128148cba",
        "indicator--5492494a-5bd2-424a-a525-8468c3d05633",
        "indicator--298c9895-4d5a-420f-9731-dcee96b62c85",
        "indicator--c2fc0c94-7e3e-4c8a-9ca9-32bd16b790ba",
        "indicator--a2359985-b761-456f-ba0b-b1bb6cdde12d",
        "indicator--e1e58ee0-3f81-429c-8e7b-589d7c8f278b",
        "indicator--f0b26935-32e4-413e-930e-034c39369952",
        "indicator--afac38ff-dfa2-4404-adc9-1f9c103b083e",
        "indicator--97c107e8-688f-4da3-a4d8-6b137a5df46b",
        "indicator--28b51de5-8d39-4cd3-ba12-6b72290cb9a8",
        "indicator--b2e2f245-36ab-46c3-aaef-b85ad2833001",
        "indicator--743c51f8-5cde-4cf9-94dc-1404699abcf0",
        "indicator--d3390ac3-7167-45e8-9b59-14d7a1c25957",
        "indicator--9f3e13f6-3587-4f5b-a7d1-0c2cce809fda",
        "indicator--95922197-b292-4928-aed2-9c2e3b495108",
        "indicator--a5260646-6319-4083-82e1-6bee1eb585de",
        "indicator--a5374ba4-0c5a-44de-a954-46d103a10583",
        "indicator--d80d57ac-f837-4057-a8ab-9223054f3151",
        "indicator--36e2293e-9d85-4dd9-9898-e6f07faef940",
        "indicator--a8d41972-383d-42a6-992b-9a3c1f680f7c",
        "indicator--2b808a2a-6955-4093-8045-c1f669609d83",
        "indicator--8e71ffee-5471-4ccf-8929-0a64e3c22567",
        "indicator--7d02abb2-78f4-4d6f-b9f8-b413f88cba36",
        "indicator--54aa4603-cfa0-43eb-bd64-9e66dd3b79da",
        "indicator--49dd85ea-94eb-4dbc-be0b-1e1832de3174",
        "indicator--e411e6d3-f402-425f-9888-3fbfca5097eb",
        "indicator--54d83fa3-de87-4c31-b7e6-523e84689280",
        "indicator--3ee5ff9d-dd40-453d-8073-f21d5fac2aa5",
        "indicator--420350ba-21b9-4aa3-916c-9cbf367d0aba",
        "indicator--697cce24-05ba-4e07-aa81-4993024d0623",
        "indicator--f1ae04ed-3a0a-4943-acd3-f7d70560fbc0",
        "indicator--033edbb1-5a65-42ed-be2e-b783036ca929",
        "indicator--22a8052e-ff89-483a-87e4-39b96913e5c5",
        "indicator--7af51894-a7ad-4be4-b51e-943fc1d33db9",
        "indicator--8cd54ffa-f4e6-4179-9bbc-455a371f0f5e",
        "indicator--a2c5669b-cec7-406f-bc64-504cdb1cfb16",
        "indicator--da8f70c7-3c8e-4f30-ad81-0983a8f1f7d5",
        "indicator--d96c08c3-02b1-4237-8437-82ea4c96ca5d",
        "indicator--59f384ea-d33b-4561-a6bf-7a4fc7db4ddf",
        "indicator--afe9bdda-e22a-4c64-81e3-1a3c2782441d",
        "indicator--1e8ba9be-6a40-4b99-a525-94f14717cec3",
        "indicator--ab164e4c-0160-4159-b2c6-eb06fff43ba2",
        "indicator--d728544f-64d8-4216-9b70-8007aa233bc5",
        "indicator--73e5f5c2-fe73-4caf-855c-00d1930c52ef",
        "indicator--ce9acd48-bb0c-48d6-8d6d-c8e6594255e0",
        "indicator--78f696d6-87f0-4b5a-a54d-c876a6e15eed",
        "indicator--02f75585-e5ff-40aa-b95d-df8dd534d414",
        "indicator--3d83f3e9-1aad-4ec3-8287-8c1db5763615",
        "indicator--e96b562e-94d4-49b1-afe8-693216a30b16",
        "indicator--96f80691-1a48-45de-9df2-b9b5dcae5fad",
        "indicator--a3d460ad-b179-403b-96c1-004edf015021",
        "indicator--4a13c201-37f9-4948-a670-f2807bd94819",
        "indicator--76a9fb15-ab01-4ad8-8aaf-e4e7941c5883",
        "indicator--b8a6823d-73c0-4d52-9b0f-d53e1d12a5af",
        "indicator--9ff7a660-d35a-443e-9d80-a61d926b1e38",
        "indicator--07ec2da2-7568-4df3-b464-3e8192d781e2",
        "indicator--b0c29e69-5070-4358-ac47-9088e798fca0",
        "indicator--2f28efec-1607-41c8-8c78-7d488c45d062",
        "indicator--02122243-8b70-4c2f-810b-5c3c3295c5ba",
        "indicator--28701139-e8dc-4bd4-be58-27fc66f3a690",
        "indicator--30e6e3fd-2e2c-422e-804f-dafef23e2fcb",
        "indicator--f3fd30e2-b5e6-41ef-827f-c447dcd7c80a",
        "indicator--fe4dd6c9-29b9-4755-8e38-ac2dcb3e7576",
        "indicator--a999fc52-b46b-4885-8634-e79d34969bc3",
        "indicator--9fe40dc0-1eef-40ba-b4cf-e7737cadc621",
        "indicator--154c5cf2-d870-4f10-a729-13f76966e19f",
        "indicator--dd9d5c03-ba6c-4a39-85b0-11da3e7425a1",
        "indicator--e96b3baa-ae14-4b26-b1ba-b919167e2522",
        "indicator--896df6f6-ad03-4fee-bc48-701ac60b7b93",
        "indicator--bf1b9def-ff0c-4015-9477-2d81adea6427",
        "indicator--8740d3b4-23d0-484c-84e3-3bec255abd1d",
        "indicator--622683ea-2cc3-4923-ae7c-6f598c51c7a3",
        "indicator--1be6a17f-7f51-4257-9859-c40d8f423e3e",
        "indicator--2e912811-23a2-49f7-8a61-03f10f59e1ac",
        "indicator--4acf1b05-d270-4a8b-b3b7-c77fb75f1b1d",
        "indicator--41d15914-e07d-441f-b748-eac16eaeae1e",
        "indicator--2c8e138d-62e6-4d34-a230-cbe0c5fce39b",
        "indicator--8edb3fcf-613f-4bdb-98ce-badbae6182d6",
        "indicator--31846280-4d44-4538-8436-b8352446afc6",
        "indicator--ed50e458-a0a4-4e90-a430-6d22daec7bfc",
        "indicator--d7e2c034-3f29-4bef-bfb4-c49f4b0a7d89",
        "indicator--d301621f-2d6b-4519-bf2e-64a3fde1c777",
        "indicator--98b16f58-20ff-4899-91d4-bc700580912e",
        "indicator--a225bb30-5ad5-497b-acd2-0578dd14cece",
        "indicator--fc2b8bf5-ab3d-45b0-bcb9-f6513cc8f525",
        "indicator--8545a3ab-c15d-44cc-a44e-2c9067e956ce",
        "indicator--3aea24de-a976-4ad5-911f-9b945779d49d",
        "indicator--ffe0761e-b2b8-432f-be0d-96e07e8e711b",
        "indicator--a9810498-80c8-41f7-92a0-7b8c2a0bab84",
        "indicator--21a5d24b-cdaf-4e86-9691-51ed7a073554",
        "indicator--64947df5-cb32-4e13-a069-8991e9486466",
        "indicator--02fc0be3-ffd6-4223-b311-4fece1f5a769",
        "indicator--84673f42-25ad-45c5-9549-a9bea7437bfd",
        "indicator--6cae5282-0009-4f2c-a34e-4106870c42f6",
        "indicator--969fa267-eca7-48d8-b3db-100a8923a496",
        "indicator--cfaf4381-4aff-40ef-bf5a-57efbd87aafa",
        "indicator--95d29599-5886-42ff-82d3-249dbde19bee",
        "indicator--0db51919-1164-4922-a1b1-c78bb570cb15",
        "indicator--3b0a0d92-03bd-4f47-8b57-2502dcef097b",
        "indicator--3a4fb440-329d-4d1a-aaf4-11376b7bfdf1",
        "indicator--020b42e6-0149-4615-96d6-01cc8eadd6f0",
        "indicator--c271a05d-3bb9-4f16-be52-a0a48a63323a",
        "indicator--ed329407-60f4-4fee-9f2e-2512f1226a0f",
        "indicator--e0ce6d91-2dbb-42ce-8efd-7701c1cd3171",
        "indicator--0b3cab83-bd36-4bb3-a636-e53c701b214e",
        "indicator--128ecc76-3253-4ae5-b3c7-38d11b1062e0",
        "indicator--0cc25d64-e498-465d-8058-7ead53f5e0eb",
        "indicator--43dcf991-0216-485d-b1c0-fe3a6892f966",
        "indicator--5ea437c2-2406-4a9f-ad6d-a81d0d421475",
        "indicator--47950095-a5a3-46cd-990a-c2798194f0d9",
        "indicator--7463378f-a2ce-42af-8be8-5f652675b214",
        "indicator--4cafa6cf-c4c6-4b1b-8b97-8999b5251847",
        "indicator--9cf3bcff-802b-41f5-b356-def4f13658f0",
        "indicator--d49df734-6ba2-4df9-9cb4-9509f9f7219f",
        "indicator--698b5656-c1e3-4ad2-a689-fec8b7ed59fc",
        "indicator--2000f64e-b9c2-4ce8-b228-57c5bbb69a9e",
        "indicator--fe4d2fb0-3691-479b-bced-0a5626a9e65c",
        "indicator--17107a49-51b0-4bb6-9b6c-d8ce5cc84288",
        "indicator--2a3fffd0-62d5-4eea-9e75-2c6fdbf82f57",
        "indicator--210ee17f-d3f3-47a3-b54d-b4048444b911",
        "indicator--dda79cd3-cd90-4868-a702-a6cf788d932e",
        "indicator--98829c28-37bc-4a87-aceb-3029704895a1",
        "indicator--90e9b4d8-94b5-4fe4-a2ab-614b2b7a2f1b",
        "indicator--cea7a2ac-89cc-4089-97c6-1ace5974f31f",
        "indicator--69dde4fd-3f1f-40a0-ba8e-fc09bc2d9c15",
        "indicator--022e46c9-5d64-43cc-b512-48bc881a7289",
        "indicator--f71f1702-6875-4c54-a776-3632c4fef98a",
        "indicator--23fab13f-50a8-4153-9ae0-d719cf5ace0b",
        "indicator--a24262ec-0b79-4535-9f51-5ee4906378e7",
        "indicator--fa376987-d286-46aa-acf8-1bedff75c24c",
        "indicator--a778002a-b9cd-4578-8c3e-32ce33461cc6",
        "indicator--f7991d3e-36fa-4d96-a156-dc192e2fb66b",
        "indicator--9d9b7268-3bee-4fab-9a07-46204917c044",
        "indicator--75940784-dd2d-441a-a7e5-5187a65cf562",
        "indicator--bbafbd18-f68f-4f7d-85df-53f5861fce62",
        "indicator--bcf52ebb-27ab-4fcb-9e7b-23e9283c7123",
        "indicator--56bd2568-65eb-4737-ab73-bb26894a0871",
        "indicator--9b34ba00-bbb8-4f13-9220-e4c5dfa4a369",
        "indicator--fb4e9eb8-982e-49bd-b84e-54cddc1097df",
        "indicator--f777c8b1-551d-4615-bfca-2fa1fb4d8f4a",
        "indicator--538780e7-2bec-417d-804f-df495c8f1766",
        "indicator--d82fb726-bd7e-4a66-9485-63e2c81536a1",
        "indicator--fbc91243-5624-400e-806f-41777914d2fe",
        "indicator--bb02f1ff-b705-4f79-bf2c-9e61057f832d",
        "indicator--99cca7d6-ff51-42c6-983d-55eff46e2371",
        "indicator--8393e6cb-4add-4a69-87b9-757e6a6f9e24",
        "indicator--21aa769c-0270-4abc-8e03-c8766a293cd3",
        "indicator--42d01540-3e2e-42d5-83a6-8c7ab9737ec5",
        "indicator--d9bd0aa4-4532-45ef-904d-e09d9d44399f",
        "indicator--e83786e5-2a03-40aa-9353-8c0826c64b7d",
        "indicator--bc15da62-630a-435e-8a52-97c08210d0cb",
        "indicator--5094474f-8aed-47a1-96aa-65f310315e5f",
        "indicator--3bfd7de0-1d83-4d63-b02e-1d33ad651649",
        "indicator--87d823a5-b579-4168-a182-b7132cb882cd",
        "indicator--8339f25d-0574-4407-8b7c-54a226a5259c",
        "indicator--8661bdd4-1dfc-45eb-b11c-9366cc551127",
        "indicator--6a312fc2-ec33-4fe1-adff-7e7222037b34",
        "indicator--13e4a5e9-83c3-4036-8200-64148e577f8f",
        "indicator--a16cc361-4205-4271-ba2a-d0b0aa89b005",
        "indicator--b7734e8e-6e29-4e33-91a0-edef25d78e7a",
        "indicator--e32b13f6-6546-4d08-8ea0-0adfaad63211",
        "indicator--faec446f-e73e-4e65-92b0-77ff9ebafd65",
        "indicator--bda9930d-ce57-4546-8160-64bbf5e685e3",
        "indicator--9fbf4d67-61e6-4dd1-beef-fe1d99f77347",
        "indicator--8b696dae-4b40-4417-a946-3b7b69f3b002",
        "indicator--7f4f9d7b-197f-44d5-928d-e2b8b0a4d351",
        "indicator--8608f0bb-c96b-4b55-bde1-db8451121187",
        "indicator--b2a62e5b-2cf3-46af-863b-c4265cd214dd",
        "indicator--73dc8510-a202-411e-8e44-1c3bdb00fb78",
        "indicator--b66bb15d-8773-46bc-a6e7-2d9b3644a9e7",
        "indicator--9f3103c2-077d-4e28-825c-6585258e32b0",
        "indicator--2eb09eea-b737-4dc4-b735-5488c8bf7ce4",
        "indicator--042a75f2-6fab-45d3-956d-01edfb56f7c2",
        "indicator--2bbcb2f0-27ba-46e6-9caf-869f800010c6",
        "indicator--27852f18-505c-411f-b330-46fc191be61a",
        "indicator--3e89c77b-3441-4418-a324-380412fe5292",
        "indicator--a66473b0-1801-4b68-9d68-f6a8fcb5dca0",
        "indicator--76698301-11c5-4b26-aaf7-7d6a18012be7",
        "indicator--bc2688e9-d246-4a70-9ee5-c4e5f20ff156",
        "indicator--cdc2b746-51e3-4453-bbe6-9f667db7c070",
        "indicator--00472424-0caf-4e31-a89b-8d60fe90e65b",
        "indicator--4c48a457-5f3e-4398-95fb-cc450942836f",
        "indicator--7443e06b-e7f3-4625-b910-7546620ba1fb",
        "indicator--aa28e903-a431-480a-b47c-12fe3a3d02b1",
        "indicator--4838bb14-a919-4e37-bb82-1aada14fecc5",
        "indicator--8ca4338c-9b0a-4955-9848-b5741db740c6",
        "indicator--e9a4b813-c7e2-44f8-b765-a34b8208a459",
        "indicator--a9569a1b-fad6-40cd-be67-49956c5294fc",
        "indicator--0ac47fc9-3613-4617-865c-29ff8b5428e9",
        "indicator--45bf1fe4-b63f-47fd-aa5b-d07a32f139db",
        "indicator--89e15fbb-4907-47a9-84e5-91fbf4ac0a84",
        "indicator--01961c45-c9ec-408f-a827-cd12be5be9dc",
        "indicator--6ac310e1-f36d-4e1f-824f-e565af383497",
        "indicator--087ccdc5-acb5-4043-af2d-a99c915a3d8c",
        "indicator--4f27814c-34a2-48f2-80af-7c62e4eb4f41",
        "indicator--5242c369-5db7-4724-8298-9a498b578899",
        "indicator--8ac88c6a-8cf5-496b-bd6f-d44ed05b4827",
        "indicator--01e8ed6b-41a4-4ade-93b4-529c9997ea7b",
        "indicator--f44a7b0a-f104-4db6-93dc-485947819c3c",
        "indicator--e4359f98-91de-4142-a60d-38ef658ffe68",
        "indicator--ade7fa58-ad22-4c72-888a-733746357af2",
        "indicator--74662a68-61b1-40d3-884e-cb0801340005",
        "indicator--f27b6179-e676-49d3-8c75-eb681d4ae55f",
        "indicator--dd441391-aa5e-4c81-aac8-0cbf482822b6",
        "indicator--9731e3f8-49e2-4cf5-9b12-2f4e4e22b716",
        "indicator--fe526806-b91b-4da1-8560-92e43df86a02",
        "indicator--bd085c67-09c5-4559-a216-8fcead13feb4",
        "indicator--fda10dbb-8d7f-4bf7-968c-a086839e155d",
        "indicator--ee62a5a3-d29a-4c06-8ca8-2be93e993ee4",
        "indicator--5699be60-86cf-4e12-9cdd-49d7a2f25b1c",
        "indicator--7d58cc5c-9793-4181-96af-69ccfbd8bf0d",
        "indicator--1802cedd-1b5f-4cbf-b0f7-be57b058b0ed",
        "indicator--f588182d-d02b-42fc-a334-4446be7ecf75",
        "indicator--3089ff16-c361-4e16-bf22-60b583437de0",
        "indicator--698cb7df-7692-4836-a064-9bbd0a228101",
        "indicator--7934b6c9-1b9c-4ab9-9bef-ce89d93c003c",
        "indicator--29aaec2f-9488-4c68-97f9-46a78f4460c6",
        "indicator--9487336b-8f31-4ef8-a4c4-0d117425b625",
        "indicator--ce8a4121-a2f9-405b-bafc-1ad4913c73f1",
        "indicator--32f03be1-d8cb-4caa-8eff-010a49ce69f8",
        "indicator--ecd39e37-abb6-4d68-8a69-15e8bae892ee",
        "indicator--1c393663-1b84-466f-85e3-304abad90868",
        "indicator--3104f03c-5dad-49a6-8ae4-67fd83bdb8b3",
        "indicator--5ebb4b48-be8e-4a31-8169-df2af2bfad55",
        "indicator--d766a410-f188-42a9-aa52-2725f9f4ea8b",
        "indicator--d972c8d4-1328-45ac-a4a0-0d705d030cb7",
        "indicator--8e1621ab-427d-4879-ab4d-b3740a32e4cc",
        "indicator--078326bb-4688-4a71-9716-4ad5821b62cf",
        "indicator--ac96d8aa-c112-41a0-9e77-65f6f5718008",
        "indicator--a513abf8-89d8-49cf-988e-cbed1afa1f39",
        "indicator--86924d43-6fca-4570-b554-ef19a3228fde",
        "indicator--0e160a3d-f87f-4116-95d5-3cb45ffabe0e",
        "indicator--91044ff5-c17c-45a2-9682-3b4619d7b712",
        "indicator--6f1f3740-dc1d-43c5-9c00-5f2160ebf11b",
        "indicator--935ec4f1-4cdd-472f-a706-21f07818f280",
        "indicator--54cc846c-858c-4f0e-aaec-27d6163814b2",
        "indicator--bed349a3-57da-4d20-be53-2d7cc45c15a4",
        "indicator--67d144c9-4335-49c8-8c22-f1eea1366307",
        "indicator--f80557e5-5373-4175-8c67-0dc0a65eb381",
        "indicator--a136694b-9745-4e3c-af4b-3446b47d9888",
        "indicator--b93b722b-636b-4899-b603-752e0bc7a9ee",
        "indicator--c29bc0aa-c080-4a9d-8ace-fc13c141eb24",
        "indicator--b7e4b1b6-b07c-4211-b6e9-aa2ac8078671",
        "indicator--3dc0c127-e809-4604-81dd-dd12a6d46b9a",
        "indicator--04fde8eb-8666-4d63-b035-acbb9605ebca",
        "indicator--3f395b80-5e84-43d1-b58a-9c4b9295dbf8",
        "indicator--e8fb6719-e83c-41f0-a243-47a432d87563",
        "indicator--cc316e68-228e-4051-83ef-d05a38e95c4c",
        "indicator--0b406edc-f69f-482e-b7c5-4f3873b0d937",
        "indicator--87975762-9637-44fb-aa5b-58fa31a5c7b3",
        "indicator--75382bbe-9641-4534-ac71-c40af6f37d7f",
        "indicator--b1cf90d5-308b-43e6-9312-125de1a0e40f",
        "indicator--7c0240fb-b0d1-4379-ba17-062e5b325568",
        "indicator--770ad526-8d8b-489e-b2e0-c03617869f9c",
        "indicator--8493f3f9-070a-4968-8761-35923b401104",
        "indicator--6839ffc5-52e5-4a77-81c6-7181011f9310",
        "indicator--c2a2eef6-c628-49a3-b1e5-a9592345eab2",
        "indicator--ab412d36-5d9f-46da-b6f1-58442c797fa9",
        "indicator--d44415a5-17ce-4c7e-8fda-44a0cbf40177",
        "indicator--5a94ffcd-9dbd-42a2-ab29-dc1c69faf862",
        "indicator--322e4c32-95bb-4b61-986a-5895b9edfc3e",
        "indicator--1e6eafef-a05b-4da3-93e6-ab9ea00a9777",
        "indicator--1553309f-b248-483f-9771-53508abd6440"
      ],
      "published": "2026-03-01T00:05:04.986Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-03-01T00:05:04.986Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-03-01T00:05:04.986Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-03-01T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--3f02a9cb-99d3-4701-a574-5dfd7b4abe5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.172.239.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:05:05.000Z",
      "valid_until": "2026-04-02T00:05:00.000Z"
    },
    {
      "created": "2026-03-01T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--c2d3f517-be3d-480d-8ddf-44f258fa1d41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.254.121.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:05:05.000Z",
      "valid_until": "2026-04-02T00:05:00.000Z"
    },
    {
      "created": "2026-03-01T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=50219; asn_org=Valence Technology Co.",
      "id": "indicator--825f334a-48d5-4ce9-9f15-51fbd5e7e321",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:05:05.000Z",
      "valid_until": "2026-04-02T00:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-12T15:02:52.326Z",
      "x_nadsec_last_seen": "2026-03-23T18:58:24.513Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "50219"
      ],
      "x_nadsec_orgs": [
        "Valence Technology Co."
      ]
    },
    {
      "created": "2026-03-01T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MO; asn=4609; asn_org=Companhia de Telecomunicacoes de Macau SARL",
      "id": "indicator--07dd7737-5879-437f-9736-e24c5caac902",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.86.184.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:05:05.000Z",
      "valid_until": "2026-04-02T00:05:00.000Z"
    },
    {
      "created": "2026-03-01T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=4775; asn_org=Globe Telecoms",
      "id": "indicator--40ffbed1-dae9-414a-a471-d57130c9e9cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.177.66.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:05:05.000Z",
      "valid_until": "2026-04-02T00:05:00.000Z"
    },
    {
      "created": "2026-03-01T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--97e29ba7-a3a9-4d63-9ecd-e7492c76578a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.22.177.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:05:05.000Z",
      "valid_until": "2026-04-02T00:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T05:39:47.301Z",
      "x_nadsec_last_seen": "2026-03-02T05:39:47.301Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-01T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--f172eb50-8707-4088-a4be-d4b99c0e2971",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.46.55.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:05:05.000Z",
      "valid_until": "2026-04-02T00:05:00.000Z"
    },
    {
      "created": "2026-03-01T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--1004736e-7686-47da-922c-5bf6c1369d53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:05:05.000Z",
      "valid_until": "2026-04-02T00:05:00.000Z"
    },
    {
      "created": "2026-03-01T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d30c9e93-d52b-4c3f-8fe5-d9f8e65f0cc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:05:05.000Z",
      "valid_until": "2026-04-02T00:05:00.000Z"
    },
    {
      "created": "2026-03-01T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--8497153e-fc07-46ac-8e15-89475a49d568",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:05:05.000Z",
      "valid_until": "2026-04-02T00:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T17:10:41.985Z",
      "x_nadsec_last_seen": "2026-03-10T17:10:41.985Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-01T00:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ff1e8e4c-c895-4abc-9887-63c15984f509",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T00:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T00:05:05.000Z",
      "valid_until": "2026-04-02T00:05:00.000Z"
    },
    {
      "created": "2026-03-01T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--c94eeb8d-b3eb-4cda-8fa3-cdf061fb917b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.55.216.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:05:13.000Z",
      "valid_until": "2026-04-02T01:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T02:19:57.514Z",
      "x_nadsec_last_seen": "2026-03-02T02:22:02.691Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-01T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LA; asn=9873; asn_org=Lao Telecom Communication, LTC",
      "id": "indicator--818f51e6-fbda-46b3-b3bf-4f2a0676b85a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.84.114.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:05:13.000Z",
      "valid_until": "2026-04-02T01:05:12.000Z"
    },
    {
      "created": "2026-03-01T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=88; services=ftpd; ports=21; cc=KR; asn=4766; asn_org=Korea Telecom; user(top)=A***n; pass(top)=***",
      "id": "indicator--2966965a-d84b-4a3d-9f4a-a4b29f080902",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.148.71.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:05:13.000Z",
      "valid_until": "2026-04-02T01:05:12.000Z"
    },
    {
      "created": "2026-03-01T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=JP; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--fba797f0-8312-47ca-b6ad-0f566d6414a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.162.119.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:05:13.000Z",
      "valid_until": "2026-04-02T01:05:12.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-02T14:47:25.363Z",
      "x_nadsec_last_seen": "2026-03-31T03:14:37.531Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-01T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--c775ace9-9cce-48ea-b66e-43bda44f1d8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.163.107.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:05:13.000Z",
      "valid_until": "2026-04-02T01:05:12.000Z"
    },
    {
      "created": "2026-03-01T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--ffbfa2f8-2323-4832-97ac-9d65556f4711",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.254.172.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:05:13.000Z",
      "valid_until": "2026-04-02T01:05:12.000Z"
    },
    {
      "created": "2026-03-01T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1f350faf-9072-4ff6-95d8-96446d03208a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:05:13.000Z",
      "valid_until": "2026-04-02T01:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T02:48:18.226Z",
      "x_nadsec_last_seen": "2026-03-11T20:31:42.194Z",
      "x_nadsec_ports": [
        "3306",
        "135"
      ],
      "x_nadsec_services": [
        "mysqld",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-01T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e0775727-f3e8-4df0-b338-4776a8724ad5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.221.72.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:05:13.000Z",
      "valid_until": "2026-04-02T01:05:12.000Z"
    },
    {
      "created": "2026-03-01T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2a616519-9ba4-485a-829d-73e2ed258d2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:05:13.000Z",
      "valid_until": "2026-04-02T01:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T17:33:42.901Z",
      "x_nadsec_last_seen": "2026-03-17T17:33:43.616Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-01T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--92b2037b-f091-4a8b-9ded-cba3642036ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.204.27.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:05:13.000Z",
      "valid_until": "2026-04-02T01:05:12.000Z"
    },
    {
      "created": "2026-03-01T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=RO; asn=47890; asn_org=Unmanaged Ltd",
      "id": "indicator--59ba6205-4dfa-4873-a6fa-399c576b880b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.93.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:05:13.000Z",
      "valid_until": "2026-04-02T01:05:12.000Z"
    },
    {
      "created": "2026-03-01T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--d6582bef-8ded-40c2-b71c-0cbc767face8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.105.24.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:05:13.000Z",
      "valid_until": "2026-04-02T01:05:12.000Z"
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=141805; asn_org=Hubcom Techno System Llp; user(top)=**",
      "id": "indicator--c250564d-85cf-4391-af57-4e66a4d269e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.109.137.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T16:45:01.453Z",
      "x_nadsec_last_seen": "2026-03-21T16:45:01.453Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141805"
      ],
      "x_nadsec_orgs": [
        "Hubcom Techno System Llp"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0e2eae7a-2d68-4101-82d7-0fe645f9366a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.183.141.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z"
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--bf0130cd-efcc-4bd0-b8b9-cc0706d627bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.30.13.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z"
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--b3f336f5-2e2b-4382-84ec-9fac3c7fed33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.69.68.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-15T05:54:20.650Z",
      "x_nadsec_last_seen": "2026-03-30T04:05:18.591Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b71bcc29-165e-417c-a766-99ed757e2fbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.190.24.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z"
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--f0162491-9e40-44ea-92c5-fb3dd800d8c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.230.214.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-03T17:21:52.219Z",
      "x_nadsec_last_seen": "2026-03-04T05:46:40.319Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.",
      "id": "indicator--3a6daaa6-0538-43a3-a4f4-f210cfbd3af0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.244.108.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z"
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=6503; asn_org=Axtel, S.A.B. de C.V.",
      "id": "indicator--aac9b5dc-6116-4490-aa38-adbcf39b625a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.245.50.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z"
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=40003; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--365e732f-7cb4-46d8-8fe9-d81e24fb2ee8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '150.107.36.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T09:24:51.738Z",
      "x_nadsec_last_seen": "2026-03-12T09:24:51.738Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--3e074dcc-8266-4629-abae-971754e58a66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '164.68.126.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z"
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PL; asn=201814; asn_org=MEVSPACE sp. z o.o.",
      "id": "indicator--c935bc0e-0229-4610-9368-1621c880c6b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.3.221.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z",
      "x_nadsec_event_count": 57,
      "x_nadsec_first_seen": "2026-03-03T11:27:05.913Z",
      "x_nadsec_last_seen": "2026-03-12T01:07:54.002Z",
      "x_nadsec_ports": [
        "81",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "201814"
      ],
      "x_nadsec_orgs": [
        "MEVSPACE sp. z o.o."
      ]
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ZA; asn=327761; asn_org=Oxygn-ISP",
      "id": "indicator--7ae2278a-bc67-4594-916d-b79f6cacedb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.6.105.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z"
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--e8100b01-1729-4e9b-be4d-f8f298ca5144",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.148.198.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z"
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--d1142a12-1764-41d1-b6a9-86072f5a5f17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.241.216.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T23:11:05.461Z",
      "x_nadsec_last_seen": "2026-03-03T23:11:05.461Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--17f0557e-2305-4677-929d-05b8df41024a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.60.241.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-03-03T20:23:28.966Z",
      "x_nadsec_last_seen": "2026-03-31T08:45:51.651Z",
      "x_nadsec_ports": [
        "81",
        "21",
        "42",
        "1723",
        "135",
        "1433",
        "34831",
        "38273"
      ],
      "x_nadsec_services": [
        "httpd",
        "ftpd",
        "mirrorc",
        "mirrord",
        "pptpd",
        "epmapper",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--a21792a6-17d1-4263-817c-052c41be43fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.42.231.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-02T07:56:38.916Z",
      "x_nadsec_last_seen": "2026-03-23T08:20:54.162Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-03-01T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom; user(top)=**",
      "id": "indicator--a2e00293-2f57-47fc-b075-5cfe3e474bc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.46.25.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:05:13.000Z",
      "valid_until": "2026-04-02T02:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T06:57:20.000Z",
      "x_nadsec_last_seen": "2026-03-12T06:57:20.026Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-01T03:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=13188; asn_org=Content Delivery Network Ltd",
      "id": "indicator--8f299832-355b-4186-bbb8-ac3aba1d4d8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.224.146.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:05:01.000Z",
      "valid_until": "2026-04-02T03:05:00.000Z"
    },
    {
      "created": "2026-03-01T03:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--9238d821-84f1-449d-819c-2a92f9bcd30b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.5.20.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:05:01.000Z",
      "valid_until": "2026-04-02T03:05:00.000Z"
    },
    {
      "created": "2026-03-01T03:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--86d4e82a-acc5-43fa-9ee5-f18680d100b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:05:01.000Z",
      "valid_until": "2026-04-02T03:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T03:24:48.027Z",
      "x_nadsec_last_seen": "2026-03-28T06:17:29.979Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-01T03:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b2e61067-bf24-47ef-a48f-cbca8fe5f361",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.168.122.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:05:01.000Z",
      "valid_until": "2026-04-02T03:05:00.000Z"
    },
    {
      "created": "2026-03-01T03:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--4c7024d7-ae1a-46ac-8166-2894933aa412",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.118.81.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:05:01.000Z",
      "valid_until": "2026-04-02T03:05:00.000Z"
    },
    {
      "created": "2026-03-01T03:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--f7bc0596-cd50-4999-a55d-eaa36696fb86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:05:01.000Z",
      "valid_until": "2026-04-02T03:05:00.000Z"
    },
    {
      "created": "2026-03-01T03:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--4a09cb11-3cdf-4e86-a166-0e81ff4623bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:05:01.000Z",
      "valid_until": "2026-04-02T03:05:00.000Z",
      "x_nadsec_event_count": 23,
      "x_nadsec_first_seen": "2026-03-02T00:32:17.281Z",
      "x_nadsec_last_seen": "2026-03-30T06:07:31.815Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-01T03:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--e3255b2f-07a5-4e8c-b408-df6b33fdfcb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.136.182.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:05:01.000Z",
      "valid_until": "2026-04-02T03:05:00.000Z"
    },
    {
      "created": "2026-03-01T03:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=JP; asn=17676; asn_org=SoftBank Corp.",
      "id": "indicator--b06f0617-5a3d-4491-bc4d-10d2099df8d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.137.106.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:05:01.000Z",
      "valid_until": "2026-04-02T03:05:00.000Z"
    },
    {
      "created": "2026-03-01T03:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=21453; asn_org=Flex Ltd.",
      "id": "indicator--8d8c35f4-1d38-4a20-b54b-e8a0e108033d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T03:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.84.195.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:05:01.000Z",
      "valid_until": "2026-04-02T03:05:00.000Z"
    },
    {
      "created": "2026-03-01T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0b97d61c-7a6e-4729-a86d-7780a345ce5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:05:11.000Z",
      "valid_until": "2026-04-02T04:05:09.000Z"
    },
    {
      "created": "2026-03-01T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=401701; asn_org=cognetcloud INC",
      "id": "indicator--2312cb91-5803-4ad8-b071-e5cad66220ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.76.198.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:05:11.000Z",
      "valid_until": "2026-04-02T04:05:09.000Z"
    },
    {
      "created": "2026-03-01T04:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ccf97dda-b162-4103-b712-960cfc8b535c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T04:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:05:11.000Z",
      "valid_until": "2026-04-02T04:05:09.000Z"
    },
    {
      "created": "2026-03-01T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d4dd377e-b2da-4b08-ac3d-21b30ecb29a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.176.43.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:05:07.000Z",
      "valid_until": "2026-04-02T05:05:05.000Z"
    },
    {
      "created": "2026-03-01T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--24bb00bd-4a08-4168-975f-a1fcbf39acf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.14.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:05:07.000Z",
      "valid_until": "2026-04-02T05:05:05.000Z"
    },
    {
      "created": "2026-03-01T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--15106a00-a838-41a2-83e9-2b2e9285c099",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.177.190.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:05:07.000Z",
      "valid_until": "2026-04-02T05:05:05.000Z"
    },
    {
      "created": "2026-03-01T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--f44c9bf0-a72d-4c53-a7b0-73ba4e8afc50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.132.121.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:05:07.000Z",
      "valid_until": "2026-04-02T05:05:05.000Z"
    },
    {
      "created": "2026-03-01T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mysqld; ports=3306; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.218.118.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:05:07.000Z",
      "valid_until": "2026-04-02T05:05:05.000Z",
      "x_nadsec_event_count": 192,
      "x_nadsec_first_seen": "2026-03-03T20:56:51.234Z",
      "x_nadsec_last_seen": "2026-03-31T21:59:55.863Z",
      "x_nadsec_ports": [
        "3306",
        "445",
        "27017",
        "1433",
        "1723",
        "81",
        "21"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd",
        "mongod",
        "mssqld",
        "pptpd",
        "httpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-01T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=327934; asn_org=Tunisie-Telecom",
      "id": "indicator--dc1b535c-1e53-4302-8c1c-eff8be1287f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.11.6.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:05:07.000Z",
      "valid_until": "2026-04-02T05:05:05.000Z"
    },
    {
      "created": "2026-03-01T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=32098; asn_org=Transtelco Inc",
      "id": "indicator--4d2c0a9b-6cfb-4e44-82e1-880ca15ee12c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.161.46.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:05:07.000Z",
      "valid_until": "2026-04-02T05:05:05.000Z"
    },
    {
      "created": "2026-03-01T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--9b790997-e19a-4cc0-84cb-2ccebe8abff5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:05:07.000Z",
      "valid_until": "2026-04-02T05:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-06T04:36:48.812Z",
      "x_nadsec_last_seen": "2026-03-06T04:36:50.005Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-01T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=28787; asn_org=Aztelekom LLC",
      "id": "indicator--daac0fe1-c1f2-4ae4-be62-8b0e0fd92b04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.154.16.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:05:07.000Z",
      "valid_until": "2026-04-02T05:05:05.000Z"
    },
    {
      "created": "2026-03-01T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mirrorc; ports=41565; cc=US; asn=174; asn_org=Cogent Communications, LLC",
      "id": "indicator--9f24a41c-a86f-4421-9188-fec5419f3950",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.123.94.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:05:07.000Z",
      "valid_until": "2026-04-02T05:05:05.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-19T00:30:31.648Z",
      "x_nadsec_last_seen": "2026-03-19T00:30:36.208Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "1433",
        "3306",
        "41389"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "174"
      ],
      "x_nadsec_orgs": [
        "Cogent Communications, LLC"
      ]
    },
    {
      "created": "2026-03-01T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--44845173-d870-4013-b200-6937c16e512b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.140.213.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:05:07.000Z",
      "valid_until": "2026-04-02T05:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T17:51:37.314Z",
      "x_nadsec_last_seen": "2026-03-29T17:53:44.280Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-01T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=RU; asn=210259; asn_org=LLC Applied Computational Technologies",
      "id": "indicator--6a4cf02f-4f5c-42a7-a890-cbec26368e05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:05:07.000Z",
      "valid_until": "2026-04-02T05:05:05.000Z",
      "x_nadsec_event_count": 69,
      "x_nadsec_first_seen": "2026-03-02T03:20:54.599Z",
      "x_nadsec_last_seen": "2026-03-27T07:47:29.720Z",
      "x_nadsec_ports": [
        "1883",
        "3306",
        "135",
        "27017",
        "1433",
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld",
        "epmapper",
        "mongod",
        "mssqld",
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "210259"
      ],
      "x_nadsec_orgs": [
        "LLC Applied Computational Technologies"
      ],
      "x_nadsec_usernames_attempted": [
        "***",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-01T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=BG; asn=213438; asn_org=ColocaTel Inc.; user(top)=r**t",
      "id": "indicator--1e1a5ff3-2901-452f-a6b1-038da4068cb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:05:07.000Z",
      "valid_until": "2026-04-02T05:05:05.000Z",
      "x_nadsec_event_count": 128,
      "x_nadsec_first_seen": "2026-03-02T01:27:42.247Z",
      "x_nadsec_last_seen": "2026-03-07T15:48:16.023Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-01T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--be7008f7-b30a-4728-b546-7089ac909da6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.255.148.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:05:07.000Z",
      "valid_until": "2026-04-02T05:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--432f05e1-b61e-4bbd-982e-65688017740f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.177.183.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--9dd857f8-d5b2-41b5-bb00-53018042bc89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.245.84.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--8ae84811-c5ac-4a4e-be59-9f4ff9d8d65c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.25.116.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--3a0bd794-dae0-4484-9044-863e91b687a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.98.141.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--74374f80-c747-455c-947b-c9b362a4c292",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.218.18.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b8d7ada2-c262-4ba2-9e49-31006a22cdc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.227.88.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--aa08b597-1a22-470c-add8-a70c9da75b7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T19:25:34.683Z",
      "x_nadsec_last_seen": "2026-03-07T19:25:34.683Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--9b1ea3a9-e5e2-474b-bac7-950ded1724e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.118.62.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--66a809e0-1839-4a77-8eb3-f27dec2baee5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.234.56.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--727022d2-6faf-4261-bbc8-b67252e5189a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.13.241.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T08:26:52.029Z",
      "x_nadsec_last_seen": "2026-03-09T08:28:59.305Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--390af12e-0655-4b73-abb9-3a11795a2815",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.119.229.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=131445; asn_org=Advance Wireless Network",
      "id": "indicator--f504626c-4031-4b79-b556-1574307bf3e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.232.113.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--51d079ce-5b4a-4813-882e-ddef604967ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.219.134.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e5168cf9-5429-451e-9d9c-1b13c43e6371",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.97.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-25T18:15:46.910Z",
      "x_nadsec_last_seen": "2026-03-25T18:15:47.550Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--0e68b301-2d62-4ce2-b087-92ff68d0c18f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=17622; asn_org=China Unicom Guangzhou network",
      "id": "indicator--7599169c-2808-4cd5-9681-135a824763a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.47.25.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--9453105b-d637-4216-a77b-ae5035565172",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.250.221.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=SA; asn=39891; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--4102683d-e796-4fd6-8375-9eb99651ecf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '51.235.207.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z"
    },
    {
      "created": "2026-03-01T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--7e9e4bd7-0420-4bda-8f0b-b69032e77a42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.102.49.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:05:06.000Z",
      "valid_until": "2026-04-02T06:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T18:27:33.087Z",
      "x_nadsec_last_seen": "2026-03-30T20:44:56.152Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-03-01T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=135407; asn_org=Trans World Enterprise Services Private Limited",
      "id": "indicator--5caa3a00-cf66-4d08-bc67-14cc157a4073",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.57.198.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:05:11.000Z",
      "valid_until": "2026-04-02T07:05:10.000Z"
    },
    {
      "created": "2026-03-01T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EC; asn=27947; asn_org=Telconet S.A",
      "id": "indicator--6019ec92-cdf8-42e8-bf31-2a24c21601ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.39.12.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:05:11.000Z",
      "valid_until": "2026-04-02T07:05:10.000Z"
    },
    {
      "created": "2026-03-01T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=30; services=pptpd; ports=1723; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--5607362d-1a85-4dde-a180-9407fa276198",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:05:11.000Z",
      "valid_until": "2026-04-02T07:05:10.000Z",
      "x_nadsec_event_count": 104,
      "x_nadsec_first_seen": "2026-03-08T11:44:04.695Z",
      "x_nadsec_last_seen": "2026-03-26T01:31:15.161Z",
      "x_nadsec_ports": [
        "1723",
        "445",
        "21",
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "pptpd",
        "smbd",
        "epmapper",
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-03-01T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--452385b4-1786-4952-8a4f-91d60e3462be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:05:11.000Z",
      "valid_until": "2026-04-02T07:05:10.000Z",
      "x_nadsec_event_count": 68,
      "x_nadsec_first_seen": "2026-03-08T07:26:25.264Z",
      "x_nadsec_last_seen": "2026-03-25T22:54:12.334Z",
      "x_nadsec_ports": [
        "1723",
        "135",
        "445",
        "1883",
        "21"
      ],
      "x_nadsec_services": [
        "pptpd",
        "epmapper",
        "mqttd",
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-03-01T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=ftpd; ports=21; cc=DE; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--fe665edc-a5b4-4f91-b386-214aa354bf5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.22.146.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:05:11.000Z",
      "valid_until": "2026-04-02T07:05:10.000Z"
    },
    {
      "created": "2026-03-01T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=24; services=smbd; ports=445; cc=NL; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.50.16.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:05:11.000Z",
      "valid_until": "2026-04-02T07:05:10.000Z",
      "x_nadsec_event_count": 1631,
      "x_nadsec_first_seen": "2026-03-02T00:47:47.111Z",
      "x_nadsec_last_seen": "2026-03-28T15:40:56.196Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "1433",
        "81",
        "3306",
        "1723",
        "1883",
        "27017",
        "135"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd",
        "mssqld",
        "httpd",
        "mysqld",
        "pptpd",
        "mqttd",
        "mongod",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-03-01T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--8565e079-940a-4ccf-8a9e-010aca9326b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.211.96.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:05:11.000Z",
      "valid_until": "2026-04-02T07:05:10.000Z"
    },
    {
      "created": "2026-03-01T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--56f2c538-acb3-46ec-9183-fdbe6afbb31d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:05:11.000Z",
      "valid_until": "2026-04-02T07:05:10.000Z"
    },
    {
      "created": "2026-03-01T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; user(top)=**",
      "id": "indicator--8cbe76d0-2b5d-4034-b4d2-7b021a9e2aac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.94.97.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:05:11.000Z",
      "valid_until": "2026-04-02T07:05:10.000Z"
    },
    {
      "created": "2026-03-01T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=23158; asn_org=ETEX COMMUNICATIONS, LLC",
      "id": "indicator--776807b6-aac6-44ee-a6a1-34c69d3ed8b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '67.216.98.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:05:11.000Z",
      "valid_until": "2026-04-02T07:05:10.000Z",
      "x_nadsec_event_count": 47,
      "x_nadsec_first_seen": "2026-03-05T12:10:00.301Z",
      "x_nadsec_last_seen": "2026-03-21T07:31:34.811Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "23158"
      ],
      "x_nadsec_orgs": [
        "ETEX COMMUNICATIONS, LLC"
      ]
    },
    {
      "created": "2026-03-01T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IL; asn=8551; asn_org=Bezeq International Ltd.",
      "id": "indicator--bed93cb0-c458-406e-abdd-5f4b8691be70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.80.220.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:05:11.000Z",
      "valid_until": "2026-04-02T07:05:10.000Z"
    },
    {
      "created": "2026-03-01T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=RU; asn=62314; asn_org=Atmospherica Ltd.",
      "id": "indicator--b9a9b498-8651-42c4-8d6e-22483ad8c0ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.171.178.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:05:11.000Z",
      "valid_until": "2026-04-02T07:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T22:53:07.812Z",
      "x_nadsec_last_seen": "2026-03-24T22:53:07.812Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "62314"
      ],
      "x_nadsec_orgs": [
        "Atmospherica Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-01T07:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=44542; asn_org=AO Countrycom",
      "id": "indicator--1754b6aa-be17-4946-a05e-0ed33e6726a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T07:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.92.136.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:05:11.000Z",
      "valid_until": "2026-04-02T07:05:10.000Z"
    },
    {
      "created": "2026-03-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--b668bb4a-289e-43fc-8d24-a79e50026eb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.57.94.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:05:08.000Z",
      "valid_until": "2026-04-02T08:05:05.000Z"
    },
    {
      "created": "2026-03-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3517c695-3a7c-452e-a618-f4d943ff0a3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:05:08.000Z",
      "valid_until": "2026-04-02T08:05:05.000Z"
    },
    {
      "created": "2026-03-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--af033483-d491-4a52-9edc-5973d5d50b71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.243.67.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:05:08.000Z",
      "valid_until": "2026-04-02T08:05:05.000Z"
    },
    {
      "created": "2026-03-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=327922; asn_org=Perlcom-iSPOT",
      "id": "indicator--31e8aac4-aec0-4e65-9790-3b5ebbcbd54f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '169.239.47.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:05:08.000Z",
      "valid_until": "2026-04-02T08:05:05.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-03T13:21:29.485Z",
      "x_nadsec_last_seen": "2026-03-20T05:36:26.467Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "327922"
      ],
      "x_nadsec_orgs": [
        "Perlcom-iSPOT"
      ]
    },
    {
      "created": "2026-03-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=44443; asn_org=LLC Inovatsiyni Telekomunikatsii",
      "id": "indicator--b0962fde-d631-421a-907d-ea952bacef6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.227.246.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:05:08.000Z",
      "valid_until": "2026-04-02T08:05:05.000Z"
    },
    {
      "created": "2026-03-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=27651; asn_org=ENTEL CHILE S.A.",
      "id": "indicator--aa4d6a75-cf96-4bdb-bf43-2c29eace8059",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.67.227.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:05:08.000Z",
      "valid_until": "2026-04-02T08:05:05.000Z"
    },
    {
      "created": "2026-03-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--d64a6aa1-7251-497f-8148-71b4d4e937aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.153.218.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:05:08.000Z",
      "valid_until": "2026-04-02T08:05:05.000Z"
    },
    {
      "created": "2026-03-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b79f2bc3-1cd2-43a9-a025-f0d6da7b27f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:05:08.000Z",
      "valid_until": "2026-04-02T08:05:05.000Z"
    },
    {
      "created": "2026-03-01T08:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--d11578f8-dc37-4e7c-bf13-41662a7c2447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T08:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:05:08.000Z",
      "valid_until": "2026-04-02T08:05:05.000Z",
      "x_nadsec_event_count": 143,
      "x_nadsec_first_seen": "2026-03-02T11:08:37.442Z",
      "x_nadsec_last_seen": "2026-03-31T17:38:07.997Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-03-01T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=196786; asn_org=IP Yashutkin Andrei Vladimirovich",
      "id": "indicator--dcebd298-cc8e-496f-baf7-6d6324b0fa46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.207.224.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:05:12.000Z",
      "valid_until": "2026-04-02T09:05:11.000Z"
    },
    {
      "created": "2026-03-01T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c5820a3b-b70f-4a82-a594-ae97ce0aabb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.25.61.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:05:12.000Z",
      "valid_until": "2026-04-02T09:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T03:41:26.271Z",
      "x_nadsec_last_seen": "2026-03-31T03:43:30.987Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-01T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--22b7c063-1c4a-4e37-94be-71f9902d2ef8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.30.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:05:12.000Z",
      "valid_until": "2026-04-02T09:05:11.000Z"
    },
    {
      "created": "2026-03-01T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PE; asn=272801; asn_org=RED AMONES S.A.C.; user(top)=**",
      "id": "indicator--81ba3903-063f-4705-aa12-e77d9d542fdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.63.6.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:05:12.000Z",
      "valid_until": "2026-04-02T09:05:11.000Z"
    },
    {
      "created": "2026-03-01T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--c107c1fd-6a8d-47de-bd8e-94e99f1d4b3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.71.113.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:05:12.000Z",
      "valid_until": "2026-04-02T09:05:11.000Z"
    },
    {
      "created": "2026-03-01T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--8f8c24f5-7122-4e02-ac46-ac323b867fde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:05:12.000Z",
      "valid_until": "2026-04-02T09:05:11.000Z"
    },
    {
      "created": "2026-03-01T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--adc1f1dd-a700-4a52-8085-b6a6fbc2e5a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.161.121.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:05:12.000Z",
      "valid_until": "2026-04-02T09:05:11.000Z"
    },
    {
      "created": "2026-03-01T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=10834; asn_org=Telefonica de Argentina",
      "id": "indicator--5b5b4372-98e7-4bc4-88c6-cf15c2fd6624",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.16.128.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:05:12.000Z",
      "valid_until": "2026-04-02T09:05:11.000Z"
    },
    {
      "created": "2026-03-01T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--78b5dde1-9ade-45f5-8e36-688cef9eb8e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.105.101.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:05:12.000Z",
      "valid_until": "2026-04-02T09:05:11.000Z"
    },
    {
      "created": "2026-03-01T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.129.187.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:05:12.000Z",
      "valid_until": "2026-04-02T09:05:11.000Z",
      "x_nadsec_event_count": 154,
      "x_nadsec_first_seen": "2026-03-03T04:15:42.116Z",
      "x_nadsec_last_seen": "2026-03-30T05:21:56.755Z",
      "x_nadsec_ports": [
        "1433",
        "81",
        "445",
        "27017",
        "3306",
        "1723",
        "21"
      ],
      "x_nadsec_services": [
        "mssqld",
        "httpd",
        "smbd",
        "mongod",
        "mysqld",
        "pptpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-01T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--fc6a62d4-3621-4c46-880e-6dafe987491c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:05:12.000Z",
      "valid_until": "2026-04-02T09:05:11.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-03-02T04:12:57.167Z",
      "x_nadsec_last_seen": "2026-03-29T22:32:45.503Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-03-01T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--94bd3a79-e150-4a67-8714-1bfad56e6721",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.189.224.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:05:12.000Z",
      "valid_until": "2026-04-02T09:05:11.000Z"
    },
    {
      "created": "2026-03-01T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--d2dded84-0afa-41d9-9b2a-faf0b35b34c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.53.38.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:05:13.000Z",
      "valid_until": "2026-04-02T10:05:12.000Z"
    },
    {
      "created": "2026-03-01T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--7238d5db-41d4-4d5f-beba-76a62cd3098d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.79.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:05:13.000Z",
      "valid_until": "2026-04-02T10:05:12.000Z"
    },
    {
      "created": "2026-03-01T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--0ee4c896-6167-4e9d-8217-71f068b38751",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.74.38.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:05:13.000Z",
      "valid_until": "2026-04-02T10:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T01:50:51.491Z",
      "x_nadsec_last_seen": "2026-03-05T01:50:51.491Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-03-01T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=35104; asn_org=Jusan Mobile JSC",
      "id": "indicator--24425d4d-518e-41e1-b93a-ace90ecaa229",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.127.35.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:05:13.000Z",
      "valid_until": "2026-04-02T10:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T20:51:28.094Z",
      "x_nadsec_last_seen": "2026-03-27T20:53:35.259Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "35104"
      ],
      "x_nadsec_orgs": [
        "Jusan Mobile JSC"
      ]
    },
    {
      "created": "2026-03-01T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5db02f6d-dd08-43c8-badb-ce889c8c4847",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:05:13.000Z",
      "valid_until": "2026-04-02T10:05:12.000Z"
    },
    {
      "created": "2026-03-01T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--fbf40437-fc36-4023-b823-807f6e3dce7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:05:13.000Z",
      "valid_until": "2026-04-02T10:05:12.000Z"
    },
    {
      "created": "2026-03-01T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=52043; asn_org=LLC Multiservice",
      "id": "indicator--06ba4c14-d353-4b6c-826e-80fce4fbd27b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.151.241.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:05:13.000Z",
      "valid_until": "2026-04-02T10:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-17T22:34:46.258Z",
      "x_nadsec_last_seen": "2026-03-21T00:56:28.778Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "52043"
      ],
      "x_nadsec_orgs": [
        "LLC Multiservice"
      ]
    },
    {
      "created": "2026-03-01T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:05:13.000Z",
      "valid_until": "2026-04-02T10:05:12.000Z"
    },
    {
      "created": "2026-03-01T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--6db49d8c-94b7-4925-96ff-116599121978",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:05:13.000Z",
      "valid_until": "2026-04-02T10:05:12.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-03-05T19:04:35.439Z",
      "x_nadsec_last_seen": "2026-03-29T18:17:46.770Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-03-01T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=10796; asn_org=Charter Communications Inc",
      "id": "indicator--7797c1b3-70a3-4729-b458-2ecad409e178",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.142.67.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:05:13.000Z",
      "valid_until": "2026-04-02T10:05:12.000Z"
    },
    {
      "created": "2026-03-01T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--3a4444c3-b356-45e7-99fd-89aa86ccc295",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.237.16.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:05:13.000Z",
      "valid_until": "2026-04-02T10:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T05:56:21.580Z",
      "x_nadsec_last_seen": "2026-03-10T05:58:26.694Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-03-01T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mysqld; ports=3306; cc=CN; asn=136180; asn_org=Beijing Tiantexin Tech. Co., Ltd.",
      "id": "indicator--fb763fbb-1e0a-42d0-9ca7-982cd2e23a6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.203.57.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:05:12.000Z",
      "valid_until": "2026-04-02T11:05:11.000Z",
      "x_nadsec_event_count": 25,
      "x_nadsec_first_seen": "2026-03-11T09:09:43.682Z",
      "x_nadsec_last_seen": "2026-03-26T23:59:51.756Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "136180"
      ],
      "x_nadsec_orgs": [
        "Beijing Tiantexin Tech. Co., Ltd."
      ]
    },
    {
      "created": "2026-03-01T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=LK; asn=18001; asn_org=Dialog Axiata PLC.",
      "id": "indicator--c492e768-325f-4a50-82e6-43f529f54051",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.231.8.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:05:12.000Z",
      "valid_until": "2026-04-02T11:05:11.000Z"
    },
    {
      "created": "2026-03-01T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--35e85297-fbf3-4d8b-8ee1-836c5db8edbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.214.54.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:05:12.000Z",
      "valid_until": "2026-04-02T11:05:11.000Z"
    },
    {
      "created": "2026-03-01T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--521a0a9c-22f0-496d-999c-02a885a80324",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:05:12.000Z",
      "valid_until": "2026-04-02T11:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T15:44:26.209Z",
      "x_nadsec_last_seen": "2026-03-10T17:35:35.635Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-01T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--b21fd1b0-8ac3-4c72-b228-d52c7e8d58e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.127.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:05:12.000Z",
      "valid_until": "2026-04-02T11:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T20:17:18.661Z",
      "x_nadsec_last_seen": "2026-03-06T20:17:48.660Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-01T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=17072; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--e7bda2a7-cef8-45e2-9bb0-d639f46cd142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.189.58.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:05:12.000Z",
      "valid_until": "2026-04-02T11:05:11.000Z"
    },
    {
      "created": "2026-03-01T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=36935; asn_org=Vodafone-EG",
      "id": "indicator--a7606301-112a-4e64-b2db-ca8f17df6a8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.128.227.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:05:12.000Z",
      "valid_until": "2026-04-02T11:05:11.000Z"
    },
    {
      "created": "2026-03-01T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--57ecbd00-8c32-4d1b-993e-e90fbf0b8b5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.233.5.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:05:12.000Z",
      "valid_until": "2026-04-02T11:05:11.000Z"
    },
    {
      "created": "2026-03-01T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--27c7b285-20c4-4738-9b60-6b5c4f638c8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:05:12.000Z",
      "valid_until": "2026-04-02T11:05:11.000Z"
    },
    {
      "created": "2026-03-01T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--6fe99a61-e033-4f1f-889c-b5250d94a28f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.74.51.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:05:12.000Z",
      "valid_until": "2026-04-02T11:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T06:52:29.915Z",
      "x_nadsec_last_seen": "2026-03-21T06:53:09.674Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-01T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--4cfbed3f-9213-4ff2-8772-f4306cb1f465",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:05:12.000Z",
      "valid_until": "2026-04-02T11:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T19:08:16.493Z",
      "x_nadsec_last_seen": "2026-03-08T06:21:37.336Z",
      "x_nadsec_ports": [
        "81",
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-01T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=141816; asn_org=Velankani Information Systems Limited",
      "id": "indicator--83f68770-47ba-445c-bf64-2e72258c74ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.89.8.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:05:14.000Z",
      "valid_until": "2026-04-02T12:05:12.000Z"
    },
    {
      "created": "2026-03-01T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=35815; asn_org=LLC Cifrovie Seti Urala",
      "id": "indicator--15b797fa-0a04-4d44-b6a9-0a4596968fc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.198.118.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:05:14.000Z",
      "valid_until": "2026-04-02T12:05:12.000Z"
    },
    {
      "created": "2026-03-01T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9758775f-0df4-424b-b038-26bfc6b9a5ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:05:14.000Z",
      "valid_until": "2026-04-02T12:05:12.000Z"
    },
    {
      "created": "2026-03-01T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IT; asn=49088; asn_org=Telmekom Srl",
      "id": "indicator--f20936a7-8646-4d43-be90-ba552d4f8e9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.216.184.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:05:14.000Z",
      "valid_until": "2026-04-02T12:05:12.000Z"
    },
    {
      "created": "2026-03-01T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IR; asn=213790; asn_org=Limited Network LTD",
      "id": "indicator--f5a37c75-8cde-4507-afb7-2f2e53770137",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:05:14.000Z",
      "valid_until": "2026-04-02T12:05:12.000Z"
    },
    {
      "created": "2026-03-01T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--b71c1d3e-c63b-49a3-968f-eecceb352859",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.53.15.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:05:14.000Z",
      "valid_until": "2026-04-02T12:05:12.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-05T02:16:52.681Z",
      "x_nadsec_last_seen": "2026-03-27T16:52:12.043Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-01T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d7d5433c-f24b-44e7-9f25-dc8a04ded954",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:05:14.000Z",
      "valid_until": "2026-04-02T12:05:12.000Z"
    },
    {
      "created": "2026-03-01T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--e30990f4-7daa-4c85-a944-4264d37404be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.32.224.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:05:14.000Z",
      "valid_until": "2026-04-02T12:05:12.000Z"
    },
    {
      "created": "2026-03-01T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--46a26322-ea99-43f9-ae21-3cbae08e990a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:05:14.000Z",
      "valid_until": "2026-04-02T12:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T14:55:14.989Z",
      "x_nadsec_last_seen": "2026-03-29T14:21:08.666Z",
      "x_nadsec_ports": [
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-01T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--077052b5-b7b8-44a8-a15a-85153cf11193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:05:14.000Z",
      "valid_until": "2026-04-02T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T13:17:38.716Z",
      "x_nadsec_last_seen": "2026-03-29T00:21:10.783Z",
      "x_nadsec_ports": [
        "445",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-01T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--9e00d84f-f583-40a0-a761-ef17d982ef62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.36.97.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:05:13.000Z",
      "valid_until": "2026-04-02T13:05:11.000Z"
    },
    {
      "created": "2026-03-01T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e0201f34-1fc9-4fa0-be1f-11e8566dc1e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.209.41.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:05:13.000Z",
      "valid_until": "2026-04-02T13:05:11.000Z"
    },
    {
      "created": "2026-03-01T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AZ; asn=57293; asn_org=AG Telekom MMC.",
      "id": "indicator--7f54530f-12c1-45e4-89a8-fd7dc2fcf146",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '149.255.155.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:05:13.000Z",
      "valid_until": "2026-04-02T13:05:11.000Z"
    },
    {
      "created": "2026-03-01T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d49f0bc9-23dd-402f-b579-8bcc3247d90c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.35.202.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:05:13.000Z",
      "valid_until": "2026-04-02T13:05:11.000Z"
    },
    {
      "created": "2026-03-01T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=46606; asn_org=Unified Layer",
      "id": "indicator--ec6c87ad-652c-453f-badc-1dcc15e37fab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.214.98.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:05:13.000Z",
      "valid_until": "2026-04-02T13:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T23:50:43.588Z",
      "x_nadsec_last_seen": "2026-03-20T15:09:42.777Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "46606"
      ],
      "x_nadsec_orgs": [
        "Unified Layer"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-01T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MD; asn=8926; asn_org=Moldtelecom SA",
      "id": "indicator--4fe10e10-158a-4ddf-8747-912996a5deac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.237.24.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:05:13.000Z",
      "valid_until": "2026-04-02T13:05:11.000Z"
    },
    {
      "created": "2026-03-01T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:05:13.000Z",
      "valid_until": "2026-04-02T13:05:11.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-04T05:20:42.841Z",
      "x_nadsec_last_seen": "2026-03-29T12:07:33.843Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-01T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=RU; asn=216473; asn_org=Bashinskii Vadim Ruslanovich",
      "id": "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.66.83.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:05:13.000Z",
      "valid_until": "2026-04-02T13:05:11.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-07T20:01:15.735Z",
      "x_nadsec_last_seen": "2026-03-23T13:27:04.438Z",
      "x_nadsec_ports": [
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "216473"
      ],
      "x_nadsec_orgs": [
        "Bashinskii Vadim Ruslanovich"
      ]
    },
    {
      "created": "2026-03-01T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--cc3a9061-e763-49c4-b841-41116c75a409",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.169.252.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:05:13.000Z",
      "valid_until": "2026-04-02T14:05:12.000Z"
    },
    {
      "created": "2026-03-01T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--1b693759-2ed0-4245-94cf-1783e3538f57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.222.226.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:05:13.000Z",
      "valid_until": "2026-04-02T14:05:12.000Z"
    },
    {
      "created": "2026-03-01T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=58461; asn_org=CT-HangZhou-IDC",
      "id": "indicator--7c627d8b-054d-40ae-956c-843a8e92ed5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.231.78.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:05:13.000Z",
      "valid_until": "2026-04-02T14:05:12.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-03-02T19:41:36.206Z",
      "x_nadsec_last_seen": "2026-03-31T19:33:23.883Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "3306",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mysqld",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "58461"
      ],
      "x_nadsec_orgs": [
        "CT-HangZhou-IDC"
      ]
    },
    {
      "created": "2026-03-01T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=JP; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--d5b30679-0fa1-445a-9285-d1fb308b002f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.162.117.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:05:13.000Z",
      "valid_until": "2026-04-02T14:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-05T22:11:22.307Z",
      "x_nadsec_last_seen": "2026-03-30T10:38:32.824Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-01T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CZ; asn=9009; asn_org=M247 Europe SRL; user(top)=n****4; pass(top)=n**a",
      "id": "indicator--3a75971c-fd5f-48a5-88c1-e384f74c1e20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.216.35.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:05:13.000Z",
      "valid_until": "2026-04-02T14:05:12.000Z"
    },
    {
      "created": "2026-03-01T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=14259; asn_org=Gtd Internet S.A.",
      "id": "indicator--cb51a6b7-37d3-4a31-914d-9f8aaff67644",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.96.68.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:05:13.000Z",
      "valid_until": "2026-04-02T14:05:12.000Z"
    },
    {
      "created": "2026-03-01T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited",
      "id": "indicator--aaba4acc-4ff8-4b7a-8316-102ef21fdba9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.234.184.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:05:13.000Z",
      "valid_until": "2026-04-02T14:05:12.000Z"
    },
    {
      "created": "2026-03-01T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--9680d567-2b3d-4c7e-a94f-e15eb8f4f636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:05:13.000Z",
      "valid_until": "2026-04-02T14:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T11:49:11.855Z",
      "x_nadsec_last_seen": "2026-03-30T14:12:36.752Z",
      "x_nadsec_ports": [
        "27017",
        "21",
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "mongod",
        "epmapper",
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-01T15:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--53228730-f81c-448e-8585-caa8a62b072c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.212.85.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:05:12.000Z",
      "valid_until": "2026-04-02T15:05:11.000Z"
    },
    {
      "created": "2026-03-01T15:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=24088; asn_org=Hanoi Telecom Joint Stock Company - HCMC Branch",
      "id": "indicator--7ab66f43-6eb8-41b9-b009-6f7e0f52397e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.0.17.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:05:12.000Z",
      "valid_until": "2026-04-02T15:05:11.000Z"
    },
    {
      "created": "2026-03-01T15:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=28669; asn_org=VERO S.A",
      "id": "indicator--d06459ad-d77f-4574-950c-b993b87d9d20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.108.42.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:05:12.000Z",
      "valid_until": "2026-04-02T15:05:11.000Z"
    },
    {
      "created": "2026-03-01T15:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation; user(top)=**",
      "id": "indicator--be6d430f-d03e-427e-86f4-e990aeb6c581",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.121.49.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:05:12.000Z",
      "valid_until": "2026-04-02T15:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T11:03:29.460Z",
      "x_nadsec_last_seen": "2026-03-16T11:03:29.558Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-01T15:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--f69509ee-0f3c-4e14-bf1f-43dd1f4160fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.194.5.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:05:12.000Z",
      "valid_until": "2026-04-02T15:05:11.000Z"
    },
    {
      "created": "2026-03-01T15:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:05:12.000Z",
      "valid_until": "2026-04-02T15:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T11:53:23.698Z",
      "x_nadsec_last_seen": "2026-03-28T10:26:18.997Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "81",
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld",
        "epmapper",
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-01T15:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--192477f9-56e9-4e8b-a2c1-f79a4cec0730",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:05:12.000Z",
      "valid_until": "2026-04-02T15:05:11.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-03-03T01:35:34.301Z",
      "x_nadsec_last_seen": "2026-03-31T13:58:53.778Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-03-01T15:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--30b43fe2-ee1b-4799-b868-cf7be8d237a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:05:12.000Z",
      "valid_until": "2026-04-02T15:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T13:14:00.277Z",
      "x_nadsec_last_seen": "2026-03-26T13:14:00.574Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-01T15:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=29190; asn_org=MTS PJSC",
      "id": "indicator--765b38ad-94b5-4830-9fac-521eb1055c40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.94.204.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:05:12.000Z",
      "valid_until": "2026-04-02T15:05:11.000Z"
    },
    {
      "created": "2026-03-01T15:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--a11502b5-83fd-436e-9e27-9602ad27ed23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T15:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.96.67.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:05:12.000Z",
      "valid_until": "2026-04-02T15:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T12:21:51.420Z",
      "x_nadsec_last_seen": "2026-03-15T12:23:58.169Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-03-01T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=136119; asn_org=PT Bali Towerindo Sentra, Tbk",
      "id": "indicator--db21abdf-efaa-419f-8cf3-7e4d63243d43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.138.40.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:05:13.000Z",
      "valid_until": "2026-04-02T16:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T05:25:50.753Z",
      "x_nadsec_last_seen": "2026-03-19T02:12:50.142Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "136119"
      ],
      "x_nadsec_orgs": [
        "PT Bali Towerindo Sentra, Tbk"
      ]
    },
    {
      "created": "2026-03-01T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9658; asn_org=Eastern Telecoms Phils., Inc.",
      "id": "indicator--82340bd0-b4bf-4d26-b6c7-1e202e9e75bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.84.253.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:05:13.000Z",
      "valid_until": "2026-04-02T16:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-14T12:29:45.721Z",
      "x_nadsec_last_seen": "2026-03-14T12:56:43.712Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9658"
      ],
      "x_nadsec_orgs": [
        "Eastern Telecoms Phils., Inc."
      ]
    },
    {
      "created": "2026-03-01T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=JP; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--dcc0c787-3972-496f-99be-8a90d75bb601",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.162.70.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:05:13.000Z",
      "valid_until": "2026-04-02T16:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T22:33:28.044Z",
      "x_nadsec_last_seen": "2026-03-28T17:17:35.759Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-01T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--29c865ec-dee9-4f50-a77a-efbc247ee7a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:05:13.000Z",
      "valid_until": "2026-04-02T16:05:12.000Z"
    },
    {
      "created": "2026-03-01T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--e7165df4-de32-491d-bd33-b66a17373e9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:05:13.000Z",
      "valid_until": "2026-04-02T16:05:12.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-03-06T19:55:33.288Z",
      "x_nadsec_last_seen": "2026-03-25T15:57:46.764Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "135",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "epmapper",
        "mqttd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-03-01T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=35004; asn_org=Branch Enterprise Netgroup-Service",
      "id": "indicator--e48f610e-7978-49b3-90ae-9f6a8d4f2f2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.74.72.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:05:13.000Z",
      "valid_until": "2026-04-02T16:05:12.000Z"
    },
    {
      "created": "2026-03-01T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e87370b5-a40c-4dda-b7a3-79eb8c13519a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:05:13.000Z",
      "valid_until": "2026-04-02T16:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T03:50:08.362Z",
      "x_nadsec_last_seen": "2026-03-08T03:50:08.362Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-01T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--db6e29cf-f35b-40c6-bab7-c5c801aba30d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:05:13.000Z",
      "valid_until": "2026-04-02T16:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T18:34:41.663Z",
      "x_nadsec_last_seen": "2026-03-24T18:34:41.663Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-01T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CA; asn=16276; asn_org=OVH SAS",
      "id": "indicator--c77b8275-22d2-405b-9f48-7ad84ad26c34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.27.77.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:05:13.000Z",
      "valid_until": "2026-04-02T16:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T11:34:05.825Z",
      "x_nadsec_last_seen": "2026-03-05T11:34:05.825Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-01T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KW; asn=47589; asn_org=Kuwait Telecommunications Company K.S.C.C.",
      "id": "indicator--f61183ff-76ed-4adf-8cba-df8a704965fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.231.159.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:05:13.000Z",
      "valid_until": "2026-04-02T16:05:12.000Z"
    },
    {
      "created": "2026-03-01T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--f86e1fa7-9bed-4e1a-9159-d16c50bf708c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.116.162.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:05:13.000Z",
      "valid_until": "2026-04-02T16:05:12.000Z"
    },
    {
      "created": "2026-03-01T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--f8d55015-14c6-46ff-88c7-0be5dc4f9f68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.13.6.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:05:13.000Z",
      "valid_until": "2026-04-02T16:05:12.000Z"
    },
    {
      "created": "2026-03-01T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=BG; asn=213438; asn_org=ColocaTel Inc.; user(top)=r**t",
      "id": "indicator--5a55d2d7-a47e-489d-bfbb-00efff55689b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:05:13.000Z",
      "valid_until": "2026-04-02T16:05:12.000Z",
      "x_nadsec_event_count": 368,
      "x_nadsec_first_seen": "2026-03-02T17:39:45.642Z",
      "x_nadsec_last_seen": "2026-03-14T23:34:46.656Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t",
        "f**a"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-01T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=122; services=mysqld; ports=3306; cc=BD; asn=38592; asn_org=Chittagong Online Limited AS38592 AP; user(top)=d****r",
      "id": "indicator--074b427f-b506-4f50-abde-94ccbbe1b04f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.2.163.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:05:14.000Z",
      "valid_until": "2026-04-02T17:05:14.000Z"
    },
    {
      "created": "2026-03-01T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=38841; asn_org=kbro CO. Ltd.",
      "id": "indicator--981b882c-7459-42f5-ad19-82dceff29b5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.232.75.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:05:14.000Z",
      "valid_until": "2026-04-02T17:05:14.000Z"
    },
    {
      "created": "2026-03-01T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--74b7d640-29b1-49bd-8b43-b01938278611",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:05:14.000Z",
      "valid_until": "2026-04-02T17:05:14.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T18:31:22.976Z",
      "x_nadsec_last_seen": "2026-03-05T18:31:22.976Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-01T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--fd220648-dc12-42c6-8b76-40cb516614aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.53.205.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:05:14.000Z",
      "valid_until": "2026-04-02T17:05:14.000Z"
    },
    {
      "created": "2026-03-01T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--40557a71-43db-4ad3-97e2-fa8502686c50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:05:14.000Z",
      "valid_until": "2026-04-02T17:05:14.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T02:06:46.783Z",
      "x_nadsec_last_seen": "2026-03-30T02:06:46.783Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-01T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--188a8f9d-9545-43f6-9f7b-27cc89bf9945",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.75.221.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:05:14.000Z",
      "valid_until": "2026-04-02T17:05:14.000Z"
    },
    {
      "created": "2026-03-01T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--4963dfad-010a-4bf8-8cec-63ee3d3ecf7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.89.82.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:05:13.000Z",
      "valid_until": "2026-04-02T18:05:11.000Z"
    },
    {
      "created": "2026-03-01T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=136180; asn_org=Beijing Tiantexin Tech. Co., Ltd.",
      "id": "indicator--644f511c-ad18-41de-a645-5310b8d3d4b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.203.57.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:05:13.000Z",
      "valid_until": "2026-04-02T18:05:11.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-02T22:05:05.231Z",
      "x_nadsec_last_seen": "2026-03-30T03:57:43.998Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "136180"
      ],
      "x_nadsec_orgs": [
        "Beijing Tiantexin Tech. Co., Ltd."
      ]
    },
    {
      "created": "2026-03-01T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=31261; asn_org=PJSC MegaFon",
      "id": "indicator--1c5cea85-14de-48c0-a1d7-47b51bc53a5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.68.146.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:05:13.000Z",
      "valid_until": "2026-04-02T18:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T07:03:59.203Z",
      "x_nadsec_last_seen": "2026-03-16T07:04:03.181Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31261"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--1be9df20-8223-4441-8556-476b70cdeccc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.36.116.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z"
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KR; asn=9318; asn_org=SK Broadband Co Ltd",
      "id": "indicator--715faa72-56ac-40a5-b3fa-48b4b8c57368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.200.239.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-06T08:14:53.279Z",
      "x_nadsec_last_seen": "2026-03-09T08:06:18.522Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "9318"
      ],
      "x_nadsec_orgs": [
        "SK Broadband Co Ltd"
      ]
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BD; asn=137967; asn_org=Digicon Telecommunication Ltd",
      "id": "indicator--e60d171f-b434-4285-b81a-a922d39a1b48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.204.151.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z"
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--29df78dc-5d9c-403a-bd85-2e105be52f3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.138.18.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z",
      "x_nadsec_event_count": 36,
      "x_nadsec_first_seen": "2026-03-03T21:58:37.202Z",
      "x_nadsec_last_seen": "2026-03-31T06:09:44.290Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=pptpd; ports=1723; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '16.58.56.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z",
      "x_nadsec_event_count": 234,
      "x_nadsec_first_seen": "2026-03-02T08:42:16.729Z",
      "x_nadsec_last_seen": "2026-03-31T23:21:58.048Z",
      "x_nadsec_ports": [
        "81",
        "1433",
        "27017",
        "445",
        "3306",
        "1723",
        "21"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld",
        "mongod",
        "mysqld",
        "smbd",
        "pptpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=AE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--8a26bfd0-f704-4ccd-883a-7c71ae84955c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.12.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z"
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5eb66a91-d2e2-4875-ab7e-02eb06af0937",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z"
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=262468; asn_org=Natel Telecom Ltda. - ME",
      "id": "indicator--f8fefba1-ba0d-4ecf-bf99-3e644bdf261e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.108.56.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z"
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--e5ef70ba-2836-4a5a-8693-5b75fa1c2d37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.203.160.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T17:07:48.506Z",
      "x_nadsec_last_seen": "2026-03-19T17:09:53.738Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--0d30ac1f-3e0d-49c8-8800-47927babd0b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.243.156.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z"
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=8560; asn_org=IONOS SE",
      "id": "indicator--6a0515c6-bcb8-488f-996b-064229668a64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.154.78.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z"
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mongod; ports=27017; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.131.220.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z",
      "x_nadsec_event_count": 124,
      "x_nadsec_first_seen": "2026-03-02T20:59:30.291Z",
      "x_nadsec_last_seen": "2026-03-31T17:54:46.181Z",
      "x_nadsec_ports": [
        "27017",
        "1433",
        "445",
        "1723",
        "3306",
        "81",
        "21"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld",
        "smbd",
        "pptpd",
        "mysqld",
        "httpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=15774; asn_org=Limited Liability Company TTK-Svyaz",
      "id": "indicator--7db03c63-4bbf-4a57-a8a9-d5ad9498bc41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.132.103.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z"
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--214a98ec-597d-4b9b-9015-c66afefdf554",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z"
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3131330e-470b-4e1a-87c5-9df2d3181696",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z"
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--bb02889d-b738-4484-9ece-93e3bac03341",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T23:24:42.498Z",
      "x_nadsec_last_seen": "2026-03-02T23:24:42.498Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-01T19:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--36d28d72-5089-4e17-bbf2-00b0b2c41064",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T19:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:05:12.000Z",
      "valid_until": "2026-04-02T19:05:12.000Z"
    },
    {
      "created": "2026-03-01T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=58466; asn_org=CHINANET Guangdong province network; user(top)=r**t",
      "id": "indicator--88ac21b1-a688-43bc-8e17-940d2cbe806c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.75.189.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:05:12.000Z",
      "valid_until": "2026-04-02T20:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T17:46:18.220Z",
      "x_nadsec_last_seen": "2026-03-27T17:46:18.220Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "58466"
      ],
      "x_nadsec_orgs": [
        "CHINANET Guangdong province network"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-01T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--8866f397-3e12-45cd-a2a3-dc1c11711822",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.193.58.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:05:12.000Z",
      "valid_until": "2026-04-02T20:05:11.000Z"
    },
    {
      "created": "2026-03-01T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--16e93605-5d1a-40fb-b2f5-4937a32113f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.190.63.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:05:12.000Z",
      "valid_until": "2026-04-02T20:05:11.000Z"
    },
    {
      "created": "2026-03-01T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--154ce8af-eedd-4ea5-ae2b-e46003bed7c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:05:12.000Z",
      "valid_until": "2026-04-02T20:05:11.000Z"
    },
    {
      "created": "2026-03-01T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--32c1eed6-1671-418c-afde-ac764fb49c2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:05:12.000Z",
      "valid_until": "2026-04-02T20:05:11.000Z"
    },
    {
      "created": "2026-03-01T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--77726002-5bbb-4d0f-9e1c-dfbaa28953b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:05:12.000Z",
      "valid_until": "2026-04-02T20:05:11.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-02T13:10:30.167Z",
      "x_nadsec_last_seen": "2026-03-16T16:34:32.493Z",
      "x_nadsec_ports": [
        "81",
        "445"
      ],
      "x_nadsec_services": [
        "httpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-01T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=50219; asn_org=Valence Technology Co.",
      "id": "indicator--303ae204-7771-4a1a-bec0-1d30f1d4f8e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:05:12.000Z",
      "valid_until": "2026-04-02T20:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T18:04:53.359Z",
      "x_nadsec_last_seen": "2026-03-25T20:55:08.877Z",
      "x_nadsec_ports": [
        "81",
        "1433"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "50219"
      ],
      "x_nadsec_orgs": [
        "Valence Technology Co."
      ]
    },
    {
      "created": "2026-03-01T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=12876; asn_org=Scaleway S.a.s.",
      "id": "indicator--e9ab10c0-a3c5-4e64-bd9e-7cbaf071ea44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.154.200.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:05:12.000Z",
      "valid_until": "2026-04-02T20:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T02:17:38.443Z",
      "x_nadsec_last_seen": "2026-03-07T09:28:10.334Z",
      "x_nadsec_ports": [
        "1433",
        "3306",
        "81",
        "135",
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld",
        "epmapper",
        "httpd",
        "mongod",
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "12876"
      ],
      "x_nadsec_orgs": [
        "Scaleway S.a.s."
      ]
    },
    {
      "created": "2026-03-01T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=VN; asn=38731; asn_org=CHT Compamy Ltd; user(top)=**",
      "id": "indicator--42d30a3b-b02c-436b-a749-748175d847d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.211.127.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:05:12.000Z",
      "valid_until": "2026-04-02T20:05:11.000Z",
      "x_nadsec_event_count": 24,
      "x_nadsec_first_seen": "2026-03-03T04:50:17.020Z",
      "x_nadsec_last_seen": "2026-03-25T22:58:17.557Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "38731"
      ],
      "x_nadsec_orgs": [
        "CHT Compamy Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-01T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--e9518c9f-6bf5-4a3d-94e5-abd9d19dad3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.65.226.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:05:12.000Z",
      "valid_until": "2026-04-02T20:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T10:57:28.562Z",
      "x_nadsec_last_seen": "2026-03-25T10:59:35.342Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-03-01T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=39891; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--12007d0d-19d8-4dfc-aa1f-a195d51aa695",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '51.253.164.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:05:12.000Z",
      "valid_until": "2026-04-02T20:05:11.000Z"
    },
    {
      "created": "2026-03-01T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=38713; asn_org=Broadband ISP, FTTH and Cable Service Provider",
      "id": "indicator--bb33dde6-fd49-4a7b-a7fa-8f604e8554d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.205.177.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:05:13.000Z",
      "valid_until": "2026-04-02T21:05:11.000Z"
    },
    {
      "created": "2026-03-01T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--3c867ec4-efd1-4fc2-a39e-0f88e156a837",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.121.159.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:05:13.000Z",
      "valid_until": "2026-04-02T21:05:11.000Z"
    },
    {
      "created": "2026-03-01T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--096a68c3-1166-477e-ba08-71caec8379f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.68.134.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:05:13.000Z",
      "valid_until": "2026-04-02T21:05:11.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-15T19:40:47.717Z",
      "x_nadsec_last_seen": "2026-03-27T05:52:07.581Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "42",
        "81",
        "135",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-01T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--1b7192e2-9a5a-471b-8268-6caad35c1775",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.233.37.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:05:13.000Z",
      "valid_until": "2026-04-02T21:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T12:57:31.528Z",
      "x_nadsec_last_seen": "2026-03-04T12:57:31.791Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-01T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--8d830343-a857-48f4-bc55-e25ffe9a8b5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.223.251.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:05:13.000Z",
      "valid_until": "2026-04-02T21:05:11.000Z"
    },
    {
      "created": "2026-03-01T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--82eec08a-9ef1-46b8-a985-58ab3286bfee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.203.233.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:05:13.000Z",
      "valid_until": "2026-04-02T21:05:11.000Z"
    },
    {
      "created": "2026-03-01T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--28ada440-35f1-4f0a-9faf-de12062b1e9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.20.93.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:05:13.000Z",
      "valid_until": "2026-04-02T22:05:12.000Z"
    },
    {
      "created": "2026-03-01T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--4a974092-b5ea-4cae-b967-a8181f88943d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.74.2.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:05:13.000Z",
      "valid_until": "2026-04-02T22:05:12.000Z"
    },
    {
      "created": "2026-03-01T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--b29a927b-2784-4846-b670-903fc8073dae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.44.106.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:05:13.000Z",
      "valid_until": "2026-04-02T22:05:12.000Z"
    },
    {
      "created": "2026-03-01T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=RU; asn=214664; asn_org=JSC Buduschee",
      "id": "indicator--7bf855b2-2c0f-4087-9891-5b8464f4f553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.91.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:05:13.000Z",
      "valid_until": "2026-04-02T22:05:12.000Z",
      "x_nadsec_event_count": 22,
      "x_nadsec_first_seen": "2026-03-02T19:17:59.222Z",
      "x_nadsec_last_seen": "2026-03-31T19:06:28.205Z",
      "x_nadsec_ports": [
        "27017",
        "21",
        "3306",
        "1723",
        "1433"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd",
        "mysqld",
        "pptpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "214664"
      ],
      "x_nadsec_orgs": [
        "JSC Buduschee"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s"
      ]
    },
    {
      "created": "2026-03-01T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--68d8c79f-a659-493e-a429-3b27b3fcbe01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T22:05:13.000Z",
      "valid_until": "2026-04-02T22:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T09:22:00.047Z",
      "x_nadsec_last_seen": "2026-03-17T09:22:00.047Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-01T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--04785ae2-e123-454b-a7ce-da22c8140d1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.170.210.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T23:05:13.000Z",
      "valid_until": "2026-04-02T23:05:12.000Z"
    },
    {
      "created": "2026-03-01T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ac3de06c-8570-4fb4-9db9-5c73ad9816ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T23:05:13.000Z",
      "valid_until": "2026-04-02T23:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T08:41:33.966Z",
      "x_nadsec_last_seen": "2026-03-23T23:39:43.944Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-01T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f0062450-8d01-4199-8eb7-74149f2947c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T23:05:13.000Z",
      "valid_until": "2026-04-02T23:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T17:19:28.159Z",
      "x_nadsec_last_seen": "2026-03-18T17:19:28.796Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-01T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8345; asn_org=JSC ER-Telecom Holding",
      "id": "indicator--d60e67a8-7dba-4ed8-b24f-a57beaa2110f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-01T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.185.48.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T23:05:13.000Z",
      "valid_until": "2026-04-02T23:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T19:12:35.019Z",
      "x_nadsec_last_seen": "2026-03-07T19:14:43.398Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8345"
      ],
      "x_nadsec_orgs": [
        "JSC ER-Telecom Holding"
      ]
    },
    {
      "created": "2026-03-02T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones",
      "id": "indicator--daf5b0f4-7a53-4fb4-8ec6-2e1fcbb86f54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.58.187.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:05:13.000Z",
      "valid_until": "2026-04-03T00:05:11.000Z"
    },
    {
      "created": "2026-03-02T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d9f4858c-dbe3-4bb0-ac7e-047c349cedd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.202.117.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:05:13.000Z",
      "valid_until": "2026-04-03T00:05:11.000Z"
    },
    {
      "created": "2026-03-02T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--73a2a6a1-4fcd-4d77-bdfc-5f79f8bbeb86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.203.254.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:05:13.000Z",
      "valid_until": "2026-04-03T00:05:11.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-08T09:52:50.959Z",
      "x_nadsec_last_seen": "2026-03-20T05:07:44.004Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-03-02T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CA; asn=36218; asn_org=WHG Hosting Services Ltd; user(top)=**",
      "id": "indicator--97715341-a483-48b7-9f98-0f52f837c8d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '209.42.25.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:05:13.000Z",
      "valid_until": "2026-04-03T00:05:11.000Z"
    },
    {
      "created": "2026-03-02T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=EG; asn=24863; asn_org=LINKdotNET; user(top)=**",
      "id": "indicator--12fd6bbf-1ea1-465c-92e7-160fc0917f9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.240.88.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:05:13.000Z",
      "valid_until": "2026-04-03T00:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T00:01:15.514Z",
      "x_nadsec_last_seen": "2026-03-02T00:01:15.514Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24863"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--5aaf7ab0-dcbb-4ef9-a7e3-dceab64c4625",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.96.207.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T00:05:13.000Z",
      "valid_until": "2026-04-03T00:05:11.000Z"
    },
    {
      "created": "2026-03-02T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--77177e22-b234-4e4e-8b50-7c4c41b7046a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:05:13.000Z",
      "valid_until": "2026-04-03T01:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T00:50:12.582Z",
      "x_nadsec_last_seen": "2026-03-02T00:50:12.582Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-02T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--8bb609af-94fa-4d3d-8b92-ab6a90a25162",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:05:13.000Z",
      "valid_until": "2026-04-03T01:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T00:14:42.461Z",
      "x_nadsec_last_seen": "2026-03-02T00:22:55.160Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-03-02T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=7470; asn_org=TRUE INTERNET Co.,Ltd.",
      "id": "indicator--7ee0d5fe-701f-4271-a4e3-37c6ee991a0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.103.17.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:05:13.000Z",
      "valid_until": "2026-04-03T01:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T00:59:46.171Z",
      "x_nadsec_last_seen": "2026-03-12T05:12:18.704Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "7470"
      ],
      "x_nadsec_orgs": [
        "TRUE INTERNET Co.,Ltd."
      ]
    },
    {
      "created": "2026-03-02T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--ffe14870-2840-4ecb-b1cd-8da2eb284b87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.225.193.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:05:13.000Z",
      "valid_until": "2026-04-03T01:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T01:01:51.080Z",
      "x_nadsec_last_seen": "2026-03-02T01:03:55.627Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-02T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--98431d82-ceae-4138-80b7-8e32268fd4d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.241.22.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:05:13.000Z",
      "valid_until": "2026-04-03T01:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T01:04:28.649Z",
      "x_nadsec_last_seen": "2026-03-02T01:11:35.209Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-02T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MY; asn=9930; asn_org=TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "id": "indicator--f6fe224e-4058-4e5b-a348-382b975bec22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.19.105.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:05:13.000Z",
      "valid_until": "2026-04-03T01:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T00:45:31.695Z",
      "x_nadsec_last_seen": "2026-03-02T00:45:56.686Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9930"
      ],
      "x_nadsec_orgs": [
        "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al"
      ]
    },
    {
      "created": "2026-03-02T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:05:13.000Z",
      "valid_until": "2026-04-03T01:05:11.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-02T00:19:15.755Z",
      "x_nadsec_last_seen": "2026-03-24T15:02:59.883Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "21",
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd",
        "epmapper",
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-02T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--ee4e11a4-f1d3-4603-a5d1-c4330a27ee31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.200.213.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:05:13.000Z",
      "valid_until": "2026-04-03T01:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T00:59:23.059Z",
      "x_nadsec_last_seen": "2026-03-21T19:56:18.761Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-03-02T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CA; asn=577; asn_org=Bell Canada",
      "id": "indicator--b686bd45-4c56-40df-87d5-1a1e93a9f885",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '50.100.63.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:05:13.000Z",
      "valid_until": "2026-04-03T01:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T00:47:22.576Z",
      "x_nadsec_last_seen": "2026-03-02T00:47:22.576Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "577"
      ],
      "x_nadsec_orgs": [
        "Bell Canada"
      ]
    },
    {
      "created": "2026-03-02T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=10103; asn_org=HK Broadband Network Ltd.",
      "id": "indicator--5e7d0281-0b59-4a48-94db-e0da3d5c6655",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.1.171.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:05:13.000Z",
      "valid_until": "2026-04-03T02:05:12.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-02T01:49:16.838Z",
      "x_nadsec_last_seen": "2026-03-02T02:13:48.863Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "10103"
      ],
      "x_nadsec_orgs": [
        "HK Broadband Network Ltd."
      ]
    },
    {
      "created": "2026-03-02T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CA; asn=16276; asn_org=OVH SAS",
      "id": "indicator--471a591b-6009-4681-9690-33abfdb890d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '158.69.113.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:05:13.000Z",
      "valid_until": "2026-04-03T02:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T01:18:05.745Z",
      "x_nadsec_last_seen": "2026-03-19T16:34:38.028Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5e8758c1-ab15-4fdb-a2d9-d3d63e35a076",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:05:13.000Z",
      "valid_until": "2026-04-03T02:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T01:40:05.801Z",
      "x_nadsec_last_seen": "2026-03-02T01:40:05.801Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-02T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ba7e8dc5-466a-484c-917b-25b24a23746d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.2.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:05:13.000Z",
      "valid_until": "2026-04-03T02:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T01:23:19.409Z",
      "x_nadsec_last_seen": "2026-03-02T01:23:29.555Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-02T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f16670f4-383b-4f81-a962-da677a69c725",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.171.8.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:05:13.000Z",
      "valid_until": "2026-04-03T02:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T01:30:06.531Z",
      "x_nadsec_last_seen": "2026-03-02T01:30:06.816Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-02T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cacc9598-d4d9-4fe3-9e69-450503f2ed05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.185.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:05:13.000Z",
      "valid_until": "2026-04-03T02:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T01:33:07.631Z",
      "x_nadsec_last_seen": "2026-03-03T16:32:26.924Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-02T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=GB; asn=12390; asn_org=KCOM Group Limited",
      "id": "indicator--a50b49e3-230c-4260-bb56-8a5d6d28025c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.249.198.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:05:13.000Z",
      "valid_until": "2026-04-03T02:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T01:05:32.230Z",
      "x_nadsec_last_seen": "2026-03-24T08:10:45.868Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "12390"
      ],
      "x_nadsec_orgs": [
        "KCOM Group Limited"
      ]
    },
    {
      "created": "2026-03-02T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--32c563d4-c064-4610-8707-6cc1fd0420bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '4.227.178.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:05:13.000Z",
      "valid_until": "2026-04-03T02:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T01:49:50.337Z",
      "x_nadsec_last_seen": "2026-03-02T01:50:00.541Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-02T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--6835e72c-6bea-49c4-9430-50478c37af8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.215.219.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:05:13.000Z",
      "valid_until": "2026-04-03T02:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-02T01:32:21.078Z",
      "x_nadsec_last_seen": "2026-03-22T03:57:33.488Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-02T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--e3e89b99-4ebc-4d8c-b005-83abc3198a18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.205.181.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:05:13.000Z",
      "valid_until": "2026-04-03T02:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T02:01:20.105Z",
      "x_nadsec_last_seen": "2026-03-02T02:03:25.857Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-02T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=LT; asn=24852; asn_org=UAB INIT",
      "id": "indicator--9d1c4599-4941-4da6-b6e7-49d848aefed4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.223.195.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T02:05:13.000Z",
      "valid_until": "2026-04-03T02:05:12.000Z",
      "x_nadsec_event_count": 22,
      "x_nadsec_first_seen": "2026-03-02T01:12:48.630Z",
      "x_nadsec_last_seen": "2026-03-02T18:48:26.411Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "LT"
      ],
      "x_nadsec_asns": [
        "24852"
      ],
      "x_nadsec_orgs": [
        "UAB INIT"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5007945c-2d5d-4316-8f0a-de2326ad9cfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.191.116.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:05:13.000Z",
      "valid_until": "2026-04-03T03:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T02:26:58.112Z",
      "x_nadsec_last_seen": "2026-03-02T02:29:04.668Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-02T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--b7a2d52c-0e97-45fe-8c57-8a310efc2901",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '145.255.9.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:05:13.000Z",
      "valid_until": "2026-04-03T03:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T02:45:51.686Z",
      "x_nadsec_last_seen": "2026-03-02T02:53:24.375Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-03-02T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--da6e1353-743a-4139-97e6-f17712ed432a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.234.226.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:05:13.000Z",
      "valid_until": "2026-04-03T03:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T02:24:30.540Z",
      "x_nadsec_last_seen": "2026-03-02T02:26:39.784Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-02T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HU; asn=5483; asn_org=Magyar Telekom Plc.",
      "id": "indicator--f3ca1f7d-eeff-4e77-b99c-217415f10a6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.228.146.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:05:13.000Z",
      "valid_until": "2026-04-03T03:05:12.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-03-02T02:18:48.715Z",
      "x_nadsec_last_seen": "2026-03-31T16:46:28.170Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HU"
      ],
      "x_nadsec_asns": [
        "5483"
      ],
      "x_nadsec_orgs": [
        "Magyar Telekom Plc."
      ]
    },
    {
      "created": "2026-03-02T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f7637ddf-d1a1-4081-9d15-d976d62659c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:05:13.000Z",
      "valid_until": "2026-04-03T03:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T02:54:35.624Z",
      "x_nadsec_last_seen": "2026-03-27T20:49:56.250Z",
      "x_nadsec_ports": [
        "135",
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-02T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a443f2ce-5f7d-4e8d-a1f6-0799c5e88f32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:05:13.000Z",
      "valid_until": "2026-04-03T03:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-02T02:10:13.505Z",
      "x_nadsec_last_seen": "2026-03-02T02:10:14.686Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-02T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--df6e6259-97aa-4bad-90d6-d86eb52678a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.99.136.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:05:13.000Z",
      "valid_until": "2026-04-03T03:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T02:34:38.177Z",
      "x_nadsec_last_seen": "2026-03-04T23:54:01.567Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-03-02T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--f805a635-fb27-4be9-bfee-4ebbbaa82a6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:05:13.000Z",
      "valid_until": "2026-04-03T03:05:12.000Z",
      "x_nadsec_event_count": 33,
      "x_nadsec_first_seen": "2026-03-02T02:44:48.287Z",
      "x_nadsec_last_seen": "2026-03-31T01:07:46.905Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-03-02T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:05:13.000Z",
      "valid_until": "2026-04-03T03:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T02:54:54.952Z",
      "x_nadsec_last_seen": "2026-03-16T14:15:30.791Z",
      "x_nadsec_ports": [
        "445",
        "1723",
        "27017",
        "81",
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd",
        "smbd",
        "epmapper",
        "httpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-02T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=41798; asn_org=JSC Transtelecom",
      "id": "indicator--7d48f31b-5844-4af5-9106-1f462de06165",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.185.4.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:05:13.000Z",
      "valid_until": "2026-04-03T03:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T02:23:40.561Z",
      "x_nadsec_last_seen": "2026-03-02T02:25:47.449Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "41798"
      ],
      "x_nadsec_orgs": [
        "JSC Transtelecom"
      ]
    },
    {
      "created": "2026-03-02T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=JO; asn=8376; asn_org=Jordan Data Communications Company LLC",
      "id": "indicator--5bffd8f4-3de8-4f12-b756-3ed805fb829a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.249.68.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:05:13.000Z",
      "valid_until": "2026-04-03T03:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T02:20:00.562Z",
      "x_nadsec_last_seen": "2026-03-02T02:20:00.752Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "8376"
      ],
      "x_nadsec_orgs": [
        "Jordan Data Communications Company LLC"
      ]
    },
    {
      "created": "2026-03-02T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=JO; asn=8376; asn_org=Jordan Data Communications Company LLC; user(top)=**",
      "id": "indicator--a5a7426c-b5f7-4635-8ada-a2cd72c3d628",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.249.69.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:05:13.000Z",
      "valid_until": "2026-04-03T03:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T02:43:37.694Z",
      "x_nadsec_last_seen": "2026-03-02T02:43:37.694Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "8376"
      ],
      "x_nadsec_orgs": [
        "Jordan Data Communications Company LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MY; asn=4788; asn_org=TM TECHNOLOGY SERVICES SDN. BHD.",
      "id": "indicator--042ae63a-bcb1-4e7b-916a-e25a5581e02f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.9.164.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:05:13.000Z",
      "valid_until": "2026-04-03T04:05:12.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-03-02T03:07:58.395Z",
      "x_nadsec_last_seen": "2026-03-23T13:21:31.378Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "4788"
      ],
      "x_nadsec_orgs": [
        "TM TECHNOLOGY SERVICES SDN. BHD."
      ]
    },
    {
      "created": "2026-03-02T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--890e5c03-7be4-45df-b393-9cbd8921678c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.93.144.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:05:13.000Z",
      "valid_until": "2026-04-03T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T03:31:02.282Z",
      "x_nadsec_last_seen": "2026-03-02T03:31:31.370Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-02T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--c721a23b-0c1d-432f-b266-c3bc2f7e1192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.164.120.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:05:13.000Z",
      "valid_until": "2026-04-03T04:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T03:08:32.498Z",
      "x_nadsec_last_seen": "2026-03-02T03:15:31.971Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-02T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=CL; asn=27651; asn_org=ENTEL CHILE S.A.",
      "id": "indicator--ecd2fcd7-ca9f-4012-aa77-788cc29774f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.231.104.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:05:13.000Z",
      "valid_until": "2026-04-03T04:05:12.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-02T03:06:30.212Z",
      "x_nadsec_last_seen": "2026-03-03T02:56:13.526Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "27651"
      ],
      "x_nadsec_orgs": [
        "ENTEL CHILE S.A."
      ]
    },
    {
      "created": "2026-03-02T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--b8d54a55-70e2-4943-9fa6-5180eb42524f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.188.77.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:05:13.000Z",
      "valid_until": "2026-04-03T04:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T03:33:09.605Z",
      "x_nadsec_last_seen": "2026-03-02T06:31:29.032Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-02T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--546b9b72-8bd9-4c03-8fde-8c5ceda6ec9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.134.219.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:05:13.000Z",
      "valid_until": "2026-04-03T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T04:03:06.711Z",
      "x_nadsec_last_seen": "2026-03-02T04:03:13.175Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-02T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cc5369e6-8a50-4629-b503-19316eda0d05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.171.25.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:05:13.000Z",
      "valid_until": "2026-04-03T04:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T03:08:20.415Z",
      "x_nadsec_last_seen": "2026-03-02T03:08:20.415Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-02T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--def82622-114f-46c4-b519-0806b49c4da9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:05:13.000Z",
      "valid_until": "2026-04-03T04:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T04:04:06.261Z",
      "x_nadsec_last_seen": "2026-03-18T12:50:46.568Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-02T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=271402; asn_org=Live Conect Telecomunicacoes Ltda.; user(top)=**",
      "id": "indicator--89241ed8-cccd-4ffb-a808-a25fb7767283",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.39.40.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:05:13.000Z",
      "valid_until": "2026-04-03T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T03:56:52.131Z",
      "x_nadsec_last_seen": "2026-03-16T14:22:00.731Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "271402"
      ],
      "x_nadsec_orgs": [
        "Live Conect Telecomunicacoes Ltda."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mysqld; ports=3306; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.130.168.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:05:13.000Z",
      "valid_until": "2026-04-03T04:05:12.000Z",
      "x_nadsec_event_count": 135,
      "x_nadsec_first_seen": "2026-03-02T03:20:36.823Z",
      "x_nadsec_last_seen": "2026-03-31T19:52:36.962Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "1723",
        "27017",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld",
        "pptpd",
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-02T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9c822a0a-3bc4-42ce-83fd-887b73999867",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.227.106.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:05:13.000Z",
      "valid_until": "2026-04-03T04:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T03:52:28.062Z",
      "x_nadsec_last_seen": "2026-03-02T03:54:14.403Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "445",
        "1433",
        "1723",
        "1883",
        "27017",
        "33371"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-02T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mssqld; ports=1433; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; user(top)=**; pass(top)=!******x",
      "id": "indicator--20db9219-0b27-4f94-91c9-aca69598ebdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.196.74.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:05:12.000Z",
      "valid_until": "2026-04-03T05:05:11.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-02T04:33:04.836Z",
      "x_nadsec_last_seen": "2026-03-02T04:48:37.835Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-03-02T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c72afa90-b856-465d-96ef-403962dd02c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.231.140.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:05:12.000Z",
      "valid_until": "2026-04-03T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T05:00:46.205Z",
      "x_nadsec_last_seen": "2026-03-02T05:02:50.779Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-02T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=63859; asn_org=PT. Eka Mas Republik",
      "id": "indicator--af03c3f5-8570-4e75-806f-089ad664f2a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '158.140.181.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:05:12.000Z",
      "valid_until": "2026-04-03T05:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T04:26:50.785Z",
      "x_nadsec_last_seen": "2026-03-12T12:16:11.319Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "63859"
      ],
      "x_nadsec_orgs": [
        "PT. Eka Mas Republik"
      ]
    },
    {
      "created": "2026-03-02T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--54ed3b00-91fb-4dbf-9fb3-d151ec3216b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:05:12.000Z",
      "valid_until": "2026-04-03T05:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T04:31:52.775Z",
      "x_nadsec_last_seen": "2026-03-04T00:32:28.816Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-02T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PY; asn=23201; asn_org=Telecel S.A.",
      "id": "indicator--56b71829-88b7-45b5-9a9f-73df8fa25734",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.120.140.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:05:12.000Z",
      "valid_until": "2026-04-03T05:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T04:58:49.983Z",
      "x_nadsec_last_seen": "2026-03-02T05:16:30.753Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "23201"
      ],
      "x_nadsec_orgs": [
        "Telecel S.A."
      ]
    },
    {
      "created": "2026-03-02T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--3fb2ac11-a56f-4fda-b36a-9840e8f8fe14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.253.112.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:05:12.000Z",
      "valid_until": "2026-04-03T05:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T04:39:50.833Z",
      "x_nadsec_last_seen": "2026-03-02T05:29:42.235Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-03-02T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PY; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--afcfe3a6-7fc8-4539-97e1-0680402dfc27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.182.233.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:05:12.000Z",
      "valid_until": "2026-04-03T05:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T05:03:14.845Z",
      "x_nadsec_last_seen": "2026-03-02T05:23:48.696Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-03-02T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8570; asn_org=Rostelecom",
      "id": "indicator--93fef48c-0559-4f8c-b846-6531c5f79f30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.34.241.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:05:12.000Z",
      "valid_until": "2026-04-03T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T04:31:56.675Z",
      "x_nadsec_last_seen": "2026-03-02T04:34:03.404Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8570"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-02T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--56fb010a-38e1-4927-b5cd-cc6384555213",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.161.56.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:05:12.000Z",
      "valid_until": "2026-04-03T05:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T04:07:58.693Z",
      "x_nadsec_last_seen": "2026-03-18T17:41:13.173Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-02T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--7b8f6607-3c89-4240-b4b9-8fbf68c915b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.79.132.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:05:12.000Z",
      "valid_until": "2026-04-03T05:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T04:16:18.979Z",
      "x_nadsec_last_seen": "2026-03-14T14:29:51.667Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133692; asn_org=Fastnet Communication Pvt. Ltd.",
      "id": "indicator--ecb1fd0f-9066-4bbf-82ad-ef8ecff244ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.47.218.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T05:43:53.561Z",
      "x_nadsec_last_seen": "2026-03-02T07:21:55.724Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133692"
      ],
      "x_nadsec_orgs": [
        "Fastnet Communication Pvt. Ltd."
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--81fb6f8f-4f92-4eff-b819-a6b6371aaa6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T05:30:01.071Z",
      "x_nadsec_last_seen": "2026-03-27T06:39:05.720Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--4d50633d-3af9-4da7-ae7f-0729b971a27f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T05:30:28.826Z",
      "x_nadsec_last_seen": "2026-03-27T06:39:14.318Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--58787ca8-e734-4bf6-b533-5b2aaa06b62f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-02T05:30:15.409Z",
      "x_nadsec_last_seen": "2026-03-07T03:51:31.292Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--f8296f25-ca91-4003-8ed6-12b3f3b1444b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-02T05:30:13.720Z",
      "x_nadsec_last_seen": "2026-03-10T06:43:28.274Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--2cd98388-4daf-4db9-9dc4-2c929dfacdd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T05:30:30.521Z",
      "x_nadsec_last_seen": "2026-03-27T06:39:19.480Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--b27bbbbd-7f54-44d8-98df-d22c84a3c0c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T05:30:26.306Z",
      "x_nadsec_last_seen": "2026-03-27T06:38:37.477Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--19beff39-c32e-4ecb-86f1-ac51e3772916",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-02T05:30:08.573Z",
      "x_nadsec_last_seen": "2026-03-27T06:38:47.043Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--7bfa793b-6552-486d-bbe5-6c7bd57ada29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T05:30:06.391Z",
      "x_nadsec_last_seen": "2026-03-10T06:43:16.046Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--ec4191ae-39e9-4d05-90e0-a89045947d0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T05:30:34.301Z",
      "x_nadsec_last_seen": "2026-03-27T06:39:09.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--f6a151cd-b000-479d-b7d4-95ad20815b5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T05:30:02.805Z",
      "x_nadsec_last_seen": "2026-03-27T06:39:07.439Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--7def5365-76ce-42a4-a268-b55c6f461078",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T05:29:48.205Z",
      "x_nadsec_last_seen": "2026-03-27T06:39:10.881Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--47034d4f-94de-4414-93f7-9f8de54c47f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T05:29:49.932Z",
      "x_nadsec_last_seen": "2026-03-27T06:39:12.600Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--18ba644f-a79f-429d-b9c5-ab4337551421",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T05:30:08.091Z",
      "x_nadsec_last_seen": "2026-03-10T06:42:46.290Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--8951b63d-09fc-4566-aec1-3e0f85978d4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-02T05:29:54.166Z",
      "x_nadsec_last_seen": "2026-03-27T06:39:16.039Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--5dbd0747-b985-4dcf-b5f3-62b2e92e2204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T05:29:46.519Z",
      "x_nadsec_last_seen": "2026-03-27T06:38:22.734Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--c5faa1fb-8e4b-4c64-9180-a4bef32898ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T05:30:04.650Z",
      "x_nadsec_last_seen": "2026-03-10T06:42:49.773Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--745ce08a-7d4b-4836-b5a3-087a5c72ff0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T05:29:59.345Z",
      "x_nadsec_last_seen": "2026-03-10T06:42:53.685Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--8012b978-c08d-4c9c-bf86-97017a078085",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T05:29:55.854Z",
      "x_nadsec_last_seen": "2026-03-27T06:39:17.762Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4ebc9e48-374f-4d60-987a-4ab81ae7602e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.19.9.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T05:13:14.766Z",
      "x_nadsec_last_seen": "2026-03-02T05:15:19.488Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--588f11ad-1b74-41a1-a33e-ad9499a086d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T05:40:45.854Z",
      "x_nadsec_last_seen": "2026-03-11T00:40:01.002Z",
      "x_nadsec_ports": [
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ZA; asn=37549; asn_org=Innovative_Networks",
      "id": "indicator--533156ae-aedd-4211-af56-54c9a87b1ad6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.73.142.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T06:01:03.153Z",
      "x_nadsec_last_seen": "2026-03-02T06:08:34.395Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37549"
      ],
      "x_nadsec_orgs": [
        "Innovative_Networks"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=153277; asn_org=Feathers Telecom Services Private Limited",
      "id": "indicator--04e3c0ee-384e-4483-965b-dc182158d469",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '163.61.28.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T06:02:36.442Z",
      "x_nadsec_last_seen": "2026-03-02T06:09:44.569Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "153277"
      ],
      "x_nadsec_orgs": [
        "Feathers Telecom Services Private Limited"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=VN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--0f2d7181-b8da-4288-97fb-c7761abfd54c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.104.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T05:44:54.846Z",
      "x_nadsec_last_seen": "2026-03-02T05:45:13.897Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--c19ff7de-d3fd-40f4-a3c3-a0b3beb3d3bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.88.241.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T05:22:31.169Z",
      "x_nadsec_last_seen": "2026-03-02T05:24:35.688Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--59187425-6bd5-4a85-9f6b-458c4fb2ac96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T05:54:09.407Z",
      "x_nadsec_last_seen": "2026-03-31T15:22:34.136Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=151698; asn_org=GREEN WEB SOFTWARE DEVELOPMENT PRIVATE LIMITED",
      "id": "indicator--ada764b1-6e43-47ce-8f30-0ada282ced84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.79.148.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T06:00:17.196Z",
      "x_nadsec_last_seen": "2026-03-02T06:02:23.170Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151698"
      ],
      "x_nadsec_orgs": [
        "GREEN WEB SOFTWARE DEVELOPMENT PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--7950ab0f-5fbf-4ea2-a9e9-1017baa2c4fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.189.199.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T05:39:42.153Z",
      "x_nadsec_last_seen": "2026-03-02T05:39:42.153Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--04834c98-151f-4964-992c-f8a8eacef831",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.105.132.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T05:14:01.544Z",
      "x_nadsec_last_seen": "2026-03-16T12:14:06.546Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--db7d927a-4b0e-48fc-91c2-3c9f9a3a4d05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T06:04:11.845Z",
      "x_nadsec_last_seen": "2026-03-11T23:11:21.124Z",
      "x_nadsec_ports": [
        "3306",
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom; user(top)=**",
      "id": "indicator--b249a21e-7900-4126-af39-8320b9552250",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.188.12.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T05:40:53.227Z",
      "x_nadsec_last_seen": "2026-03-19T08:58:01.091Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T06:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=JO; asn=47887; asn_org=Al-hadatheh Lil-itisalat Wa Al-technologia Co.",
      "id": "indicator--8e84396c-3f5f-4ff6-b0a1-f4000bbe5674",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T06:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.212.85.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:05:11.000Z",
      "valid_until": "2026-04-03T06:05:10.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-02T05:41:22.868Z",
      "x_nadsec_last_seen": "2026-03-25T12:22:21.857Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "47887"
      ],
      "x_nadsec_orgs": [
        "Al-hadatheh Lil-itisalat Wa Al-technologia Co."
      ]
    },
    {
      "created": "2026-03-02T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ed0843e2-e31b-499b-b2d8-8772ac64e1e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.89.124.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:05:06.000Z",
      "valid_until": "2026-04-03T07:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T06:44:59.555Z",
      "x_nadsec_last_seen": "2026-03-02T06:45:09.736Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-02T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--279360c8-3447-4a19-97b0-e585768ee7a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.70.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:05:06.000Z",
      "valid_until": "2026-04-03T07:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T06:56:56.014Z",
      "x_nadsec_last_seen": "2026-03-02T06:59:00.972Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-02T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134887; asn_org=Aristo Telenet Private Limited",
      "id": "indicator--e272d506-6f87-4836-8f84-9b3729ba5688",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '163.61.252.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:05:06.000Z",
      "valid_until": "2026-04-03T07:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T06:25:13.176Z",
      "x_nadsec_last_seen": "2026-03-02T06:27:20.463Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134887"
      ],
      "x_nadsec_orgs": [
        "Aristo Telenet Private Limited"
      ]
    },
    {
      "created": "2026-03-02T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=4800; asn_org=PT Aplikanusa Lintasarta",
      "id": "indicator--7843eedf-9be0-4427-9cab-8746bd594515",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.91.83.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:05:06.000Z",
      "valid_until": "2026-04-03T07:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T06:50:37.456Z",
      "x_nadsec_last_seen": "2026-03-02T06:53:48.221Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4800"
      ],
      "x_nadsec_orgs": [
        "PT Aplikanusa Lintasarta"
      ]
    },
    {
      "created": "2026-03-02T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--d3dd15f5-7b12-41c3-916f-aa299618a167",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.210.134.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:05:06.000Z",
      "valid_until": "2026-04-03T07:05:05.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-02T06:30:16.006Z",
      "x_nadsec_last_seen": "2026-03-29T19:33:39.420Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-02T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=2561; asn_org=EUN",
      "id": "indicator--e93e98a5-4dbd-4944-a88f-fdd4cb7d24d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.227.16.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:05:06.000Z",
      "valid_until": "2026-04-03T07:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-02T06:33:25.109Z",
      "x_nadsec_last_seen": "2026-03-02T06:34:11.554Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "2561"
      ],
      "x_nadsec_orgs": [
        "EUN"
      ]
    },
    {
      "created": "2026-03-02T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mqttd; ports=1883; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ba7cd4c5-c861-42e4-8158-39c738e54ce9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '209.38.89.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:05:06.000Z",
      "valid_until": "2026-04-03T07:05:05.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T06:48:02.752Z",
      "x_nadsec_last_seen": "2026-03-02T06:48:05.726Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-02T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--2c061c74-c3f7-49c1-9e45-e2bc4ba0d3f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.20.122.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:05:06.000Z",
      "valid_until": "2026-04-03T07:05:05.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-02T06:31:10.926Z",
      "x_nadsec_last_seen": "2026-03-16T04:04:34.918Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-02T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--1ac86c51-69bd-49f6-929a-a23157b900f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.204.204.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:05:06.000Z",
      "valid_until": "2026-04-03T07:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T06:48:58.760Z",
      "x_nadsec_last_seen": "2026-03-02T06:51:03.290Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-02T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=17762; asn_org=Tata Teleservices Maharashtra Ltd",
      "id": "indicator--912885f1-1efd-4fb9-a4d0-bc81e7abf7a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.107.167.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:05:06.000Z",
      "valid_until": "2026-04-03T07:05:05.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T06:08:26.093Z",
      "x_nadsec_last_seen": "2026-03-16T06:46:12.019Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17762"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices Maharashtra Ltd"
      ]
    },
    {
      "created": "2026-03-02T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--2c71adcb-ce2b-42c2-a628-2b466477d49e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.115.186.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:05:06.000Z",
      "valid_until": "2026-04-03T07:05:05.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T06:39:37.036Z",
      "x_nadsec_last_seen": "2026-03-03T06:51:20.723Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-02T07:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7a146bf6-c6e9-4c0d-991a-070c1bf4edf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T07:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T07:05:06.000Z",
      "valid_until": "2026-04-03T07:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-02T06:31:14.195Z",
      "x_nadsec_last_seen": "2026-03-10T13:30:24.791Z",
      "x_nadsec_ports": [
        "21",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=141744; asn_org=CPA",
      "id": "indicator--f26f2a61-65ad-4211-a0d7-2dead85d50c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.163.96.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T07:18:13.958Z",
      "x_nadsec_last_seen": "2026-03-02T07:20:18.679Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "141744"
      ],
      "x_nadsec_orgs": [
        "CPA"
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--fb6efe7c-3bb2-4543-8b99-8439069bd722",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.25.122.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T07:14:21.008Z",
      "x_nadsec_last_seen": "2026-03-02T07:14:21.008Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--375bd23d-3768-4520-946d-29735eb65dd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.44.128.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T07:42:48.928Z",
      "x_nadsec_last_seen": "2026-03-02T08:11:46.224Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--8d3d0b09-9b82-4026-8ebb-d7eb4800ab83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '150.255.178.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T07:14:21.937Z",
      "x_nadsec_last_seen": "2026-03-02T07:14:21.937Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BD; asn=63969; asn_org=Race Online Limited",
      "id": "indicator--0d8a798c-a31a-412d-917d-a0ba7502d6c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.187.190.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T07:15:56.862Z",
      "x_nadsec_last_seen": "2026-03-02T07:15:56.862Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "63969"
      ],
      "x_nadsec_orgs": [
        "Race Online Limited"
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=63969; asn_org=Race Online Limited",
      "id": "indicator--0a5d39e7-d799-4db2-bde1-a4cc73c57cd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.187.190.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T07:13:26.789Z",
      "x_nadsec_last_seen": "2026-03-02T07:16:22.712Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "63969"
      ],
      "x_nadsec_orgs": [
        "Race Online Limited"
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--0545311a-433f-4f18-a21d-b37347440129",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.5.247.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T08:04:24.391Z",
      "x_nadsec_last_seen": "2026-03-02T08:10:41.942Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=21859; asn_org=Zenlayer Inc; user(top)=**",
      "id": "indicator--0bac8c68-ff38-4926-b1a8-48173fff2512",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.247.32.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T07:36:35.342Z",
      "x_nadsec_last_seen": "2026-03-02T07:36:35.342Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AM; asn=197834; asn_org=Ucom CJSC",
      "id": "indicator--615cba90-b5cc-4837-bb8c-2feb9627d252",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.32.195.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-02T07:38:23.777Z",
      "x_nadsec_last_seen": "2026-03-22T20:43:50.575Z",
      "x_nadsec_ports": [
        "27017",
        "3306",
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "197834"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=17638; asn_org=ASN for TIANJIN Provincial Net of CT",
      "id": "indicator--340e38de-7af8-4ed3-ab39-7921c3a67b53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.212.93.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T07:14:22.654Z",
      "x_nadsec_last_seen": "2026-03-02T07:14:22.654Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "17638"
      ],
      "x_nadsec_orgs": [
        "ASN for TIANJIN Provincial Net of CT"
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--811359b6-ae27-4843-9545-88d9a92dcb29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-02T07:44:36.906Z",
      "x_nadsec_last_seen": "2026-03-16T02:34:40.392Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ed6125eb-4bb6-459f-8cd0-9f68ceadf58a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-02T07:54:41.780Z",
      "x_nadsec_last_seen": "2026-03-09T16:37:59.531Z",
      "x_nadsec_ports": [
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=9924; asn_org=Taiwan Fixed Network, Telco and Network Service Provider.",
      "id": "indicator--f6d3ff96-feec-40f7-b58e-c724cc00bac5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '219.80.117.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T07:21:02.277Z",
      "x_nadsec_last_seen": "2026-03-02T07:23:07.146Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "9924"
      ],
      "x_nadsec_orgs": [
        "Taiwan Fixed Network, Telco and Network Service Provider."
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=17621; asn_org=China Unicom Shanghai network",
      "id": "indicator--a50cb7da-c2f6-44a9-8177-249a813ae855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.166.22.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T07:14:30.812Z",
      "x_nadsec_last_seen": "2026-03-02T07:14:30.812Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "17621"
      ],
      "x_nadsec_orgs": [
        "China Unicom Shanghai network"
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--1d8379ca-9138-4774-bcf2-3f13e4c3f693",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.71.98.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T07:31:58.047Z",
      "x_nadsec_last_seen": "2026-03-02T07:38:30.401Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--d6b9e7c5-e401-4561-88b7-b0aeb56a8bfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.80.254.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T07:31:39.428Z",
      "x_nadsec_last_seen": "2026-03-02T07:39:14.533Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--d7b6dfad-beb0-4e52-a973-f34c920a56b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.53.245.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T07:47:09.256Z",
      "x_nadsec_last_seen": "2026-03-02T07:49:15.486Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-02T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MZ; asn=36945; asn_org=mcelISP",
      "id": "indicator--d22cc502-28d5-46fc-a474-5efb47f444ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.220.193.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T08:05:06.000Z",
      "valid_until": "2026-04-03T08:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T07:59:51.951Z",
      "x_nadsec_last_seen": "2026-03-02T08:04:05.658Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MZ"
      ],
      "x_nadsec_asns": [
        "36945"
      ],
      "x_nadsec_orgs": [
        "mcelISP"
      ]
    },
    {
      "created": "2026-03-02T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MY; asn=24514; asn_org=MINISTRY OF HIGHER EDUCATION MALAYSIA",
      "id": "indicator--aa1d4c25-44e5-4a27-9c24-6555651e88ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.26.47.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:05:12.000Z",
      "valid_until": "2026-04-03T09:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T08:50:18.477Z",
      "x_nadsec_last_seen": "2026-03-02T08:54:31.894Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "24514"
      ],
      "x_nadsec_orgs": [
        "MINISTRY OF HIGHER EDUCATION MALAYSIA"
      ]
    },
    {
      "created": "2026-03-02T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=59139; asn_org=PT Wifiku Indonesia",
      "id": "indicator--4ecfbd8e-8758-41ca-83f7-e81ff9e28f34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.0.2.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:05:12.000Z",
      "valid_until": "2026-04-03T09:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T08:52:59.157Z",
      "x_nadsec_last_seen": "2026-03-02T08:55:03.821Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "59139"
      ],
      "x_nadsec_orgs": [
        "PT Wifiku Indonesia"
      ]
    },
    {
      "created": "2026-03-02T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--7bf32665-7b3d-4349-a886-aaa77c59cc42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.108.22.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:05:12.000Z",
      "valid_until": "2026-04-03T09:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T08:56:46.043Z",
      "x_nadsec_last_seen": "2026-03-14T06:24:07.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-02T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--3b023841-1ae5-47dc-a1c0-4da828115c81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.176.107.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:05:12.000Z",
      "valid_until": "2026-04-03T09:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T08:13:55.002Z",
      "x_nadsec_last_seen": "2026-03-02T08:16:02.451Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-02T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=4796; asn_org=Institute of Technology Bandung",
      "id": "indicator--5c21e092-2290-4e94-b4e0-e60478dc792b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.205.0.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:05:12.000Z",
      "valid_until": "2026-04-03T09:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T08:27:04.188Z",
      "x_nadsec_last_seen": "2026-03-02T08:27:04.188Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4796"
      ],
      "x_nadsec_orgs": [
        "Institute of Technology Bandung"
      ]
    },
    {
      "created": "2026-03-02T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--08b1415a-9b43-448a-b793-9f2998843b87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:05:12.000Z",
      "valid_until": "2026-04-03T09:05:11.000Z",
      "x_nadsec_event_count": 86,
      "x_nadsec_first_seen": "2026-03-02T08:47:13.967Z",
      "x_nadsec_last_seen": "2026-03-24T22:02:37.542Z",
      "x_nadsec_ports": [
        "445",
        "135",
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-03-02T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--06275e4f-e0a4-4f60-b542-5816589cceb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.145.231.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:05:12.000Z",
      "valid_until": "2026-04-03T09:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T09:00:22.475Z",
      "x_nadsec_last_seen": "2026-03-20T06:41:52.772Z",
      "x_nadsec_ports": [
        "1433",
        "445"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GH; asn=37012; asn_org=Comsys (GH)",
      "id": "indicator--ed4a5147-f66c-4a96-871c-54beee9d5c34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.159.140.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:05:12.000Z",
      "valid_until": "2026-04-03T09:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T08:23:54.820Z",
      "x_nadsec_last_seen": "2026-03-02T08:26:01.581Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GH"
      ],
      "x_nadsec_asns": [
        "37012"
      ],
      "x_nadsec_orgs": [
        "Comsys (GH)"
      ]
    },
    {
      "created": "2026-03-02T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=18734; asn_org=Operbes, S.A. de C.V.",
      "id": "indicator--b4b1bc13-d544-467e-8676-a954336d5edd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.57.23.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:05:12.000Z",
      "valid_until": "2026-04-03T09:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T08:20:15.193Z",
      "x_nadsec_last_seen": "2026-03-13T10:26:17.242Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "18734"
      ],
      "x_nadsec_orgs": [
        "Operbes, S.A. de C.V."
      ]
    },
    {
      "created": "2026-03-02T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ba09cd7b-36e0-4d6a-a538-b49c91e3392f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.162.160.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:05:12.000Z",
      "valid_until": "2026-04-03T09:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T08:56:31.621Z",
      "x_nadsec_last_seen": "2026-03-02T09:01:06.343Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-02T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--c7ba80e4-43f4-4dbd-babf-ee1fe4052878",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.95.220.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:05:12.000Z",
      "valid_until": "2026-04-03T09:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T08:21:18.595Z",
      "x_nadsec_last_seen": "2026-03-02T08:29:12.994Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-02T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=3326; asn_org=Private Joint Stock Company datagroup",
      "id": "indicator--e715863f-9733-495e-9b4e-cd91563c47e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.164.171.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:05:12.000Z",
      "valid_until": "2026-04-03T09:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T08:15:32.787Z",
      "x_nadsec_last_seen": "2026-03-02T08:17:40.596Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "3326"
      ],
      "x_nadsec_orgs": [
        "Private Joint Stock Company datagroup"
      ]
    },
    {
      "created": "2026-03-02T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--f8450206-7cc4-4008-81d7-91077407de2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:05:12.000Z",
      "valid_until": "2026-04-03T09:05:11.000Z",
      "x_nadsec_event_count": 22,
      "x_nadsec_first_seen": "2026-03-02T08:55:29.840Z",
      "x_nadsec_last_seen": "2026-03-28T03:04:06.481Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-03-02T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=UA; asn=24945; asn_org=Telecommunication Company Vinteleport Ltd.",
      "id": "indicator--be590e96-ecb1-4f5e-b386-30d359ae9e3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.143.41.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:05:12.000Z",
      "valid_until": "2026-04-03T09:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T08:54:59.131Z",
      "x_nadsec_last_seen": "2026-03-02T08:54:59.270Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "24945"
      ],
      "x_nadsec_orgs": [
        "Telecommunication Company Vinteleport Ltd."
      ]
    },
    {
      "created": "2026-03-02T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--72d4f91c-850f-468a-97e8-69ceee26db43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:05:12.000Z",
      "valid_until": "2026-04-03T09:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T08:07:43.309Z",
      "x_nadsec_last_seen": "2026-03-02T08:07:43.309Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-02T10:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--cff03fcb-b399-430e-908f-ec7b3b7d4087",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.50.75.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:05:07.000Z",
      "valid_until": "2026-04-03T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T09:20:11.467Z",
      "x_nadsec_last_seen": "2026-03-02T09:22:17.777Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-02T10:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--dc93b1fd-9e55-49c3-a32d-1cbe5d6a138b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.236.31.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:05:07.000Z",
      "valid_until": "2026-04-03T10:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T09:17:10.014Z",
      "x_nadsec_last_seen": "2026-03-02T09:17:10.534Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-02T10:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b317d5e5-88a7-4952-a1bc-2db7eebfd5cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.24.206.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:05:07.000Z",
      "valid_until": "2026-04-03T10:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T09:17:33.618Z",
      "x_nadsec_last_seen": "2026-03-02T09:24:05.588Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-02T10:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--de9b0b4a-e2da-44a3-913b-5b69584dfe52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:05:07.000Z",
      "valid_until": "2026-04-03T10:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T09:05:56.109Z",
      "x_nadsec_last_seen": "2026-03-02T09:05:56.109Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-02T10:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--719a76f2-d512-4bfb-b095-cca9e883e58d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.74.4.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:05:07.000Z",
      "valid_until": "2026-04-03T10:05:05.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T09:24:59.161Z",
      "x_nadsec_last_seen": "2026-03-26T18:59:26.564Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-02T10:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KZ; asn=60757; asn_org=Optinet LLP; user(top)=**",
      "id": "indicator--2797d98a-c8c9-449a-9f93-822c7b406002",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.217.188.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:05:07.000Z",
      "valid_until": "2026-04-03T10:05:05.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T09:26:17.196Z",
      "x_nadsec_last_seen": "2026-03-31T21:49:24.360Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "60757"
      ],
      "x_nadsec_orgs": [
        "Optinet LLP"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T10:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--ee5a39b9-fc56-4f95-bd5a-10711c95a858",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.221.164.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:05:07.000Z",
      "valid_until": "2026-04-03T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T09:58:05.347Z",
      "x_nadsec_last_seen": "2026-03-02T10:00:11.928Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-03-02T10:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--9d28318c-d8e0-4ea4-a03b-c350589d2c95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.75.38.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:05:07.000Z",
      "valid_until": "2026-04-03T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T09:56:09.858Z",
      "x_nadsec_last_seen": "2026-03-02T09:56:16.290Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-02T10:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--31bd3854-904e-4049-b356-088cf420ce62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.22.173.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:05:07.000Z",
      "valid_until": "2026-04-03T10:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T09:36:01.385Z",
      "x_nadsec_last_seen": "2026-03-02T09:36:01.385Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T10:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--3a4d3791-94f8-4336-a281-ddffb65a66e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.189.212.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:05:07.000Z",
      "valid_until": "2026-04-03T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T09:36:00.758Z",
      "x_nadsec_last_seen": "2026-03-05T14:01:49.146Z",
      "x_nadsec_ports": [
        "21",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-02T10:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=639; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--43485d9e-f723-4db1-bcc9-54bc00a16d12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.139.177.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:05:07.000Z",
      "valid_until": "2026-04-03T10:05:05.000Z",
      "x_nadsec_event_count": 3154,
      "x_nadsec_first_seen": "2026-03-02T09:47:19.569Z",
      "x_nadsec_last_seen": "2026-03-17T10:24:42.836Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-03-02T10:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--3231a295-d22d-4121-a1c3-c5f1a813a440",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:05:07.000Z",
      "valid_until": "2026-04-03T10:05:05.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-02T09:37:15.337Z",
      "x_nadsec_last_seen": "2026-03-02T09:37:35.200Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-03-02T10:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=SC; asn=42624; asn_org=Global-Data System IT Corporation",
      "id": "indicator--65093dc1-0b8f-4993-9f41-f4c6ff1c9676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '69.5.189.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:05:07.000Z",
      "valid_until": "2026-04-03T10:05:05.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-02T09:17:40.249Z",
      "x_nadsec_last_seen": "2026-03-25T05:07:53.959Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "42624"
      ],
      "x_nadsec_orgs": [
        "Global-Data System IT Corporation"
      ]
    },
    {
      "created": "2026-03-02T10:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--76583976-535d-482c-bb3e-6bedca55fc99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T10:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '8.221.136.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:05:07.000Z",
      "valid_until": "2026-04-03T10:05:05.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-02T10:01:08.488Z",
      "x_nadsec_last_seen": "2026-03-26T06:33:07.899Z",
      "x_nadsec_ports": [
        "27017",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-02T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=29975; asn_org=VODACOM",
      "id": "indicator--51bec361-75ae-419a-b4ac-8dabe13576e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.245.171.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:05:07.000Z",
      "valid_until": "2026-04-03T11:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T10:55:02.256Z",
      "x_nadsec_last_seen": "2026-03-02T10:57:10.536Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "29975"
      ],
      "x_nadsec_orgs": [
        "VODACOM"
      ]
    },
    {
      "created": "2026-03-02T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=RU; asn=48642; asn_org=Joint stock company For",
      "id": "indicator--3fe85188-f3d9-47c5-b41f-bc233bceabb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.74.173.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:05:07.000Z",
      "valid_until": "2026-04-03T11:05:05.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T10:16:08.158Z",
      "x_nadsec_last_seen": "2026-03-02T10:36:26.983Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48642"
      ],
      "x_nadsec_orgs": [
        "Joint stock company For"
      ]
    },
    {
      "created": "2026-03-02T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--131bd4f3-b04b-4087-b1d7-9273aacb1985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.254.84.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:05:07.000Z",
      "valid_until": "2026-04-03T11:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T10:24:19.165Z",
      "x_nadsec_last_seen": "2026-03-02T10:26:23.700Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-02T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--a50d5574-7976-4d32-b2b1-d475320b029a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.183.49.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:05:07.000Z",
      "valid_until": "2026-04-03T11:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T10:54:53.280Z",
      "x_nadsec_last_seen": "2026-03-02T11:03:27.960Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-02T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--3cff8424-42c3-4206-b03e-be07300c7b51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.242.72.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:05:07.000Z",
      "valid_until": "2026-04-03T11:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T10:58:14.288Z",
      "x_nadsec_last_seen": "2026-03-02T10:58:20.753Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-02T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=21928; asn_org=T-Mobile USA, Inc.",
      "id": "indicator--448b3e29-c3ba-4040-84fc-b1203fc9bdb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.191.62.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:05:07.000Z",
      "valid_until": "2026-04-03T11:05:05.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T10:23:55.907Z",
      "x_nadsec_last_seen": "2026-03-07T05:50:59.461Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "21928"
      ],
      "x_nadsec_orgs": [
        "T-Mobile USA, Inc."
      ]
    },
    {
      "created": "2026-03-02T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--a51b2d3e-bcd7-43e9-ab29-8929f9c744fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:05:07.000Z",
      "valid_until": "2026-04-03T11:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T10:35:21.174Z",
      "x_nadsec_last_seen": "2026-03-22T16:40:06.604Z",
      "x_nadsec_ports": [
        "445",
        "1883",
        "1433"
      ],
      "x_nadsec_services": [
        "mqttd",
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-02T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--b47509bb-0cb5-456f-b443-460bbc1b8236",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '169.148.86.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:05:07.000Z",
      "valid_until": "2026-04-03T11:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T10:46:55.704Z",
      "x_nadsec_last_seen": "2026-03-02T10:49:04.164Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-02T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--2a5a6eda-73a0-48a9-a0ed-22985d82618f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.157.26.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:05:07.000Z",
      "valid_until": "2026-04-03T11:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T11:02:16.900Z",
      "x_nadsec_last_seen": "2026-03-02T11:02:17.015Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-02T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17762; asn_org=Tata Teleservices Maharashtra Ltd",
      "id": "indicator--9397e362-5e84-480d-93b2-3e1c27737374",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.149.205.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:05:07.000Z",
      "valid_until": "2026-04-03T11:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T10:07:24.805Z",
      "x_nadsec_last_seen": "2026-03-02T10:09:30.370Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17762"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices Maharashtra Ltd"
      ]
    },
    {
      "created": "2026-03-02T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--8e81bd6a-1482-422b-ab41-ba9649bef2e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.38.96.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:05:07.000Z",
      "valid_until": "2026-04-03T11:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T10:23:23.605Z",
      "x_nadsec_last_seen": "2026-03-02T10:23:26.993Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-02T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=SC; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--41eff508-cf9f-46cb-9dc7-999c952d0089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.82.70.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:05:07.000Z",
      "valid_until": "2026-04-03T11:05:05.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T10:33:35.471Z",
      "x_nadsec_last_seen": "2026-03-26T18:53:04.439Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL",
        "SC"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-03-02T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--006608f4-e97a-4dc0-9c8a-eda31bdc919a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '86.57.218.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:05:07.000Z",
      "valid_until": "2026-04-03T11:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T10:28:47.908Z",
      "x_nadsec_last_seen": "2026-03-02T10:35:52.531Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-03-02T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--f2d831a5-f851-4d41-8ad9-0969ca027381",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.50.143.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:05:07.000Z",
      "valid_until": "2026-04-03T11:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-02T10:20:14.296Z",
      "x_nadsec_last_seen": "2026-03-02T10:22:19.282Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-03-02T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--95e132dc-a777-46da-bfb1-662341a5408b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.102.49.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:05:07.000Z",
      "valid_until": "2026-04-03T11:05:05.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-02T10:33:48.070Z",
      "x_nadsec_last_seen": "2026-03-18T19:10:46.200Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-03-02T12:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--cbc136c9-7c6f-4b4d-ba70-12610a0c7842",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.110.41.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:05:12.000Z",
      "valid_until": "2026-04-03T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T11:59:05.367Z",
      "x_nadsec_last_seen": "2026-03-02T12:01:10.891Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-02T12:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=24086; asn_org=Viettel Corporation",
      "id": "indicator--4b3004cf-a643-4a2e-8f90-cfd3bff87b03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.98.7.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:05:12.000Z",
      "valid_until": "2026-04-03T12:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-02T11:49:32.337Z",
      "x_nadsec_last_seen": "2026-03-02T11:51:36.292Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24086"
      ],
      "x_nadsec_orgs": [
        "Viettel Corporation"
      ]
    },
    {
      "created": "2026-03-02T12:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--06bc9590-6b54-499e-9b61-c6e3dae84ae2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.2.66.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:05:12.000Z",
      "valid_until": "2026-04-03T12:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T11:45:11.027Z",
      "x_nadsec_last_seen": "2026-03-02T11:51:37.180Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-02T12:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--6ef3201a-3da9-41f9-971a-80d566f2d703",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.3.221.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:05:12.000Z",
      "valid_until": "2026-04-03T12:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T11:34:39.937Z",
      "x_nadsec_last_seen": "2026-03-02T11:34:40.256Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-02T12:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=24863; asn_org=LINKdotNET",
      "id": "indicator--5dcd177b-53e6-49ea-bd64-ec24f60a130d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.165.161.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:05:12.000Z",
      "valid_until": "2026-04-03T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T12:02:02.230Z",
      "x_nadsec_last_seen": "2026-03-02T12:04:09.229Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24863"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET"
      ]
    },
    {
      "created": "2026-03-02T12:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=28009; asn_org=Davitel S.A.",
      "id": "indicator--137d87b6-9a7c-40e5-b8db-88c1996a3f3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.85.178.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:05:12.000Z",
      "valid_until": "2026-04-03T12:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-02T11:21:49.184Z",
      "x_nadsec_last_seen": "2026-03-16T00:25:31.159Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "28009"
      ],
      "x_nadsec_orgs": [
        "Davitel S.A."
      ]
    },
    {
      "created": "2026-03-02T12:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--d88149b1-1a55-4d08-9dbb-7875fc7293db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.87.87.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:05:12.000Z",
      "valid_until": "2026-04-03T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T11:30:08.058Z",
      "x_nadsec_last_seen": "2026-03-02T11:30:17.281Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-02T12:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--fecdf817-39f9-4828-889e-b471c180eb0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.158.156.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:05:12.000Z",
      "valid_until": "2026-04-03T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T11:10:38.648Z",
      "x_nadsec_last_seen": "2026-03-02T11:12:43.893Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24186"
      ],
      "x_nadsec_orgs": [
        "RailTel Corporation of India Ltd"
      ]
    },
    {
      "created": "2026-03-02T12:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--64700655-fe95-4d36-b89e-efef64a4010a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.71.57.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:05:12.000Z",
      "valid_until": "2026-04-03T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T11:49:04.273Z",
      "x_nadsec_last_seen": "2026-03-02T11:51:10.161Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-02T12:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=RU; asn=40995; asn_org=Sibirskie Seti Ltd.",
      "id": "indicator--b851d7da-feb9-4b15-a7b5-ac5a51c302ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.44.172.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:05:12.000Z",
      "valid_until": "2026-04-03T12:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T11:22:07.976Z",
      "x_nadsec_last_seen": "2026-03-02T11:46:32.151Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "40995"
      ],
      "x_nadsec_orgs": [
        "Sibirskie Seti Ltd."
      ]
    },
    {
      "created": "2026-03-02T12:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=267809; asn_org=360NET C.A.",
      "id": "indicator--0a7182ce-b50f-4531-939e-293f5ea76fc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T12:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.86.119.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:05:12.000Z",
      "valid_until": "2026-04-03T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T11:46:54.055Z",
      "x_nadsec_last_seen": "2026-03-02T11:48:59.696Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "267809"
      ],
      "x_nadsec_orgs": [
        "360NET C.A."
      ]
    },
    {
      "created": "2026-03-02T13:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--7e7dff22-a425-45f3-bc18-704da0a04d3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.163.65.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:05:08.000Z",
      "valid_until": "2026-04-03T13:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T12:31:55.049Z",
      "x_nadsec_last_seen": "2026-03-02T12:34:02.054Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-02T13:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--ab7be803-016c-496f-9470-66d924f0d5c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.186.190.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:05:08.000Z",
      "valid_until": "2026-04-03T13:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T12:38:02.835Z",
      "x_nadsec_last_seen": "2026-03-02T12:40:09.052Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-02T13:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--098a35e3-6be4-4b52-b7ad-6974e1ce1f06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:05:08.000Z",
      "valid_until": "2026-04-03T13:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T12:32:24.098Z",
      "x_nadsec_last_seen": "2026-03-02T12:32:24.098Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-02T13:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c034f0c4-9940-4b51-a32e-5227992ca1ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.128.149.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:05:08.000Z",
      "valid_until": "2026-04-03T13:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T12:45:54.465Z",
      "x_nadsec_last_seen": "2026-03-02T12:45:54.465Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-02T13:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--83c5e94b-865e-4c72-b51c-5003a2b97836",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.83.132.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:05:08.000Z",
      "valid_until": "2026-04-03T13:05:07.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T12:33:03.381Z",
      "x_nadsec_last_seen": "2026-03-02T12:39:41.442Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-02T13:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CO; asn=27837; asn_org=Dialnet de Colombia S.A. E.S.P.",
      "id": "indicator--3062bce4-4e21-4683-a3a8-62e12c88c89d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.1.167.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:05:08.000Z",
      "valid_until": "2026-04-03T13:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T12:51:47.315Z",
      "x_nadsec_last_seen": "2026-03-02T12:51:47.605Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "27837"
      ],
      "x_nadsec_orgs": [
        "Dialnet de Colombia S.A. E.S.P."
      ]
    },
    {
      "created": "2026-03-02T13:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--9ea07729-1de0-4193-b0b4-26f4b0919e7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.81.131.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:05:08.000Z",
      "valid_until": "2026-04-03T13:05:07.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-03-02T12:51:41.452Z",
      "x_nadsec_last_seen": "2026-03-02T12:52:35.486Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-02T13:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f7caeb67-5117-402d-a9a8-990ddb7595d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:05:08.000Z",
      "valid_until": "2026-04-03T13:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T12:25:42.379Z",
      "x_nadsec_last_seen": "2026-03-02T12:25:52.699Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-02T13:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--8a4e10ca-f3e8-41f7-a366-db276eda9ed4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.38.15.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:05:08.000Z",
      "valid_until": "2026-04-03T13:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T12:20:26.567Z",
      "x_nadsec_last_seen": "2026-03-02T12:22:33.264Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-02T13:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--9f9c0022-fe80-4b6a-9953-db9aea065334",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.173.100.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:05:08.000Z",
      "valid_until": "2026-04-03T13:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T12:06:34.404Z",
      "x_nadsec_last_seen": "2026-03-02T12:06:34.404Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T13:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=22773; asn_org=Cox Communications Inc.",
      "id": "indicator--ff4ed4fd-fd58-4967-b45e-cf86b33aeff0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T13:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '72.214.85.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:05:08.000Z",
      "valid_until": "2026-04-03T13:05:07.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-02T12:05:37.212Z",
      "x_nadsec_last_seen": "2026-03-19T05:15:46.154Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "22773"
      ],
      "x_nadsec_orgs": [
        "Cox Communications Inc."
      ]
    },
    {
      "created": "2026-03-02T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=137074; asn_org=Responsible Internet Sustainability Effort",
      "id": "indicator--1a0dc291-ea8a-41cf-beea-953ef46f6ae2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.43.215.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:05:02.000Z",
      "valid_until": "2026-04-03T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T13:54:27.244Z",
      "x_nadsec_last_seen": "2026-03-02T13:56:38.393Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "137074"
      ],
      "x_nadsec_orgs": [
        "Responsible Internet Sustainability Effort"
      ]
    },
    {
      "created": "2026-03-02T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CA; asn=16276; asn_org=OVH SAS; user(top)=**",
      "id": "indicator--6f214f42-137e-4ba8-9787-bf8fe2b8e7de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '15.235.5.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:05:02.000Z",
      "valid_until": "2026-04-03T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T13:11:37.995Z",
      "x_nadsec_last_seen": "2026-03-02T13:11:37.995Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262378; asn_org=Compuservice Empreendimentos Ltda",
      "id": "indicator--ef0c1e4c-0c86-459b-9fba-9b16471c50c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.131.29.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:05:02.000Z",
      "valid_until": "2026-04-03T14:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T13:47:47.286Z",
      "x_nadsec_last_seen": "2026-03-11T10:57:28.460Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262378"
      ],
      "x_nadsec_orgs": [
        "Compuservice Empreendimentos Ltda"
      ]
    },
    {
      "created": "2026-03-02T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--1506341e-8966-4f57-bcba-33ae939df226",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:05:02.000Z",
      "valid_until": "2026-04-03T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T13:07:48.321Z",
      "x_nadsec_last_seen": "2026-03-02T13:07:49.223Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-02T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KH; asn=38600; asn_org=SMART AXIATA Co., Ltd.",
      "id": "indicator--a7f36cd3-d06e-44a0-9ff4-d8626163aae2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.56.1.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:05:02.000Z",
      "valid_until": "2026-04-03T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T13:54:16.105Z",
      "x_nadsec_last_seen": "2026-03-02T13:56:20.855Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KH"
      ],
      "x_nadsec_asns": [
        "38600"
      ],
      "x_nadsec_orgs": [
        "SMART AXIATA Co., Ltd."
      ]
    },
    {
      "created": "2026-03-02T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=pptpd; ports=1723; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited",
      "id": "indicator--8f6cb2eb-dcc9-4e11-8ad8-ceab7b9b8c59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:05:02.000Z",
      "valid_until": "2026-04-03T14:05:01.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-02T13:18:26.890Z",
      "x_nadsec_last_seen": "2026-03-31T04:17:14.064Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "212512"
      ],
      "x_nadsec_orgs": [
        "Detai Prosperous Technologies Limited"
      ]
    },
    {
      "created": "2026-03-02T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--8a4d0218-6f8b-460b-88bc-3ccd87cf41f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:05:02.000Z",
      "valid_until": "2026-04-03T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T13:55:43.711Z",
      "x_nadsec_last_seen": "2026-03-27T12:21:32.909Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-02T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:05:02.000Z",
      "valid_until": "2026-04-03T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-02T13:39:36.773Z",
      "x_nadsec_last_seen": "2026-03-12T13:58:46.846Z",
      "x_nadsec_ports": [
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-02T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:05:02.000Z",
      "valid_until": "2026-04-03T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T13:48:26.942Z",
      "x_nadsec_last_seen": "2026-03-04T12:16:35.458Z",
      "x_nadsec_ports": [
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-02T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--5d5c932f-0f08-4b60-a9b7-4d0c5a2750a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.163.119.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:05:02.000Z",
      "valid_until": "2026-04-03T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T13:55:52.953Z",
      "x_nadsec_last_seen": "2026-03-02T13:57:59.580Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-02T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=25; services=smbd; ports=445; cc=IN; asn=133278; asn_org=Dehradun Enet Solutions Private Ltd",
      "id": "indicator--83f7babf-80e0-43d4-b7ee-f90bf13ac249",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.94.112.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:05:14.000Z",
      "valid_until": "2026-04-03T15:05:12.000Z",
      "x_nadsec_event_count": 25,
      "x_nadsec_first_seen": "2026-03-02T14:26:48.486Z",
      "x_nadsec_last_seen": "2026-03-02T14:29:36.908Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133278"
      ],
      "x_nadsec_orgs": [
        "Dehradun Enet Solutions Private Ltd"
      ]
    },
    {
      "created": "2026-03-02T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ce40dbc0-6bc0-4198-8e28-a1b9df010984",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.190.68.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:05:14.000Z",
      "valid_until": "2026-04-03T15:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T14:56:50.273Z",
      "x_nadsec_last_seen": "2026-03-02T14:57:01.475Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-02T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=394089; asn_org=Google LLC",
      "id": "indicator--822f99d8-d123-4c5c-9e2b-4c7ee2135f4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.85.142.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:05:14.000Z",
      "valid_until": "2026-04-03T15:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T14:22:48.744Z",
      "x_nadsec_last_seen": "2026-03-02T14:25:54.824Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "394089"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-02T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=7029; asn_org=Windstream Communications LLC",
      "id": "indicator--82f99516-6b76-4473-9d32-1081e5f3fe0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.185.140.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:05:14.000Z",
      "valid_until": "2026-04-03T15:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T14:43:49.422Z",
      "x_nadsec_last_seen": "2026-03-02T14:48:36.931Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "7029"
      ],
      "x_nadsec_orgs": [
        "Windstream Communications LLC"
      ]
    },
    {
      "created": "2026-03-02T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28343; asn_org=UNIFIQUE TELECOMUNICACOES SA",
      "id": "indicator--1b07bc7d-22e0-4157-9f46-839f59dacc6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.73.142.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:05:14.000Z",
      "valid_until": "2026-04-03T15:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T14:19:26.319Z",
      "x_nadsec_last_seen": "2026-03-02T14:21:34.165Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28343"
      ],
      "x_nadsec_orgs": [
        "UNIFIQUE TELECOMUNICACOES SA"
      ]
    },
    {
      "created": "2026-03-02T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--f6d4a6b7-b41c-444a-b9a3-2bacf320caa6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.57.182.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:05:14.000Z",
      "valid_until": "2026-04-03T15:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T14:24:48.462Z",
      "x_nadsec_last_seen": "2026-03-02T14:32:03.082Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-02T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3f5955a4-67ec-431c-9474-b1e527227b9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.168.124.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:05:14.000Z",
      "valid_until": "2026-04-03T15:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T14:26:36.611Z",
      "x_nadsec_last_seen": "2026-03-02T14:26:36.611Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-02T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=10834; asn_org=Telefonica de Argentina",
      "id": "indicator--3a1ec5a1-3a0e-4059-b48b-1cd31dc32bcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.51.91.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:05:14.000Z",
      "valid_until": "2026-04-03T15:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-02T14:12:44.938Z",
      "x_nadsec_last_seen": "2026-03-31T16:42:48.929Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "10834"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-02T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--37a80f06-59f2-4a2b-b4f7-5384d0006976",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.206.222.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:05:14.000Z",
      "valid_until": "2026-04-03T15:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-02T14:28:22.196Z",
      "x_nadsec_last_seen": "2026-03-02T14:32:36.197Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-02T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--55e9a76a-1ca8-4dd1-9438-8bd149421167",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '68.183.26.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:05:14.000Z",
      "valid_until": "2026-04-03T15:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T14:57:02.295Z",
      "x_nadsec_last_seen": "2026-03-03T19:06:49.592Z",
      "x_nadsec_ports": [
        "1883",
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-02T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=JO; asn=48832; asn_org=Jordanian mobile phone services Ltd",
      "id": "indicator--9edb283c-792b-4f7f-9453-88d1e7d0fdba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.245.6.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:05:14.000Z",
      "valid_until": "2026-04-03T15:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T15:00:29.422Z",
      "x_nadsec_last_seen": "2026-03-02T15:07:57.830Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "48832"
      ],
      "x_nadsec_orgs": [
        "Jordanian mobile phone services Ltd"
      ]
    },
    {
      "created": "2026-03-02T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--c185f73f-694f-45b4-a937-cda405f8ce5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.182.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:05:14.000Z",
      "valid_until": "2026-04-03T15:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-02T14:28:17.547Z",
      "x_nadsec_last_seen": "2026-03-02T19:43:11.486Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-03-02T15:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--137b29b5-e297-43ce-a988-6dca1b0e2c7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T15:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T15:05:14.000Z",
      "valid_until": "2026-04-03T15:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-02T14:40:01.384Z",
      "x_nadsec_last_seen": "2026-03-29T10:18:01.931Z",
      "x_nadsec_ports": [
        "81",
        "21",
        "445",
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "ftpd",
        "mssqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-03-02T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b6257d93-2eec-465e-b3cd-a89ab18bf84c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.120.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:05:13.000Z",
      "valid_until": "2026-04-03T16:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T15:31:42.004Z",
      "x_nadsec_last_seen": "2026-03-02T15:31:42.004Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-02T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6017679d-e560-4f6f-a821-6bd7b6b15563",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.159.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:05:13.000Z",
      "valid_until": "2026-04-03T16:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T15:12:42.021Z",
      "x_nadsec_last_seen": "2026-03-02T15:12:42.021Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-02T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5f3068e6-512a-4e38-905d-a499a4f59c98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.189.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:05:13.000Z",
      "valid_until": "2026-04-03T16:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T15:31:43.399Z",
      "x_nadsec_last_seen": "2026-03-02T15:31:43.399Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-02T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--a6d6fc8f-793a-4757-99c9-c711eb20889c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.0.233.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:05:13.000Z",
      "valid_until": "2026-04-03T16:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T15:34:27.122Z",
      "x_nadsec_last_seen": "2026-03-02T15:36:33.043Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ]
    },
    {
      "created": "2026-03-02T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--0b096aa8-1190-4350-8c43-0517aa566e19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.81.131.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:05:13.000Z",
      "valid_until": "2026-04-03T16:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T15:39:53.424Z",
      "x_nadsec_last_seen": "2026-03-02T15:39:53.424Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-02T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--05ff7547-9bbc-4459-9d4b-05a30ba1f0b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.81.131.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:05:13.000Z",
      "valid_until": "2026-04-03T16:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T15:39:51.402Z",
      "x_nadsec_last_seen": "2026-03-02T15:39:51.402Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-02T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--edbd9482-cb65-4aec-b991-2da546d7a440",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.199.120.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:05:13.000Z",
      "valid_until": "2026-04-03T16:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T15:31:42.917Z",
      "x_nadsec_last_seen": "2026-03-02T15:31:42.917Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-02T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fe695f2d-a143-4d53-9ff5-cda847ef5901",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:05:13.000Z",
      "valid_until": "2026-04-03T16:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T15:31:01.661Z",
      "x_nadsec_last_seen": "2026-03-02T15:31:01.661Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-02T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=25; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--334b5454-ce08-4646-ab7a-c4cebf9a3c4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.33.60.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:05:13.000Z",
      "valid_until": "2026-04-03T16:05:12.000Z",
      "x_nadsec_event_count": 25,
      "x_nadsec_first_seen": "2026-03-02T15:45:38.931Z",
      "x_nadsec_last_seen": "2026-03-02T15:46:18.229Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-02T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f4bda97f-6811-49c4-a842-c5add4a59220",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '67.205.153.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:05:13.000Z",
      "valid_until": "2026-04-03T16:05:12.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-03-02T15:45:19.955Z",
      "x_nadsec_last_seen": "2026-03-02T15:46:17.888Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-02T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=140726; asn_org=UNICOM AnHui province network",
      "id": "indicator--a16622b7-d164-4424-adcd-aceb8e427af4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.122.236.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:05:12.000Z",
      "valid_until": "2026-04-03T17:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T16:11:29.802Z",
      "x_nadsec_last_seen": "2026-03-02T16:11:29.802Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "140726"
      ],
      "x_nadsec_orgs": [
        "UNICOM AnHui province network"
      ]
    },
    {
      "created": "2026-03-02T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--0e125127-67f7-486c-95df-70e5258c9ad4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.191.130.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:05:12.000Z",
      "valid_until": "2026-04-03T17:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T16:11:28.558Z",
      "x_nadsec_last_seen": "2026-03-02T16:11:28.558Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-02T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a29c4320-2527-4791-b623-6b17127b4a65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:05:12.000Z",
      "valid_until": "2026-04-03T17:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T16:17:34.250Z",
      "x_nadsec_last_seen": "2026-03-02T16:17:44.461Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-02T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--7d462411-05eb-4edb-ab81-6b7cab89850b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.44.196.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:05:12.000Z",
      "valid_until": "2026-04-03T17:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T16:59:43.444Z",
      "x_nadsec_last_seen": "2026-03-02T16:59:47.928Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-03-02T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--775d5014-4ef4-467c-917b-486faf1085ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:05:12.000Z",
      "valid_until": "2026-04-03T17:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T16:18:51.741Z",
      "x_nadsec_last_seen": "2026-03-02T16:18:51.741Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-02T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--bc33eeff-d081-407b-bb4c-488107cff129",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.8.138.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:05:12.000Z",
      "valid_until": "2026-04-03T17:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T16:11:22.702Z",
      "x_nadsec_last_seen": "2026-03-02T16:11:22.702Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-02T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=16960; asn_org=Television Internacional, S.A. de C.V.",
      "id": "indicator--bfcbd46f-e09a-4913-bfa5-c59263568ca6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.249.60.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:05:12.000Z",
      "valid_until": "2026-04-03T17:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T17:03:22.643Z",
      "x_nadsec_last_seen": "2026-03-02T17:03:22.643Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "16960"
      ],
      "x_nadsec_orgs": [
        "Television Internacional, S.A. de C.V."
      ]
    },
    {
      "created": "2026-03-02T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--50f4e7c3-0528-4ae2-9bc7-39b7e5e9b637",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.178.246.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:05:12.000Z",
      "valid_until": "2026-04-03T17:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T16:51:14.136Z",
      "x_nadsec_last_seen": "2026-03-02T16:53:22.197Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-02T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--e9233c2f-c96f-4b03-81d9-8a0c68574f47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.81.129.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:05:12.000Z",
      "valid_until": "2026-04-03T17:05:11.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-03-02T16:38:06.121Z",
      "x_nadsec_last_seen": "2026-03-02T16:39:00.164Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-02T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=140726; asn_org=UNICOM AnHui province network",
      "id": "indicator--4d467214-4b1b-459d-bdc7-21b528c0c28a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.243.46.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:05:12.000Z",
      "valid_until": "2026-04-03T17:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T16:11:11.776Z",
      "x_nadsec_last_seen": "2026-03-02T16:11:11.776Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "140726"
      ],
      "x_nadsec_orgs": [
        "UNICOM AnHui province network"
      ]
    },
    {
      "created": "2026-03-02T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--64395c5c-df5f-4eeb-a8b9-407d74ca53dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.175.211.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:05:12.000Z",
      "valid_until": "2026-04-03T17:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T16:32:41.727Z",
      "x_nadsec_last_seen": "2026-03-02T16:32:41.727Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-02T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BA; asn=42560; asn_org=Telemach BH d.o.o. Sarajevo; user(top)=**",
      "id": "indicator--7829dfb7-c2d6-4741-830a-5882ac8ee255",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.78.203.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:05:12.000Z",
      "valid_until": "2026-04-03T17:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T16:23:38.640Z",
      "x_nadsec_last_seen": "2026-03-11T07:01:58.673Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BA"
      ],
      "x_nadsec_asns": [
        "42560"
      ],
      "x_nadsec_orgs": [
        "Telemach BH d.o.o. Sarajevo"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T17:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--4e1bc778-5150-4d96-92af-adef1406d916",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T17:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.182.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:05:12.000Z",
      "valid_until": "2026-04-03T17:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T16:08:06.467Z",
      "x_nadsec_last_seen": "2026-03-02T16:08:06.987Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-03-02T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45769; asn_org=D-Vois Broadband Pvt Ltd",
      "id": "indicator--9de9deb8-ea6e-4d93-ae61-ef5179bf02e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.79.159.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:05:03.000Z",
      "valid_until": "2026-04-03T18:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-02T17:08:14.484Z",
      "x_nadsec_last_seen": "2026-03-07T19:57:36.733Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45769"
      ],
      "x_nadsec_orgs": [
        "D-Vois Broadband Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-02T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--78399b29-ba81-470b-ba88-d7435977d823",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.14.237.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:05:03.000Z",
      "valid_until": "2026-04-03T18:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-02T17:55:14.904Z",
      "x_nadsec_last_seen": "2026-03-02T17:55:37.131Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--c9eb1295-096b-42ee-b724-6775b376a377",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '144.172.111.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:05:03.000Z",
      "valid_until": "2026-04-03T18:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-02T17:27:47.125Z",
      "x_nadsec_last_seen": "2026-03-02T18:26:06.049Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-03-02T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5a7be381-7aae-42d6-b9d5-87719aefb0dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:05:03.000Z",
      "valid_until": "2026-04-03T18:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-02T17:16:23.322Z",
      "x_nadsec_last_seen": "2026-03-09T03:07:54.225Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-02T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6aace095-95ee-4617-8ce3-7d9ac2409c7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.42.221.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:05:03.000Z",
      "valid_until": "2026-04-03T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T17:48:58.749Z",
      "x_nadsec_last_seen": "2026-03-02T17:49:01.105Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-02T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--cbd7c854-71a4-4f8a-9208-74c06a1a4958",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.53.209.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:05:03.000Z",
      "valid_until": "2026-04-03T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T17:13:28.779Z",
      "x_nadsec_last_seen": "2026-03-02T17:15:33.508Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-02T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--0cfe1d7c-9f0f-415d-b7f7-bc6b9e68e07d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.221.10.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:05:03.000Z",
      "valid_until": "2026-04-03T18:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T17:53:54.505Z",
      "x_nadsec_last_seen": "2026-03-02T18:01:25.095Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-03-02T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--71295360-f00a-44f7-bf23-e67c0e83339d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.248.6.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:05:03.000Z",
      "valid_until": "2026-04-03T18:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-02T17:54:54.391Z",
      "x_nadsec_last_seen": "2026-03-02T17:55:57.110Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-03-02T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4a9041e0-3a44-476a-8370-2a323523bea3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:05:03.000Z",
      "valid_until": "2026-04-03T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T17:30:31.969Z",
      "x_nadsec_last_seen": "2026-03-02T17:30:42.130Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-02T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GA; asn=16058; asn_org=Gabon-Telecom",
      "id": "indicator--25c2e7e7-40ee-431d-9ac4-fb8c0ccf2a78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.159.133.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:05:03.000Z",
      "valid_until": "2026-04-03T18:05:01.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-03-02T17:30:15.174Z",
      "x_nadsec_last_seen": "2026-03-25T03:03:12.975Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GA"
      ],
      "x_nadsec_asns": [
        "16058"
      ],
      "x_nadsec_orgs": [
        "Gabon-Telecom"
      ]
    },
    {
      "created": "2026-03-02T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KR; asn=9698; asn_org=LG HelloVision Corp.",
      "id": "indicator--634a9326-49db-4f67-bacc-d2345eedff56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.146.246.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:05:03.000Z",
      "valid_until": "2026-04-03T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T17:22:19.912Z",
      "x_nadsec_last_seen": "2026-03-02T17:24:25.358Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "9698"
      ],
      "x_nadsec_orgs": [
        "LG HelloVision Corp."
      ]
    },
    {
      "created": "2026-03-02T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=KR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--3b48d475-cbc8-4971-a586-acb2b4ae0cd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.36.114.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:05:13.000Z",
      "valid_until": "2026-04-03T19:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-02T18:18:20.819Z",
      "x_nadsec_last_seen": "2026-03-02T18:18:45.911Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--929060f2-3392-4a6f-b2d6-e982da1a5e71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.165.128.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:05:13.000Z",
      "valid_until": "2026-04-03T19:05:11.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-02T18:41:29.992Z",
      "x_nadsec_last_seen": "2026-03-27T19:40:44.818Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-03-02T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=136514; asn_org=Rashedur Rahman ta Onesky Communications Limited.",
      "id": "indicator--278e258c-926e-4654-8e2b-0012d03ec97b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.253.37.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:05:13.000Z",
      "valid_until": "2026-04-03T19:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T18:18:23.811Z",
      "x_nadsec_last_seen": "2026-03-19T03:47:46.465Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "136514"
      ],
      "x_nadsec_orgs": [
        "Rashedur Rahman ta Onesky Communications Limited."
      ]
    },
    {
      "created": "2026-03-02T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--562aabdf-6d0c-4843-867a-35fca7f60d92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:05:13.000Z",
      "valid_until": "2026-04-03T19:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T19:03:14.418Z",
      "x_nadsec_last_seen": "2026-03-09T04:32:23.621Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-02T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ca6b8840-594f-4f09-8bbf-3629c0d4081a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.128.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:05:13.000Z",
      "valid_until": "2026-04-03T19:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T18:11:39.458Z",
      "x_nadsec_last_seen": "2026-03-16T17:23:19.721Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-02T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--789d61f0-5a85-4887-8a0c-e42267eb7122",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.182.13.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:05:13.000Z",
      "valid_until": "2026-04-03T19:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T18:06:57.289Z",
      "x_nadsec_last_seen": "2026-03-02T18:09:03.995Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-02T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--5d8bbebd-b3f9-4380-8921-9c82603a21cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:05:13.000Z",
      "valid_until": "2026-04-03T19:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T19:04:30.091Z",
      "x_nadsec_last_seen": "2026-03-02T19:04:49.522Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-02T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--0c600559-d225-4a85-9a74-d00a2a38ab5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:05:13.000Z",
      "valid_until": "2026-04-03T19:05:11.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-02T18:15:11.095Z",
      "x_nadsec_last_seen": "2026-03-28T21:52:45.146Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-02T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=202993; asn_org=Institute of Information Technologies of National Academy of Science Azerbaijan",
      "id": "indicator--2e88ba6a-ef25-40cb-9f63-9a1942dcee95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.147.24.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:05:13.000Z",
      "valid_until": "2026-04-03T19:05:11.000Z",
      "x_nadsec_event_count": 48,
      "x_nadsec_first_seen": "2026-03-02T18:41:00.704Z",
      "x_nadsec_last_seen": "2026-03-12T21:13:10.355Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "202993"
      ],
      "x_nadsec_orgs": [
        "Institute of Information Technologies of National Academy of Science Azerbaijan"
      ]
    },
    {
      "created": "2026-03-02T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--a3695ba9-e100-4a1d-86ee-f7d293c958b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.203.178.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:05:13.000Z",
      "valid_until": "2026-04-03T19:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T18:18:31.539Z",
      "x_nadsec_last_seen": "2026-03-02T18:21:49.594Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-02T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--867c1d28-8ba1-4b7e-824f-3673cdecba41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.203.212.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:05:13.000Z",
      "valid_until": "2026-04-03T19:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T18:21:49.266Z",
      "x_nadsec_last_seen": "2026-03-02T18:22:38.656Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-02T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=RO; asn=47890; asn_org=Unmanaged Ltd",
      "id": "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:05:13.000Z",
      "valid_until": "2026-04-03T19:05:11.000Z",
      "x_nadsec_event_count": 139,
      "x_nadsec_first_seen": "2026-03-02T18:48:30.282Z",
      "x_nadsec_last_seen": "2026-03-31T10:04:00.143Z",
      "x_nadsec_ports": [
        "81",
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld",
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "47890"
      ],
      "x_nadsec_orgs": [
        "Unmanaged Ltd"
      ]
    },
    {
      "created": "2026-03-02T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--10746048-2b09-43db-bdd6-8e422290ba77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.74.115.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:05:13.000Z",
      "valid_until": "2026-04-03T19:05:11.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-02T18:29:22.595Z",
      "x_nadsec_last_seen": "2026-03-19T02:47:23.609Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-02T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--ccb3f248-d815-492d-8b3f-09af3293d091",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.72.172.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:05:13.000Z",
      "valid_until": "2026-04-03T19:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T18:33:26.590Z",
      "x_nadsec_last_seen": "2026-03-02T18:35:31.236Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-02T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--fed3a61e-8415-4737-a73c-0d7fd1f0d60b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.216.144.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:05:13.000Z",
      "valid_until": "2026-04-03T19:05:11.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-02T18:18:36.104Z",
      "x_nadsec_last_seen": "2026-03-24T18:37:32.109Z",
      "x_nadsec_ports": [
        "21",
        "27017",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-02T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=264103; asn_org=Pinheiro Net",
      "id": "indicator--91e20441-7491-4f05-afea-f2ddc2e821d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.59.191.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:05:13.000Z",
      "valid_until": "2026-04-03T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T19:25:44.377Z",
      "x_nadsec_last_seen": "2026-03-02T19:29:06.628Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264103"
      ],
      "x_nadsec_orgs": [
        "Pinheiro Net"
      ]
    },
    {
      "created": "2026-03-02T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--68b5e9b0-4d62-4700-9486-06699cef1c5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:05:13.000Z",
      "valid_until": "2026-04-03T20:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T19:32:39.505Z",
      "x_nadsec_last_seen": "2026-03-05T03:33:31.012Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-02T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=35819; asn_org=Etihad Etisalat, a joint stock company",
      "id": "indicator--62df14a8-e1b8-44d8-a1ff-15b9d6445b47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.224.234.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:05:13.000Z",
      "valid_until": "2026-04-03T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T19:08:11.633Z",
      "x_nadsec_last_seen": "2026-03-02T19:10:18.825Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "35819"
      ],
      "x_nadsec_orgs": [
        "Etihad Etisalat, a joint stock company"
      ]
    },
    {
      "created": "2026-03-02T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--e6f87c3e-0066-4329-8c36-831ab6025c7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.144.105.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:05:13.000Z",
      "valid_until": "2026-04-03T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T19:24:30.393Z",
      "x_nadsec_last_seen": "2026-03-02T19:26:35.548Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-02T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fc52f6a3-d4c9-4d74-8b7e-7968c719bc8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:05:13.000Z",
      "valid_until": "2026-04-03T20:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T19:22:52.917Z",
      "x_nadsec_last_seen": "2026-03-02T19:22:52.917Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-02T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--44f7ff70-2b27-48e5-b15d-3420627b2d85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:05:13.000Z",
      "valid_until": "2026-04-03T20:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T19:22:03.430Z",
      "x_nadsec_last_seen": "2026-03-13T09:38:35.498Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-02T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--e13b8ded-e8ad-4254-bbb0-1a43fc72387f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.48.196.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:05:13.000Z",
      "valid_until": "2026-04-03T20:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T19:51:13.790Z",
      "x_nadsec_last_seen": "2026-03-02T19:57:57.023Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-02T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--975b0631-c579-4c05-812e-4aa462d69f90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.182.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:05:13.000Z",
      "valid_until": "2026-04-03T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T19:27:03.467Z",
      "x_nadsec_last_seen": "2026-03-03T13:50:57.555Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-03-02T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--b115c661-dfb5-43da-a2e5-cc35e1ca4d7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.51.52.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:05:12.000Z",
      "valid_until": "2026-04-03T21:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-02T20:48:27.103Z",
      "x_nadsec_last_seen": "2026-03-15T09:25:25.937Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-03-02T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--53b4e067-c28c-4e0d-a1f1-005d01181b2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.88.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:05:12.000Z",
      "valid_until": "2026-04-03T21:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T20:08:38.784Z",
      "x_nadsec_last_seen": "2026-03-02T20:10:43.477Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-02T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6526808d-423d-4ff9-a190-3fdc47d16afa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:05:12.000Z",
      "valid_until": "2026-04-03T21:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T21:00:27.124Z",
      "x_nadsec_last_seen": "2026-03-02T21:00:27.124Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-02T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.132.26.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:05:12.000Z",
      "valid_until": "2026-04-03T21:05:11.000Z",
      "x_nadsec_event_count": 105,
      "x_nadsec_first_seen": "2026-03-02T20:09:09.892Z",
      "x_nadsec_last_seen": "2026-03-28T22:10:18.740Z",
      "x_nadsec_ports": [
        "3306",
        "27017",
        "81",
        "1723",
        "445",
        "1433",
        "21"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod",
        "httpd",
        "pptpd",
        "smbd",
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-02T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--10b950d9-c7ff-4858-9e0c-8d490e246ae4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.186.98.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:05:12.000Z",
      "valid_until": "2026-04-03T21:05:11.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-02T20:40:58.228Z",
      "x_nadsec_last_seen": "2026-03-03T15:43:32.454Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-03-02T21:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--29cdae77-90f2-4107-abe3-01cf8d69ae14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T21:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.105.185.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:05:12.000Z",
      "valid_until": "2026-04-03T21:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T20:52:05.503Z",
      "x_nadsec_last_seen": "2026-03-02T20:54:12.180Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-02T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=136698; asn_org=Devdarpan Broadband Pvt. Ltd.",
      "id": "indicator--1936dc0d-bce0-4176-8f43-1746fcf0d1e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.83.9.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:05:13.000Z",
      "valid_until": "2026-04-03T22:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T22:03:09.451Z",
      "x_nadsec_last_seen": "2026-03-02T22:03:09.513Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "136698"
      ],
      "x_nadsec_orgs": [
        "Devdarpan Broadband Pvt. Ltd."
      ]
    },
    {
      "created": "2026-03-02T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e911ecb1-291b-4d12-b8f7-fb678d1826b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.163.163.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:05:13.000Z",
      "valid_until": "2026-04-03T22:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T21:10:18.083Z",
      "x_nadsec_last_seen": "2026-03-02T21:17:40.571Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-02T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--019e465b-6221-4882-9bec-a08dd19313b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.232.138.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:05:13.000Z",
      "valid_until": "2026-04-03T22:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T21:23:03.585Z",
      "x_nadsec_last_seen": "2026-03-02T21:23:03.585Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-02T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3889a982-cebe-4e6a-8cab-b4bb79954e3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:05:13.000Z",
      "valid_until": "2026-04-03T22:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T22:02:23.369Z",
      "x_nadsec_last_seen": "2026-03-02T22:02:23.369Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-02T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=14117; asn_org=Telefonica del Sur S.A.",
      "id": "indicator--353e9c2e-dd40-403d-bee2-1bdef4260121",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.56.60.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:05:13.000Z",
      "valid_until": "2026-04-03T22:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T21:25:57.810Z",
      "x_nadsec_last_seen": "2026-03-02T21:26:04.584Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "14117"
      ],
      "x_nadsec_orgs": [
        "Telefonica del Sur S.A."
      ]
    },
    {
      "created": "2026-03-02T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--83d73e45-aca7-4b05-98e5-9ec89032a548",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.199.123.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:05:13.000Z",
      "valid_until": "2026-04-03T22:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T21:38:51.464Z",
      "x_nadsec_last_seen": "2026-03-02T21:38:51.464Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-02T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bf86e7d9-9a76-4630-99cf-3e33626e11fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:05:13.000Z",
      "valid_until": "2026-04-03T22:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T21:53:17.686Z",
      "x_nadsec_last_seen": "2026-03-02T21:53:17.686Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-02T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=21; services=mongod; ports=27017; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--21610cdd-2b73-4c4d-baa0-96c23e092993",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:05:13.000Z",
      "valid_until": "2026-04-03T22:05:12.000Z",
      "x_nadsec_event_count": 41,
      "x_nadsec_first_seen": "2026-03-02T21:54:46.704Z",
      "x_nadsec_last_seen": "2026-03-17T10:28:27.636Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-02T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--3fd6a4e8-fac6-4ff8-a495-34fe50c42363",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.46.175.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:05:13.000Z",
      "valid_until": "2026-04-03T23:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-02T22:52:15.816Z",
      "x_nadsec_last_seen": "2026-03-02T22:52:15.936Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-02T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--742ef046-24ec-452c-87ad-250d3e6d4ab5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.204.15.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:05:13.000Z",
      "valid_until": "2026-04-03T23:05:12.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-02T23:00:21.450Z",
      "x_nadsec_last_seen": "2026-03-06T01:47:08.817Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-02T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--489ca25a-cd83-4a4f-b52c-ab86766e5eb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.242.61.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:05:13.000Z",
      "valid_until": "2026-04-03T23:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T22:27:43.375Z",
      "x_nadsec_last_seen": "2026-03-02T22:29:49.932Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-02T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--ce788332-ce8f-4a51-bb14-9e2dcdd8b9d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.89.221.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:05:13.000Z",
      "valid_until": "2026-04-03T23:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T23:00:17.456Z",
      "x_nadsec_last_seen": "2026-03-02T23:02:21.895Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-02T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--5fd0b8cf-9cdf-4bfa-ac34-820a647c9b74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.109.237.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:05:13.000Z",
      "valid_until": "2026-04-03T23:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T22:45:30.555Z",
      "x_nadsec_last_seen": "2026-03-02T22:52:52.407Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-03-02T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--aaa8db2a-2624-46f0-9df1-e640adf899fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.26.57.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:05:13.000Z",
      "valid_until": "2026-04-03T23:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T22:54:49.943Z",
      "x_nadsec_last_seen": "2026-03-02T22:54:56.610Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-02T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=51167; asn_org=Contabo GmbH; user(top)=**",
      "id": "indicator--5f32278d-5ca3-428a-a633-00e54b75e96c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '84.247.175.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:05:13.000Z",
      "valid_until": "2026-04-03T23:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T22:57:43.871Z",
      "x_nadsec_last_seen": "2026-03-02T22:57:43.871Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-02T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--4e7261cb-e797-4219-9662-43e3828b5ba7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-02T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.106.196.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:05:13.000Z",
      "valid_until": "2026-04-03T23:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T22:47:16.836Z",
      "x_nadsec_last_seen": "2026-03-02T22:49:23.813Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-03T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=140061; asn_org=Qinghai Telecom",
      "id": "indicator--29fdbfe3-54a7-45a3-8621-54d8db8ae35c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.72.236.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:05:13.000Z",
      "valid_until": "2026-04-04T00:05:12.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-02T23:25:52.446Z",
      "x_nadsec_last_seen": "2026-03-09T18:54:56.833Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "140061"
      ],
      "x_nadsec_orgs": [
        "Qinghai Telecom"
      ]
    },
    {
      "created": "2026-03-03T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PE; asn=22411; asn_org=GTD PERU S.A",
      "id": "indicator--37fbc6aa-a135-493e-99e0-cd54fdd5b756",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.132.157.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:05:13.000Z",
      "valid_until": "2026-04-04T00:05:12.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-03-02T23:38:32.697Z",
      "x_nadsec_last_seen": "2026-03-28T23:17:56.427Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "22411"
      ],
      "x_nadsec_orgs": [
        "GTD PERU S.A"
      ]
    },
    {
      "created": "2026-03-03T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d821c922-f232-4d64-8303-b5664388a2b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:05:13.000Z",
      "valid_until": "2026-04-04T00:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-02T23:15:39.645Z",
      "x_nadsec_last_seen": "2026-03-02T23:16:01.933Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-03T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=53062; asn_org=ALT | GRUPO BRASIL TECPAR",
      "id": "indicator--55b597b6-d231-4a9f-9f88-281f3663cc2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.155.128.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:05:13.000Z",
      "valid_until": "2026-04-04T00:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T23:06:51.937Z",
      "x_nadsec_last_seen": "2026-03-02T23:08:58.855Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53062"
      ],
      "x_nadsec_orgs": [
        "ALT | GRUPO BRASIL TECPAR"
      ]
    },
    {
      "created": "2026-03-03T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--5ebf6f51-ecea-491d-80af-0f5fe386b613",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.80.234.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:05:13.000Z",
      "valid_until": "2026-04-04T00:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-02T23:14:39.946Z",
      "x_nadsec_last_seen": "2026-03-02T23:16:46.546Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-03T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PH; asn=4775; asn_org=Globe Telecoms",
      "id": "indicator--363d8add-3821-4a8a-8b30-57d3c4146a05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.177.190.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:05:13.000Z",
      "valid_until": "2026-04-04T00:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T00:01:25.739Z",
      "x_nadsec_last_seen": "2026-03-03T00:03:31.231Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "4775"
      ],
      "x_nadsec_orgs": [
        "Globe Telecoms"
      ]
    },
    {
      "created": "2026-03-03T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--9da7a684-e294-4ef2-8cd8-b6baebf3139b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:05:13.000Z",
      "valid_until": "2026-04-04T00:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T23:12:46.983Z",
      "x_nadsec_last_seen": "2026-03-02T23:12:46.983Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-03T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.",
      "id": "indicator--f58f264a-b513-4cf0-86b9-0e5069424887",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.244.153.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:05:13.000Z",
      "valid_until": "2026-04-04T00:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-02T23:13:34.754Z",
      "x_nadsec_last_seen": "2026-03-17T01:58:38.383Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9269"
      ],
      "x_nadsec_orgs": [
        "Hong Kong Broadband Network Ltd."
      ]
    },
    {
      "created": "2026-03-03T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d9e91bcc-04ca-4fcd-b5d8-0d0dcd9ea897",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:05:13.000Z",
      "valid_until": "2026-04-04T00:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-02T23:24:42.150Z",
      "x_nadsec_last_seen": "2026-03-02T23:24:42.150Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-03T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MA; asn=6713; asn_org=Itissalat Al-MAGHRIB",
      "id": "indicator--5c76e314-e63a-4c07-9134-3fa490b22210",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.159.252.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:05:12.000Z",
      "valid_until": "2026-04-04T01:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T00:54:27.069Z",
      "x_nadsec_last_seen": "2026-03-03T00:56:33.300Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "6713"
      ],
      "x_nadsec_orgs": [
        "Itissalat Al-MAGHRIB"
      ]
    },
    {
      "created": "2026-03-03T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=28573; asn_org=Claro NXT Telecomunicacoes Ltda; user(top)=**",
      "id": "indicator--77e88233-718f-4595-8839-cb9739c20ca5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.222.97.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:05:12.000Z",
      "valid_until": "2026-04-04T01:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T00:05:30.927Z",
      "x_nadsec_last_seen": "2026-03-03T00:05:30.927Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28573"
      ],
      "x_nadsec_orgs": [
        "Claro NXT Telecomunicacoes Ltda"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-03T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fb545b67-056e-4e72-b696-3491ccbf8ff8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:05:12.000Z",
      "valid_until": "2026-04-04T01:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T00:36:17.103Z",
      "x_nadsec_last_seen": "2026-03-23T06:58:31.288Z",
      "x_nadsec_ports": [
        "135",
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-03T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1a3c6d6e-c3a5-458a-9e2e-9d9faa8f9e50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:05:12.000Z",
      "valid_until": "2026-04-04T01:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T00:12:05.464Z",
      "x_nadsec_last_seen": "2026-03-03T00:12:05.464Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-03T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KR; asn=3786; asn_org=LG DACOM Corporation",
      "id": "indicator--b9737d11-fd80-426d-ade7-d907c7a4b5e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.92.207.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:05:12.000Z",
      "valid_until": "2026-04-04T01:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-03T00:56:13.447Z",
      "x_nadsec_last_seen": "2026-03-18T10:34:14.164Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "3786"
      ],
      "x_nadsec_orgs": [
        "LG DACOM Corporation"
      ]
    },
    {
      "created": "2026-03-03T01:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--b11e9fab-d74e-4edf-8457-5cad490370d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T01:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.196.222.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:05:12.000Z",
      "valid_until": "2026-04-04T01:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T01:03:31.402Z",
      "x_nadsec_last_seen": "2026-03-03T01:03:31.402Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--3343c7da-7a5a-450c-bd00-2fe8af64f172",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.52.158.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T01:05:13.522Z",
      "x_nadsec_last_seen": "2026-03-03T01:07:22.527Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--23e4b73a-d513-4059-9b31-db90c6765c4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.3.53.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T01:13:07.822Z",
      "x_nadsec_last_seen": "2026-03-03T01:15:16.573Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8e4a7ddb-dcd0-4432-8b57-73bee5498905",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.247.114.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T01:06:28.865Z",
      "x_nadsec_last_seen": "2026-03-03T01:08:45.262Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CO; asn=18747; asn_org=IFX Corporation",
      "id": "indicator--dd666dd6-e9f1-49fd-bf54-21f7e5df951e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.91.251.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T01:06:17.555Z",
      "x_nadsec_last_seen": "2026-03-03T01:08:22.134Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "18747"
      ],
      "x_nadsec_orgs": [
        "IFX Corporation"
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--33025a4a-a3b7-4f58-906c-15369c0802df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T01:09:49.704Z",
      "x_nadsec_last_seen": "2026-03-23T05:12:53.678Z",
      "x_nadsec_ports": [
        "445",
        "81"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=15924; asn_org=Vodafone Net Iletisim Hizmetler AS",
      "id": "indicator--1531a4ac-d29b-406a-924f-21adc6ed979e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.145.174.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T01:56:13.432Z",
      "x_nadsec_last_seen": "2026-03-03T02:03:25.965Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "15924"
      ],
      "x_nadsec_orgs": [
        "Vodafone Net Iletisim Hizmetler AS"
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--e78f4124-c3f6-442a-8976-cce7dca5edb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.140.188.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T01:46:13.448Z",
      "x_nadsec_last_seen": "2026-03-03T01:46:13.448Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--9c5f07fa-0d51-46a0-b64c-28c147fcbd0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.38.83.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T01:46:12.814Z",
      "x_nadsec_last_seen": "2026-03-28T08:49:09.579Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--704e575c-1ced-4ebd-86e8-b4786c8c1de6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.205.72.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T01:51:13.635Z",
      "x_nadsec_last_seen": "2026-03-14T06:22:24.178Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--18a9635f-a52b-4d3a-81d3-4c33c36a158d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.64.10.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T01:45:00.548Z",
      "x_nadsec_last_seen": "2026-03-03T01:51:44.434Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--39e668b8-2270-4b4e-a0b4-726d73ac27e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.81.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T01:38:33.986Z",
      "x_nadsec_last_seen": "2026-03-22T00:34:14.859Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--1d36807e-2d4f-482d-a6e2-6eb357639169",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-03T01:05:12.004Z",
      "x_nadsec_last_seen": "2026-03-03T01:06:25.790Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--6c0f6e20-6f4d-455b-a9d0-8532c2a84abd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T01:05:41.616Z",
      "x_nadsec_last_seen": "2026-03-03T01:06:10.189Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--0e779e73-9071-4794-b3bb-737b97b7ab83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T01:05:33.607Z",
      "x_nadsec_last_seen": "2026-03-03T01:06:15.192Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--6c50f4cc-e9e9-4e69-a934-dff55685d946",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T01:05:17.586Z",
      "x_nadsec_last_seen": "2026-03-03T01:05:25.592Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MK; asn=34772; asn_org=NEOTEL AD Skopje; user(top)=**",
      "id": "indicator--5621206f-ee74-4851-8c2b-77e2c3af8bc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.77.146.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T01:07:31.399Z",
      "x_nadsec_last_seen": "2026-03-03T01:07:31.399Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MK"
      ],
      "x_nadsec_asns": [
        "34772"
      ],
      "x_nadsec_orgs": [
        "NEOTEL AD Skopje"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-03T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KZ; asn=35104; asn_org=Jusan Mobile JSC",
      "id": "indicator--e4df7863-5ef0-4c12-836e-59e0501c03ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.141.135.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:05:13.000Z",
      "valid_until": "2026-04-04T02:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T01:17:23.567Z",
      "x_nadsec_last_seen": "2026-03-03T01:19:28.820Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "35104"
      ],
      "x_nadsec_orgs": [
        "Jusan Mobile JSC"
      ]
    },
    {
      "created": "2026-03-03T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=146863; asn_org=SHYAM DATA AND VOICE SERVICES PVT LTD",
      "id": "indicator--df20b504-f7e1-418e-af02-6e6bb8e8d00b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.173.93.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:05:12.000Z",
      "valid_until": "2026-04-04T03:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T02:45:46.601Z",
      "x_nadsec_last_seen": "2026-03-03T02:52:35.938Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "146863"
      ],
      "x_nadsec_orgs": [
        "SHYAM DATA AND VOICE SERVICES PVT LTD"
      ]
    },
    {
      "created": "2026-03-03T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2c8fd0fa-9329-4886-a69e-10b2e172da68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:05:12.000Z",
      "valid_until": "2026-04-04T03:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T02:11:00.255Z",
      "x_nadsec_last_seen": "2026-03-03T02:11:00.255Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-03T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7ab4e304-3243-484d-8f9d-fa4bdfc73a40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:05:12.000Z",
      "valid_until": "2026-04-04T03:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T02:33:22.892Z",
      "x_nadsec_last_seen": "2026-03-09T09:34:15.541Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-03T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--c1973a3b-7949-464e-95fb-725e8331d474",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.98.127.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:05:12.000Z",
      "valid_until": "2026-04-04T03:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-03T02:42:09.712Z",
      "x_nadsec_last_seen": "2026-03-03T04:01:16.334Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-03T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--0fbe0f4f-b845-476b-97cd-adf292ee1303",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.120.234.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:05:12.000Z",
      "valid_until": "2026-04-04T03:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T02:51:04.270Z",
      "x_nadsec_last_seen": "2026-03-03T02:58:10.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4538"
      ],
      "x_nadsec_orgs": [
        "China Education and Research Network Center"
      ]
    },
    {
      "created": "2026-03-03T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--496f9dab-99b8-4cf0-9954-0110da278cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:05:12.000Z",
      "valid_until": "2026-04-04T03:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T03:00:26.464Z",
      "x_nadsec_last_seen": "2026-03-03T03:00:26.464Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-03T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--f036ad83-09a4-40ca-a8e3-3b8dffdfb876",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.147.148.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:05:12.000Z",
      "valid_until": "2026-04-04T03:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-03T02:54:57.614Z",
      "x_nadsec_last_seen": "2026-03-16T00:54:59.080Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-03T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=RU; asn=200593; asn_org=Prospero Ooo",
      "id": "indicator--15d786a1-b30c-44d0-8db6-b0517ef1da37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.215.85.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:05:12.000Z",
      "valid_until": "2026-04-04T03:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T03:04:36.395Z",
      "x_nadsec_last_seen": "2026-03-27T08:20:42.664Z",
      "x_nadsec_ports": [
        "27017",
        "445"
      ],
      "x_nadsec_services": [
        "mongod",
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "200593"
      ],
      "x_nadsec_orgs": [
        "Prospero Ooo"
      ]
    },
    {
      "created": "2026-03-03T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=42110; asn_org=PVimpelCom",
      "id": "indicator--287d6eb0-b396-419d-946a-275eb7b5aea3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.25.118.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:05:12.000Z",
      "valid_until": "2026-04-04T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T03:02:19.983Z",
      "x_nadsec_last_seen": "2026-03-03T03:04:36.614Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "42110"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-03-03T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--66c933be-e3fe-4b42-b31c-99f351c85ec7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.55.210.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:05:12.000Z",
      "valid_until": "2026-04-04T04:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T03:27:09.356Z",
      "x_nadsec_last_seen": "2026-03-03T03:29:15.160Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-03T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=24088; asn_org=Hanoi Telecom Joint Stock Company - HCMC Branch",
      "id": "indicator--39b86dc8-cc86-4e2a-9294-80f44cc6905c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.130.208.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:05:12.000Z",
      "valid_until": "2026-04-04T04:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T03:14:04.939Z",
      "x_nadsec_last_seen": "2026-03-03T03:16:09.674Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24088"
      ],
      "x_nadsec_orgs": [
        "Hanoi Telecom Joint Stock Company - HCMC Branch"
      ]
    },
    {
      "created": "2026-03-03T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=140003; asn_org=Rumah Sakit Umum Pusat DR Hasan Sadikin",
      "id": "indicator--6792b1a2-1cbe-40ba-ba35-6c15d5ab3d5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.148.194.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:05:12.000Z",
      "valid_until": "2026-04-04T04:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T03:57:15.886Z",
      "x_nadsec_last_seen": "2026-03-03T10:06:33.591Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "140003"
      ],
      "x_nadsec_orgs": [
        "Rumah Sakit Umum Pusat DR Hasan Sadikin"
      ]
    },
    {
      "created": "2026-03-03T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f6fd302f-85ed-46d0-848f-5cb273c84d25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.248.82.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:05:12.000Z",
      "valid_until": "2026-04-04T04:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T03:14:05.111Z",
      "x_nadsec_last_seen": "2026-03-03T03:14:05.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-03T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=41743; asn_org=OPTIMASET Ltd.",
      "id": "indicator--4edfd0ea-da74-452a-a1cf-aa960d0b573c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.115.139.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:05:12.000Z",
      "valid_until": "2026-04-04T04:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T03:33:46.915Z",
      "x_nadsec_last_seen": "2026-03-03T03:41:26.180Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "41743"
      ],
      "x_nadsec_orgs": [
        "OPTIMASET Ltd."
      ]
    },
    {
      "created": "2026-03-03T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--94d8ee80-d985-46ea-ad6f-56bbd0b98a1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.70.81.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:05:12.000Z",
      "valid_until": "2026-04-04T04:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T03:31:35.998Z",
      "x_nadsec_last_seen": "2026-03-03T03:31:36.120Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-03T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--b733cfe5-134d-4f4d-bfdc-836e4a675548",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '8.208.10.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:05:12.000Z",
      "valid_until": "2026-04-04T04:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T03:40:35.341Z",
      "x_nadsec_last_seen": "2026-03-03T03:40:35.341Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-03T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=149575; asn_org=SITI VISION DATA SOLUTIONS PRIVATE LIMITED",
      "id": "indicator--2ffa6b6a-b879-4427-ada4-75182bb84ed5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.187.78.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:05:13.000Z",
      "valid_until": "2026-04-04T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T04:14:10.683Z",
      "x_nadsec_last_seen": "2026-03-03T04:16:16.694Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "149575"
      ],
      "x_nadsec_orgs": [
        "SITI VISION DATA SOLUTIONS PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-03T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--2830d2cf-5453-4499-b2f6-9b6d1e497d4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.239.132.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:05:13.000Z",
      "valid_until": "2026-04-04T05:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T04:17:01.895Z",
      "x_nadsec_last_seen": "2026-03-03T04:17:29.402Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-03T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=262216; asn_org=TELCONET S A",
      "id": "indicator--28c2482b-e196-4a06-9310-dce70ab66014",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.0.104.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:05:13.000Z",
      "valid_until": "2026-04-04T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T05:00:29.705Z",
      "x_nadsec_last_seen": "2026-03-03T05:00:36.143Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "262216"
      ],
      "x_nadsec_orgs": [
        "TELCONET S A"
      ]
    },
    {
      "created": "2026-03-03T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e2491c28-4350-4415-abad-cbcb1142b131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:05:13.000Z",
      "valid_until": "2026-04-04T05:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T04:57:48.439Z",
      "x_nadsec_last_seen": "2026-03-31T19:58:43.291Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "ftpd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-03T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--ef2d0d8f-4595-4b5e-98ac-457f49d7cfb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.136.160.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:05:13.000Z",
      "valid_until": "2026-04-04T05:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T05:01:11.905Z",
      "x_nadsec_last_seen": "2026-03-03T05:01:12.122Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-03T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--5f8a4cf5-bb43-4d2b-8cfd-a51480db18d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.162.202.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:05:13.000Z",
      "valid_until": "2026-04-04T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T04:13:05.127Z",
      "x_nadsec_last_seen": "2026-03-03T04:15:12.345Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-03T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=266550; asn_org=WTD TELECOM; user(top)=**",
      "id": "indicator--781996f2-a795-4c05-ac7f-52a74626247f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.140.64.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:05:13.000Z",
      "valid_until": "2026-04-04T05:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T04:15:34.135Z",
      "x_nadsec_last_seen": "2026-03-10T15:26:43.328Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "266550"
      ],
      "x_nadsec_orgs": [
        "WTD TELECOM"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-03T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--81992fa7-991b-455f-b168-683d8b2b96b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:05:13.000Z",
      "valid_until": "2026-04-04T05:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T04:37:41.723Z",
      "x_nadsec_last_seen": "2026-03-03T04:37:41.723Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-03T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134863; asn_org=SP INTERNET TECHNOLOGIES PRIVATE LTD",
      "id": "indicator--bf4baf86-3a28-4af6-a03b-7932738146a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.16.90.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:05:13.000Z",
      "valid_until": "2026-04-04T05:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T04:52:42.066Z",
      "x_nadsec_last_seen": "2026-03-03T05:00:17.691Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134863"
      ],
      "x_nadsec_orgs": [
        "SP INTERNET TECHNOLOGIES PRIVATE LTD"
      ]
    },
    {
      "created": "2026-03-03T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=38200; asn_org=BTS Communications BD ltd",
      "id": "indicator--924bdbae-1d7d-494a-aa17-8344a23a21a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.247.165.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:05:13.000Z",
      "valid_until": "2026-04-04T05:05:11.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-03T04:12:32.554Z",
      "x_nadsec_last_seen": "2026-03-08T08:29:43.795Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "38200"
      ],
      "x_nadsec_orgs": [
        "BTS Communications BD ltd"
      ]
    },
    {
      "created": "2026-03-03T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--35b80c59-b077-4354-9baa-0d608233dddc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.233.95.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:05:13.000Z",
      "valid_until": "2026-04-04T05:05:11.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-03T04:12:18.745Z",
      "x_nadsec_last_seen": "2026-03-28T06:05:40.650Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-03T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--de41a027-9ede-4877-9c35-a4914c5cdeb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.187.123.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:05:13.000Z",
      "valid_until": "2026-04-04T05:05:11.000Z",
      "x_nadsec_event_count": 60,
      "x_nadsec_first_seen": "2026-03-03T05:02:00.309Z",
      "x_nadsec_last_seen": "2026-03-21T16:55:43.343Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-03-03T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132955; asn_org=Pmg Networks Pvt Ltd",
      "id": "indicator--81f3a886-8550-4404-80ed-8081b4ca71ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.76.7.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:05:12.000Z",
      "valid_until": "2026-04-04T06:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T05:53:07.842Z",
      "x_nadsec_last_seen": "2026-03-03T05:53:14.301Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132955"
      ],
      "x_nadsec_orgs": [
        "Pmg Networks Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-03T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d7be791d-aad0-4e7d-b639-c7f7c71df278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.25.225.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:05:12.000Z",
      "valid_until": "2026-04-04T06:05:11.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-03-03T05:25:26.119Z",
      "x_nadsec_last_seen": "2026-03-18T07:58:31.571Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-03T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=JP; asn=17676; asn_org=SoftBank Corp.",
      "id": "indicator--a0dd5227-ad79-4266-9513-26fa962d1fe4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '126.31.49.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:05:12.000Z",
      "valid_until": "2026-04-04T06:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T05:47:06.523Z",
      "x_nadsec_last_seen": "2026-03-03T05:47:06.523Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "17676"
      ],
      "x_nadsec_orgs": [
        "SoftBank Corp."
      ]
    },
    {
      "created": "2026-03-03T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=53184; asn_org=VERO S.A",
      "id": "indicator--c542a5a9-a3d4-4f11-8eb3-b271cb4bb69b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.39.68.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:05:12.000Z",
      "valid_until": "2026-04-04T06:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T05:09:40.621Z",
      "x_nadsec_last_seen": "2026-03-03T05:11:47.145Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53184"
      ],
      "x_nadsec_orgs": [
        "VERO S.A"
      ]
    },
    {
      "created": "2026-03-03T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--34344c3b-1cb6-432e-b47b-3500cadb7322",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.82.114.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:05:12.000Z",
      "valid_until": "2026-04-04T06:05:11.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-03T05:22:30.620Z",
      "x_nadsec_last_seen": "2026-03-18T01:09:38.783Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-03T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=UA; asn=31725; asn_org=ISP Shtorm LTD",
      "id": "indicator--1ec1440c-f659-47bc-bcd6-061f35597b34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.62.15.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:05:12.000Z",
      "valid_until": "2026-04-04T06:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T05:25:46.319Z",
      "x_nadsec_last_seen": "2026-03-03T05:25:46.319Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "31725"
      ],
      "x_nadsec_orgs": [
        "ISP Shtorm LTD"
      ]
    },
    {
      "created": "2026-03-03T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8ab43a85-2717-4eef-beeb-b50e570cd0dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:05:12.000Z",
      "valid_until": "2026-04-04T06:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T05:23:18.631Z",
      "x_nadsec_last_seen": "2026-03-12T17:27:17.110Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-03T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--807ce508-98da-4f29-9dee-aead1c4e0882",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:05:12.000Z",
      "valid_until": "2026-04-04T06:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T05:28:46.818Z",
      "x_nadsec_last_seen": "2026-03-25T13:21:10.605Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-03T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--979f09ef-b5c9-4f08-89a7-0dd82f2daa7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.79.11.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:05:12.000Z",
      "valid_until": "2026-04-04T06:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T06:01:19.618Z",
      "x_nadsec_last_seen": "2026-03-03T06:03:26.325Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-03T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LA; asn=131267; asn_org=Star Telecom",
      "id": "indicator--a3189e32-2e71-459c-a7cb-dc2feccd308e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.1.28.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:05:13.000Z",
      "valid_until": "2026-04-04T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T06:53:16.114Z",
      "x_nadsec_last_seen": "2026-03-03T06:55:20.597Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "131267"
      ],
      "x_nadsec_orgs": [
        "Star Telecom"
      ]
    },
    {
      "created": "2026-03-03T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--4092b0ff-fc96-42d8-a706-18942756e247",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.96.102.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:05:13.000Z",
      "valid_until": "2026-04-04T07:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T06:38:22.695Z",
      "x_nadsec_last_seen": "2026-03-03T06:45:42.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-03T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--a1527cd0-6984-464f-8d4f-f06e265f7331",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.198.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:05:13.000Z",
      "valid_until": "2026-04-04T07:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-03T06:20:39.405Z",
      "x_nadsec_last_seen": "2026-03-09T06:29:20.636Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-03T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=202412; asn_org=Omegatech LTD",
      "id": "indicator--18a3c21a-c249-442a-a497-e371d9968806",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:05:13.000Z",
      "valid_until": "2026-04-04T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T06:54:13.321Z",
      "x_nadsec_last_seen": "2026-03-03T22:34:44.619Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ]
    },
    {
      "created": "2026-03-03T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--cd111716-4156-4972-8690-68976e2d0d6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.13.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:05:13.000Z",
      "valid_until": "2026-04-04T07:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-03T06:48:11.398Z",
      "x_nadsec_last_seen": "2026-03-25T07:22:34.212Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-03T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AZ; asn=8814; asn_org=Aztelekom LLC",
      "id": "indicator--1a295a5c-b0c6-4131-ab6a-c6d458ca3e86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.47.144.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:05:13.000Z",
      "valid_until": "2026-04-04T07:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T07:01:12.603Z",
      "x_nadsec_last_seen": "2026-03-03T07:03:20.564Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "8814"
      ],
      "x_nadsec_orgs": [
        "Aztelekom LLC"
      ]
    },
    {
      "created": "2026-03-03T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AZ; asn=8814; asn_org=Aztelekom LLC",
      "id": "indicator--33cbc6e7-f0b8-45ef-ab03-7564bf2d561c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.47.148.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:05:13.000Z",
      "valid_until": "2026-04-04T07:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T07:03:18.318Z",
      "x_nadsec_last_seen": "2026-03-03T07:03:18.318Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "8814"
      ],
      "x_nadsec_orgs": [
        "Aztelekom LLC"
      ]
    },
    {
      "created": "2026-03-03T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=FR; asn=16347; asn_org=ADISTA SAS",
      "id": "indicator--fa02b2be-1d29-4bf4-93c1-cd4284257a5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.14.166.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:05:13.000Z",
      "valid_until": "2026-04-04T07:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-03T07:01:30.449Z",
      "x_nadsec_last_seen": "2026-03-14T15:59:58.800Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16347"
      ],
      "x_nadsec_orgs": [
        "ADISTA SAS"
      ]
    },
    {
      "created": "2026-03-03T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=37069; asn_org=MOBINIL",
      "id": "indicator--4ed46ae9-791e-44df-805a-5dcdcf20b52d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.41.178.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:05:14.000Z",
      "valid_until": "2026-04-04T08:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T07:28:58.836Z",
      "x_nadsec_last_seen": "2026-03-03T07:31:06.124Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "37069"
      ],
      "x_nadsec_orgs": [
        "MOBINIL"
      ]
    },
    {
      "created": "2026-03-03T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--88b8fdd6-65a2-446b-bbb8-4125975ee65d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.160.100.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:05:14.000Z",
      "valid_until": "2026-04-04T08:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T07:14:12.765Z",
      "x_nadsec_last_seen": "2026-03-03T07:16:17.389Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-03T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4181b13f-1891-4e73-af79-8124cab50444",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.20.46.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:05:14.000Z",
      "valid_until": "2026-04-04T08:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T07:56:53.357Z",
      "x_nadsec_last_seen": "2026-03-03T07:58:57.998Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-03T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--a0b9100f-4e80-4d78-b891-4fc6a31389a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.26.186.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:05:14.000Z",
      "valid_until": "2026-04-04T08:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T07:50:24.739Z",
      "x_nadsec_last_seen": "2026-03-03T07:57:08.401Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-03T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--7b51d1e4-e0d6-4cae-a0fc-59ed16249437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:05:14.000Z",
      "valid_until": "2026-04-04T08:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T07:13:04.999Z",
      "x_nadsec_last_seen": "2026-03-31T14:46:57.275Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-03T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--b86ed45c-3c34-4b25-aaa7-b36487656de8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.208.85.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T08:05:14.000Z",
      "valid_until": "2026-04-04T08:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T07:53:44.932Z",
      "x_nadsec_last_seen": "2026-03-03T07:55:06.875Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-03T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=141342; asn_org=FIBERISH PVT LTD",
      "id": "indicator--1e523be2-2101-4e0c-9fa8-f1ff4499a987",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.82.253.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:05:13.000Z",
      "valid_until": "2026-04-04T09:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T08:54:39.839Z",
      "x_nadsec_last_seen": "2026-03-03T08:59:00.073Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "141342"
      ],
      "x_nadsec_orgs": [
        "FIBERISH PVT LTD"
      ]
    },
    {
      "created": "2026-03-03T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0eb266de-382a-43d9-9bac-43996a2a762a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.165.166.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:05:13.000Z",
      "valid_until": "2026-04-04T09:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T08:08:50.295Z",
      "x_nadsec_last_seen": "2026-03-03T08:09:25.539Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-03T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=132199; asn_org=Globe Telecom Inc.",
      "id": "indicator--b60a0106-243a-4070-8212-bf8aebe6c8a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.28.217.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:05:13.000Z",
      "valid_until": "2026-04-04T09:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T08:20:29.073Z",
      "x_nadsec_last_seen": "2026-03-03T08:22:34.585Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "132199"
      ],
      "x_nadsec_orgs": [
        "Globe Telecom Inc."
      ]
    },
    {
      "created": "2026-03-03T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--5af46e79-f5b5-496e-b0eb-ccaabe9cad83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.105.89.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:05:13.000Z",
      "valid_until": "2026-04-04T09:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-03T08:12:34.011Z",
      "x_nadsec_last_seen": "2026-03-03T08:16:46.440Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-03T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--e862f2b5-07ae-4f69-baa8-14e79cad5241",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.109.46.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:05:13.000Z",
      "valid_until": "2026-04-04T09:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T08:34:00.879Z",
      "x_nadsec_last_seen": "2026-03-03T08:34:00.957Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-03T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--fe58d46a-1e64-4590-a8cf-2e74703b2a31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:05:13.000Z",
      "valid_until": "2026-04-04T09:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-03T08:56:39.866Z",
      "x_nadsec_last_seen": "2026-03-31T11:49:07.808Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-03T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--a5ce5611-2e4f-484c-b827-eaee38171778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.97.26.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:05:13.000Z",
      "valid_until": "2026-04-04T09:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-03T09:03:12.922Z",
      "x_nadsec_last_seen": "2026-03-03T09:03:48.932Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-03T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--ea6fa25f-39c7-40c1-9de6-ef3cde78eed2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:05:13.000Z",
      "valid_until": "2026-04-04T09:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T08:55:32.092Z",
      "x_nadsec_last_seen": "2026-03-13T22:59:40.990Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-03-03T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=15; services=smbd; ports=445; cc=PH; asn=4775; asn_org=Globe Telecoms",
      "id": "indicator--607cb5bb-c562-413a-8fa5-79e965543ebb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.127.140.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:05:13.000Z",
      "valid_until": "2026-04-04T09:05:12.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-03T08:12:34.796Z",
      "x_nadsec_last_seen": "2026-03-03T08:15:43.725Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "4775"
      ],
      "x_nadsec_orgs": [
        "Globe Telecoms"
      ]
    },
    {
      "created": "2026-03-03T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=GE; asn=44327; asn_org=Delta Comm LLC",
      "id": "indicator--8bff1358-e938-447e-af38-c1b765ccb112",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.131.224.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:05:13.000Z",
      "valid_until": "2026-04-04T09:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T08:14:23.575Z",
      "x_nadsec_last_seen": "2026-03-03T08:18:35.278Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "44327"
      ],
      "x_nadsec_orgs": [
        "Delta Comm LLC"
      ]
    },
    {
      "created": "2026-03-03T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--1d701c47-2758-4d80-8351-20b1182ca412",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.111.215.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:05:13.000Z",
      "valid_until": "2026-04-04T09:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T08:42:51.052Z",
      "x_nadsec_last_seen": "2026-03-03T08:50:07.368Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-03T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--9026443b-94c7-4028-a161-15c7554f8593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.49.195.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:05:13.000Z",
      "valid_until": "2026-04-04T09:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T08:42:43.815Z",
      "x_nadsec_last_seen": "2026-03-03T08:42:43.910Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-03T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--f9bb2cc8-122c-46a2-a3f8-b734530336d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.224.160.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:05:13.000Z",
      "valid_until": "2026-04-04T09:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T08:12:34.513Z",
      "x_nadsec_last_seen": "2026-03-03T08:14:39.889Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-03T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=RU; asn=47165; asn_org=Omskie kabelnye seti Ltd.",
      "id": "indicator--b9224bc3-6b84-4e2f-b023-232253ca0e5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.137.28.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T09:05:13.000Z",
      "valid_until": "2026-04-04T09:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-03T08:05:52.531Z",
      "x_nadsec_last_seen": "2026-03-03T08:27:13.583Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "47165"
      ],
      "x_nadsec_orgs": [
        "Omskie kabelnye seti Ltd."
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--6624b2fe-fb0c-4128-86db-da823d710776",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.51.88.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-03T09:26:44.777Z",
      "x_nadsec_last_seen": "2026-03-23T13:58:24.268Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD",
      "id": "indicator--6c166492-8271-4b04-816d-4587efbc9e3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T09:06:25.231Z",
      "x_nadsec_last_seen": "2026-03-03T09:06:25.235Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--84743f9f-f90a-4e32-847b-2eb08ede8c4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.59.225.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T09:17:06.572Z",
      "x_nadsec_last_seen": "2026-03-03T09:19:17.134Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--b87b5d8a-d65c-4c5f-ad6c-1cc8db7c8662",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.194.11.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T09:31:19.517Z",
      "x_nadsec_last_seen": "2026-03-03T09:31:19.783Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e609a38b-17c2-458b-96ea-7ce2f9fffb17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.16.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T09:10:40.872Z",
      "x_nadsec_last_seen": "2026-03-03T09:12:48.092Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e7f2cdfc-0d5f-4d97-99cc-5a78b0d094fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.74.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T09:51:12.400Z",
      "x_nadsec_last_seen": "2026-03-03T09:51:12.694Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--9bd738f4-f00e-4b7d-b617-7f6f314c14ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.153.20.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T09:17:29.499Z",
      "x_nadsec_last_seen": "2026-03-03T09:19:34.777Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10429"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--f03cf453-2a8d-4bca-972f-6bf4e4e06531",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.251.125.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T09:05:42.385Z",
      "x_nadsec_last_seen": "2026-03-03T09:07:50.349Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=39442; asn_org=JSC RDE Unico",
      "id": "indicator--d3b16763-e574-45c6-957d-105400f017dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.234.0.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T09:26:29.759Z",
      "x_nadsec_last_seen": "2026-03-03T09:26:29.759Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "39442"
      ],
      "x_nadsec_orgs": [
        "JSC RDE Unico"
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--d832d8ce-9102-485d-be77-0b58ed3418ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.56.36.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T09:41:49.144Z",
      "x_nadsec_last_seen": "2026-03-03T09:48:43.129Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--2ed6ec3b-8f1d-40c4-8ed0-c0f1354a2c0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.141.134.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T09:23:01.254Z",
      "x_nadsec_last_seen": "2026-03-03T09:24:00.229Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--aa477a97-f019-4b55-97bd-f57e6a938336",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.191.209.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T09:26:27.744Z",
      "x_nadsec_last_seen": "2026-03-03T09:26:27.744Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--6f2a46dd-39b7-4b5d-92b0-21157be46d66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '72.90.84.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-03T09:34:18.946Z",
      "x_nadsec_last_seen": "2026-03-22T00:49:22.528Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--79e79fea-d77f-4bb3-84b6-1319ad1371a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.214.111.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-03T09:36:26.337Z",
      "x_nadsec_last_seen": "2026-03-03T10:57:47.181Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--17101048-9001-4e7b-b83c-f4cfb5b141b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.173.126.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T09:31:21.787Z",
      "x_nadsec_last_seen": "2026-03-03T09:33:28.901Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-03T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=UZ; asn=8193; asn_org=Uzbektelekom Joint Stock Company",
      "id": "indicator--feaa5bb7-aa1f-4949-983a-e385c787732a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.188.86.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:05:13.000Z",
      "valid_until": "2026-04-04T10:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-03T09:09:46.824Z",
      "x_nadsec_last_seen": "2026-03-03T10:06:17.636Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "8193"
      ],
      "x_nadsec_orgs": [
        "Uzbektelekom Joint Stock Company"
      ]
    },
    {
      "created": "2026-03-03T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--7efee158-d366-40e4-af01-a3aa73139016",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.88.109.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:05:12.000Z",
      "valid_until": "2026-04-04T11:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T11:02:38.091Z",
      "x_nadsec_last_seen": "2026-03-03T11:04:45.366Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-03T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--89ffc0fc-c47d-42f0-9c18-6b8f8a1cf1c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.96.27.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:05:12.000Z",
      "valid_until": "2026-04-04T11:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T10:48:37.980Z",
      "x_nadsec_last_seen": "2026-03-03T10:48:37.999Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ]
    },
    {
      "created": "2026-03-03T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--00794190-d05c-4f37-8bb2-5882aa30cf2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.70.176.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:05:12.000Z",
      "valid_until": "2026-04-04T11:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T10:08:36.297Z",
      "x_nadsec_last_seen": "2026-03-03T10:10:41.335Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-03T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4e0dd959-c443-4dbb-a27c-bd4262758c2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.18.206.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:05:12.000Z",
      "valid_until": "2026-04-04T11:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-03T10:55:17.975Z",
      "x_nadsec_last_seen": "2026-03-25T20:33:56.460Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-03T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--b49141f3-d7e7-4f7b-b1ee-f1ef1d3904ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.236.77.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:05:12.000Z",
      "valid_until": "2026-04-04T11:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-03T10:07:39.906Z",
      "x_nadsec_last_seen": "2026-03-12T18:46:32.506Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-03T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=LA; asn=131267; asn_org=Star Telecom",
      "id": "indicator--45ea9514-8e4a-4fa3-a239-0f5b87a009c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.182.99.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:05:12.000Z",
      "valid_until": "2026-04-04T11:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-03T10:47:07.642Z",
      "x_nadsec_last_seen": "2026-03-17T23:22:42.360Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "131267"
      ],
      "x_nadsec_orgs": [
        "Star Telecom"
      ]
    },
    {
      "created": "2026-03-03T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--65df4e03-92f9-4e39-a2cb-7807d45497c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.82.33.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:05:12.000Z",
      "valid_until": "2026-04-04T11:05:11.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-03T10:24:03.267Z",
      "x_nadsec_last_seen": "2026-03-28T04:57:19.199Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-03-03T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--ac5081d5-5c5a-41c8-a125-d51451c2fc31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.158.49.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:05:12.000Z",
      "valid_until": "2026-04-04T11:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T10:27:36.340Z",
      "x_nadsec_last_seen": "2026-03-03T10:28:19.307Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-03T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PA; asn=11556; asn_org=Cable & Wireless Panama",
      "id": "indicator--59a60683-4fb2-4d40-8033-a0359d209080",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.34.154.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:05:12.000Z",
      "valid_until": "2026-04-04T11:05:11.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-03T10:06:42.666Z",
      "x_nadsec_last_seen": "2026-03-29T17:08:40.343Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PA"
      ],
      "x_nadsec_asns": [
        "11556"
      ],
      "x_nadsec_orgs": [
        "Cable & Wireless Panama"
      ]
    },
    {
      "created": "2026-03-03T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8fe89976-6884-44ab-acea-0fc04b1594d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.83.126.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:05:12.000Z",
      "valid_until": "2026-04-04T11:05:11.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-03T11:01:28.244Z",
      "x_nadsec_last_seen": "2026-03-05T04:43:08.375Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-03T11:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=209788; asn_org=LLC Cifrovie Seti Urala",
      "id": "indicator--b9a7e811-9c0d-4e9d-8356-d8ddaf3119c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T11:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.183.46.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T11:05:12.000Z",
      "valid_until": "2026-04-04T11:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T10:59:43.039Z",
      "x_nadsec_last_seen": "2026-03-03T11:01:00.870Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "209788"
      ],
      "x_nadsec_orgs": [
        "LLC Cifrovie Seti Urala"
      ]
    },
    {
      "created": "2026-03-03T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=137354; asn_org=PT. Data Sinergitama Jaya",
      "id": "indicator--c60b737a-5c34-4f28-8c6d-1d2f4e136e90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.114.244.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:05:07.000Z",
      "valid_until": "2026-04-04T12:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T11:38:04.153Z",
      "x_nadsec_last_seen": "2026-03-03T11:40:12.793Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "137354"
      ],
      "x_nadsec_orgs": [
        "PT. Data Sinergitama Jaya"
      ]
    },
    {
      "created": "2026-03-03T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=151757; asn_org=WEONE BROADAND PRIVATE LIMITED",
      "id": "indicator--8a0e131f-0052-47ff-953b-a8e58f4826d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.82.185.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:05:07.000Z",
      "valid_until": "2026-04-04T12:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T11:28:50.668Z",
      "x_nadsec_last_seen": "2026-03-03T11:30:56.806Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151757"
      ],
      "x_nadsec_orgs": [
        "WEONE BROADAND PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-03T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45609; asn_org=Bharti Airtel Ltd. AS for GPRS Service",
      "id": "indicator--a17d1400-7222-49eb-a603-efba6b84876b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.211.227.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:05:07.000Z",
      "valid_until": "2026-04-04T12:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T11:57:20.981Z",
      "x_nadsec_last_seen": "2026-03-03T11:59:30.265Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45609"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd. AS for GPRS Service"
      ]
    },
    {
      "created": "2026-03-03T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d452a010-0f9d-4819-9d27-65467bd3faa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.176.185.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:05:07.000Z",
      "valid_until": "2026-04-04T12:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T11:28:55.698Z",
      "x_nadsec_last_seen": "2026-03-03T11:31:00.244Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-03T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--7df1ceae-25cf-49d3-87c7-75cb6f69f258",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.102.75.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:05:07.000Z",
      "valid_until": "2026-04-04T12:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T11:14:16.865Z",
      "x_nadsec_last_seen": "2026-03-03T11:19:51.039Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-03-03T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=9534; asn_org=Binariang Berhad",
      "id": "indicator--4f97f50e-4c6f-432b-a0f7-9090aff1d10a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.122.138.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:05:07.000Z",
      "valid_until": "2026-04-04T12:05:05.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-03T11:24:21.128Z",
      "x_nadsec_last_seen": "2026-03-28T17:42:56.623Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9534"
      ],
      "x_nadsec_orgs": [
        "Binariang Berhad"
      ]
    },
    {
      "created": "2026-03-03T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--a0fa153b-cc88-4a45-a7b0-3c606588b96a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.241.161.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:05:07.000Z",
      "valid_until": "2026-04-04T12:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T11:40:35.037Z",
      "x_nadsec_last_seen": "2026-03-03T11:48:01.440Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-03T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mirrord; ports=42; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--cd25bff6-f29d-4dfd-b0f6-d7cf4ad2e16e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:05:07.000Z",
      "valid_until": "2026-04-04T12:05:05.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-03T12:03:48.222Z",
      "x_nadsec_last_seen": "2026-03-03T12:05:05.582Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "36711"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mqttd",
        "mssqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-03-03T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--9f9a1586-1dab-4c84-9980-86b0897e986a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '218.173.86.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:05:07.000Z",
      "valid_until": "2026-04-04T12:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T11:46:00.883Z",
      "x_nadsec_last_seen": "2026-03-03T11:48:07.927Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-03T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=215925; asn_org=Vpsvault.host Ltd",
      "id": "indicator--0f224ef0-aa40-4c39-9c36-1253c5c63ad8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:05:07.000Z",
      "valid_until": "2026-04-04T12:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T11:42:50.603Z",
      "x_nadsec_last_seen": "2026-03-04T10:55:38.911Z",
      "x_nadsec_ports": [
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215925"
      ],
      "x_nadsec_orgs": [
        "Vpsvault.host Ltd"
      ]
    },
    {
      "created": "2026-03-03T12:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DE; asn=3320; asn_org=Deutsche Telekom AG",
      "id": "indicator--5bb8df17-f464-4485-950d-10a17de8ddcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T12:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.11.188.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:05:07.000Z",
      "valid_until": "2026-04-04T12:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T11:56:43.744Z",
      "x_nadsec_last_seen": "2026-03-03T11:58:50.386Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "3320"
      ],
      "x_nadsec_orgs": [
        "Deutsche Telekom AG"
      ]
    },
    {
      "created": "2026-03-03T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=JP; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--0e00f9da-ae75-4869-8c52-eff9e6416a59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.105.224.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:05:13.000Z",
      "valid_until": "2026-04-04T13:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T12:23:55.972Z",
      "x_nadsec_last_seen": "2026-03-17T02:41:56.570Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-03T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--d3e6338e-f0be-4b91-b21e-3e348c498769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:05:13.000Z",
      "valid_until": "2026-04-04T13:05:12.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-03T12:32:43.907Z",
      "x_nadsec_last_seen": "2026-03-30T21:23:49.740Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-03T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=262916; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--f391fa3a-2b38-4475-9852-040440e84b82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.240.17.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:05:13.000Z",
      "valid_until": "2026-04-04T13:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T12:26:59.060Z",
      "x_nadsec_last_seen": "2026-03-03T12:30:21.162Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "262916"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-03-03T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--247df011-3986-49cc-9e3c-adcdebd2dd8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.116.178.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:05:13.000Z",
      "valid_until": "2026-04-04T13:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T12:51:58.451Z",
      "x_nadsec_last_seen": "2026-03-03T12:54:05.575Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-03-03T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27747; asn_org=Telecentro S.A.",
      "id": "indicator--ba09c7e2-3980-4a1c-86c5-45511c312e89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.44.117.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:05:13.000Z",
      "valid_until": "2026-04-04T13:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T12:44:02.834Z",
      "x_nadsec_last_seen": "2026-03-03T12:46:10.384Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27747"
      ],
      "x_nadsec_orgs": [
        "Telecentro S.A."
      ]
    },
    {
      "created": "2026-03-03T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--d3b79e12-3e88-4cf9-bdc4-119c28865e35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:05:13.000Z",
      "valid_until": "2026-04-04T13:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T12:13:34.826Z",
      "x_nadsec_last_seen": "2026-03-03T12:13:34.826Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-03T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6c24df71-77a1-44be-a05e-49cffb7d5afa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:05:13.000Z",
      "valid_until": "2026-04-04T13:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T12:54:55.093Z",
      "x_nadsec_last_seen": "2026-03-03T12:54:55.093Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-03T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--82c6706c-0c54-4538-99ab-bca4d9e48b72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.202.57.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:05:13.000Z",
      "valid_until": "2026-04-04T13:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T12:28:25.274Z",
      "x_nadsec_last_seen": "2026-03-28T03:06:30.589Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-03T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.; user(top)=**",
      "id": "indicator--da3108b5-1dc1-40f6-9416-9e2613c0deef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.149.239.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:05:13.000Z",
      "valid_until": "2026-04-04T13:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T12:22:43.517Z",
      "x_nadsec_last_seen": "2026-03-23T00:06:34.140Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9269"
      ],
      "x_nadsec_orgs": [
        "Hong Kong Broadband Network Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-03T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--c0ae0dec-bdd8-4578-8249-a21609b58a57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.44.6.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:05:13.000Z",
      "valid_until": "2026-04-04T13:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T13:04:37.038Z",
      "x_nadsec_last_seen": "2026-03-03T13:06:43.214Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-03-03T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=42087; asn_org=MTS PJSC",
      "id": "indicator--79709fac-e78c-4e50-9139-33438351117d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.117.82.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:05:13.000Z",
      "valid_until": "2026-04-04T13:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T12:45:43.379Z",
      "x_nadsec_last_seen": "2026-03-03T12:53:50.990Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "42087"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-03-03T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=httpd; ports=81; cc=JP; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ffb7076b-32d8-431b-9f3c-638dacbf358e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.194.236.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:05:13.000Z",
      "valid_until": "2026-04-04T14:05:12.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-03T13:25:50.832Z",
      "x_nadsec_last_seen": "2026-03-17T18:30:36.087Z",
      "x_nadsec_ports": [
        "81",
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-03T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--a75b4a07-2db7-4627-9288-5cdc45d7dda6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.16.6.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:05:13.000Z",
      "valid_until": "2026-04-04T14:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T13:14:37.698Z",
      "x_nadsec_last_seen": "2026-03-03T13:21:08.648Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-03T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--687b52bc-9bed-4268-bce9-1aadf94fddac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.177.247.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:05:13.000Z",
      "valid_until": "2026-04-04T14:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T13:59:53.385Z",
      "x_nadsec_last_seen": "2026-03-03T14:01:59.786Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-03T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=263661; asn_org=BRASIL DIGITAL SERVICOS DE INFORMATICA E COMERCIO",
      "id": "indicator--a502c5ee-e751-46d6-ac52-714527dd8a11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.221.59.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:05:13.000Z",
      "valid_until": "2026-04-04T14:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T13:59:39.487Z",
      "x_nadsec_last_seen": "2026-03-03T14:06:53.958Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263661"
      ],
      "x_nadsec_orgs": [
        "BRASIL DIGITAL SERVICOS DE INFORMATICA E COMERCIO"
      ]
    },
    {
      "created": "2026-03-03T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=FR; asn=3215; asn_org=Orange",
      "id": "indicator--bbdb3e0b-fbd4-49f4-b82c-cf3fba7ebb80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.248.253.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:05:13.000Z",
      "valid_until": "2026-04-04T14:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T13:45:24.401Z",
      "x_nadsec_last_seen": "2026-03-03T13:47:30.646Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "3215"
      ],
      "x_nadsec_orgs": [
        "Orange"
      ]
    },
    {
      "created": "2026-03-03T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IL; asn=8948; asn_org=099 Primo Communications Ltd",
      "id": "indicator--3aace403-afe2-4ef4-843b-06a28915620e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.229.181.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:05:13.000Z",
      "valid_until": "2026-04-04T14:05:12.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-03T13:22:26.524Z",
      "x_nadsec_last_seen": "2026-03-03T14:08:40.004Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "8948"
      ],
      "x_nadsec_orgs": [
        "099 Primo Communications Ltd"
      ]
    },
    {
      "created": "2026-03-03T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--77bc1a11-9161-4920-bf00-e3c3f0cec8a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.242.230.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:05:13.000Z",
      "valid_until": "2026-04-04T14:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T13:09:49.994Z",
      "x_nadsec_last_seen": "2026-03-03T13:09:49.994Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-03T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SC; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--412bd647-8932-4879-a00d-874db55e539f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.61.209.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:05:13.000Z",
      "valid_until": "2026-04-04T14:05:12.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-03T14:00:41.944Z",
      "x_nadsec_last_seen": "2026-03-19T01:07:59.171Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-03-03T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:05:13.000Z",
      "valid_until": "2026-04-04T14:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T13:13:37.615Z",
      "x_nadsec_last_seen": "2026-03-24T13:30:28.669Z",
      "x_nadsec_ports": [
        "135",
        "21",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-03T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d70dc23d-e9cf-4371-9011-d845b767f58c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:05:13.000Z",
      "valid_until": "2026-04-04T14:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T13:32:54.376Z",
      "x_nadsec_last_seen": "2026-03-03T13:32:56.380Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-03T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--be80cae7-6ae8-4fb7-b2a0-809f203f4b97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:05:13.000Z",
      "valid_until": "2026-04-04T14:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T13:30:15.339Z",
      "x_nadsec_last_seen": "2026-03-03T13:30:15.339Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=LU; asn=53667; asn_org=FranTech Solutions",
      "id": "indicator--10b0ae1d-9a20-433f-ad36-c247b2822257",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '107.189.30.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T14:16:15.206Z",
      "x_nadsec_last_seen": "2026-03-03T14:16:16.280Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "LU"
      ],
      "x_nadsec_asns": [
        "53667"
      ],
      "x_nadsec_orgs": [
        "FranTech Solutions"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--37bfcffe-4ee5-4b57-8d52-acfd8524968d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.68.90.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T14:25:33.621Z",
      "x_nadsec_last_seen": "2026-03-03T14:25:33.621Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--abf68990-e42c-4f23-83a4-b8c8e8504797",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.189.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T14:26:38.635Z",
      "x_nadsec_last_seen": "2026-03-03T14:26:39.081Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9f83be76-66a0-4527-b7a5-42db074d1b35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T14:22:59.698Z",
      "x_nadsec_last_seen": "2026-03-03T14:22:59.698Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--691a87fa-6c8d-443d-9354-4bfc0b69398e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.104.11.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-03T14:32:14.628Z",
      "x_nadsec_last_seen": "2026-03-31T18:23:24.717Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=EC; asn=27947; asn_org=Telconet S.A; user(top)=**",
      "id": "indicator--56859250-6687-4494-b143-744a5753c60f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.39.108.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T15:00:38.657Z",
      "x_nadsec_last_seen": "2026-03-03T15:00:38.657Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "27947"
      ],
      "x_nadsec_orgs": [
        "Telconet S.A"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=205100; asn_org=F3 Netze e.V.",
      "id": "indicator--0daf1a46-a413-452d-8029-bdba033aa0ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T14:17:31.627Z",
      "x_nadsec_last_seen": "2026-03-03T14:17:31.627Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "205100"
      ],
      "x_nadsec_orgs": [
        "F3 Netze e.V."
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=DE; asn=205100; asn_org=F3 Netze e.V.",
      "id": "indicator--3c75293e-c0a4-4863-a06e-3ce21b12ea7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T14:15:32.751Z",
      "x_nadsec_last_seen": "2026-03-03T14:15:43.632Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "205100"
      ],
      "x_nadsec_orgs": [
        "F3 Netze e.V."
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=DE; asn=60729; asn_org=Stiftung Erneuerbare Freiheit",
      "id": "indicator--77202c5d-0d71-44db-ac55-a02629d2992a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T14:16:37.339Z",
      "x_nadsec_last_seen": "2026-03-03T14:16:38.164Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "60729"
      ],
      "x_nadsec_orgs": [
        "Stiftung Erneuerbare Freiheit"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=60729; asn_org=Stiftung Erneuerbare Freiheit",
      "id": "indicator--9dac09f0-300b-4111-aff8-9eecd2f9ed8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T14:15:11.123Z",
      "x_nadsec_last_seen": "2026-03-03T14:15:11.123Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "60729"
      ],
      "x_nadsec_orgs": [
        "Stiftung Erneuerbare Freiheit"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=NL; asn=200651; asn_org=FlokiNET ehf",
      "id": "indicator--4367f8cc-845d-498e-a552-ceca80cf8725",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.246.188.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T14:14:59.438Z",
      "x_nadsec_last_seen": "2026-03-03T14:15:01.004Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "200651"
      ],
      "x_nadsec_orgs": [
        "FlokiNET ehf"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=httpd; ports=81; cc=IS; asn=200651; asn_org=FlokiNET ehf",
      "id": "indicator--8a512f1a-b7cd-4f2b-9d67-f27027bc99d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.246.190.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-03T14:15:21.036Z",
      "x_nadsec_last_seen": "2026-03-03T14:16:59.880Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IS"
      ],
      "x_nadsec_asns": [
        "200651"
      ],
      "x_nadsec_orgs": [
        "FlokiNET ehf"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28252; asn_org=WorldNet Telecom Comercio e Servicos de Telecomuni",
      "id": "indicator--83481cc2-4700-4b29-a1eb-9e661916d5b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.1.163.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-03T14:52:53.055Z",
      "x_nadsec_last_seen": "2026-03-27T03:49:39.431Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28252"
      ],
      "x_nadsec_orgs": [
        "WorldNet Telecom Comercio e Servicos de Telecomuni"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=263478; asn_org=DUFIBRANET TELECOM LTDA",
      "id": "indicator--0a0b345f-46bf-4905-89d1-f57a172d7d98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.242.192.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T14:46:56.209Z",
      "x_nadsec_last_seen": "2026-03-03T14:49:03.803Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263478"
      ],
      "x_nadsec_orgs": [
        "DUFIBRANET TELECOM LTDA"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=8570; asn_org=Rostelecom",
      "id": "indicator--d53ea49f-fd66-4390-aa7b-9d84856b861f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.34.243.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-03T14:05:27.810Z",
      "x_nadsec_last_seen": "2026-03-14T14:01:08.737Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8570"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e564d18d-9313-4c7f-98d5-036e968f84a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.98.166.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T14:25:21.881Z",
      "x_nadsec_last_seen": "2026-03-03T14:25:21.881Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e12c2c48-a1ce-43f2-a5bd-ee4cd0fc6cef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.185.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T14:19:19.989Z",
      "x_nadsec_last_seen": "2026-03-03T14:19:19.989Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--f817a2f4-11f4-4711-a1cd-03a23d7d4a81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.109.181.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T15:01:58.188Z",
      "x_nadsec_last_seen": "2026-03-03T15:04:04.502Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=61125; asn_org=Sabotage LLC",
      "id": "indicator--0d202aa1-0284-4440-a2ba-c3c831985982",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.66.35.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T14:14:49.471Z",
      "x_nadsec_last_seen": "2026-03-03T14:14:49.471Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "61125"
      ],
      "x_nadsec_orgs": [
        "Sabotage LLC"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=SE; asn=214503; asn_org=QuxLabs AB",
      "id": "indicator--40317f30-ef03-4ac7-aa37-3088379794f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T14:17:20.788Z",
      "x_nadsec_last_seen": "2026-03-03T14:17:21.679Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "214503"
      ],
      "x_nadsec_orgs": [
        "QuxLabs AB"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--80633887-0ef6-46c7-acbd-b3337b80a45e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T14:16:32.323Z",
      "x_nadsec_last_seen": "2026-03-28T12:35:42.880Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--71fa9a05-b14e-4624-bbd6-17cd74b2bd1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.247.99.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T15:01:09.909Z",
      "x_nadsec_last_seen": "2026-03-03T15:03:16.873Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-03T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=SE; asn=33837; asn_org=Fredrik Holmqvist",
      "id": "indicator--2496c921-a981-4eec-abda-75d6dc441403",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.80.26.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T15:05:13.000Z",
      "valid_until": "2026-04-04T15:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T14:17:09.911Z",
      "x_nadsec_last_seen": "2026-03-03T14:17:10.792Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "33837"
      ],
      "x_nadsec_orgs": [
        "Fredrik Holmqvist"
      ]
    },
    {
      "created": "2026-03-03T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--917e97e9-fe8f-47db-b5bc-d4843b539a9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.55.255.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:05:13.000Z",
      "valid_until": "2026-04-04T16:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T15:28:41.768Z",
      "x_nadsec_last_seen": "2026-03-03T15:28:42.173Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-03T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--2c779985-a517-4858-aa48-9363ccfb939a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.99.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:05:13.000Z",
      "valid_until": "2026-04-04T16:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T15:45:01.083Z",
      "x_nadsec_last_seen": "2026-03-03T15:45:27.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-03T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45433; asn_org=Kappa Internet Services Private Limited",
      "id": "indicator--d318c61a-b9dc-4d1c-ae29-7e83a70b589d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.178.102.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:05:13.000Z",
      "valid_until": "2026-04-04T16:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T15:17:31.254Z",
      "x_nadsec_last_seen": "2026-03-03T15:17:31.254Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45433"
      ],
      "x_nadsec_orgs": [
        "Kappa Internet Services Private Limited"
      ]
    },
    {
      "created": "2026-03-03T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KR; asn=3786; asn_org=LG DACOM Corporation",
      "id": "indicator--892b9cd9-9519-45b3-a58b-b908b44a9a1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.91.31.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:05:13.000Z",
      "valid_until": "2026-04-04T16:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T15:41:41.153Z",
      "x_nadsec_last_seen": "2026-03-03T15:43:45.743Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "3786"
      ],
      "x_nadsec_orgs": [
        "LG DACOM Corporation"
      ]
    },
    {
      "created": "2026-03-03T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--dc0ff5d4-ea60-4603-9784-80d8d18efe1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.99.171.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:05:13.000Z",
      "valid_until": "2026-04-04T16:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T15:44:25.506Z",
      "x_nadsec_last_seen": "2026-03-03T15:46:30.827Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-03-03T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--5f5766af-7946-41e4-b2dc-fc4bdb625259",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '144.123.170.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:05:13.000Z",
      "valid_until": "2026-04-04T16:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T15:56:50.847Z",
      "x_nadsec_last_seen": "2026-03-03T15:58:59.913Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-03T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--06599d2f-34fa-48dc-9a4b-fa1ddc9b9b41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:05:13.000Z",
      "valid_until": "2026-04-04T16:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T15:19:00.033Z",
      "x_nadsec_last_seen": "2026-03-22T23:20:27.712Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-03T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--8ae441bf-b6c4-48d4-9a8f-35c110b1bc6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.129.210.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:05:13.000Z",
      "valid_until": "2026-04-04T16:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T15:16:59.349Z",
      "x_nadsec_last_seen": "2026-03-03T15:16:59.543Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-03-03T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--6b57b974-65ce-40c1-9b01-0b33ce04a03d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:05:13.000Z",
      "valid_until": "2026-04-04T16:05:11.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-03T15:05:13.836Z",
      "x_nadsec_last_seen": "2026-03-31T03:17:44.532Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-03T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=267391; asn_org=ALL KEYS COMERCIO DE EQUIPAMENTOS DE INFORMATICA L",
      "id": "indicator--05ea3889-8242-4a27-9662-09bcdee13265",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.235.4.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:05:13.000Z",
      "valid_until": "2026-04-04T16:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T15:32:12.848Z",
      "x_nadsec_last_seen": "2026-03-03T15:39:26.414Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "267391"
      ],
      "x_nadsec_orgs": [
        "ALL KEYS COMERCIO DE EQUIPAMENTOS DE INFORMATICA L"
      ]
    },
    {
      "created": "2026-03-03T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--56c4bc92-1d82-43a3-909b-2312d76ca4d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.231.106.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:05:13.000Z",
      "valid_until": "2026-04-04T16:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T15:58:12.431Z",
      "x_nadsec_last_seen": "2026-03-03T16:00:19.266Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-03T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=BD; asn=137059; asn_org=Easy Net",
      "id": "indicator--4e7b9bd8-576b-4a8b-bc9b-0305b56e18a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.171.143.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:05:13.000Z",
      "valid_until": "2026-04-04T17:05:12.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-03T16:08:27.014Z",
      "x_nadsec_last_seen": "2026-03-03T18:19:46.348Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "137059"
      ],
      "x_nadsec_orgs": [
        "Easy Net"
      ]
    },
    {
      "created": "2026-03-03T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f2425490-8f27-446c-972f-2ef9642685de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.30.249.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:05:13.000Z",
      "valid_until": "2026-04-04T17:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T16:48:12.863Z",
      "x_nadsec_last_seen": "2026-03-10T22:26:59.543Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-03T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262417; asn_org=UltraTelecom Provedora de Internet",
      "id": "indicator--f71493b9-6ad9-4172-823f-c848093a56aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '131.255.132.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:05:13.000Z",
      "valid_until": "2026-04-04T17:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T16:51:09.720Z",
      "x_nadsec_last_seen": "2026-03-03T16:51:17.051Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262417"
      ],
      "x_nadsec_orgs": [
        "UltraTelecom Provedora de Internet"
      ]
    },
    {
      "created": "2026-03-03T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--fc4c5a81-42d8-42e9-a448-46ace9d9a0e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.59.39.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:05:13.000Z",
      "valid_until": "2026-04-04T17:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T16:59:04.300Z",
      "x_nadsec_last_seen": "2026-03-03T17:01:10.829Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-03T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8ac2642c-ed00-408c-9fd8-e4b55db4e8e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.81.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:05:13.000Z",
      "valid_until": "2026-04-04T17:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T16:54:06.276Z",
      "x_nadsec_last_seen": "2026-03-03T16:54:06.562Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-03T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e1eee194-08b0-4dc9-af56-166941c394a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:05:13.000Z",
      "valid_until": "2026-04-04T17:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T16:50:20.114Z",
      "x_nadsec_last_seen": "2026-03-03T16:50:20.114Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-03T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--546f3214-3cdb-4c1a-ae79-7256e5965758",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:05:13.000Z",
      "valid_until": "2026-04-04T17:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T16:34:02.101Z",
      "x_nadsec_last_seen": "2026-03-03T16:34:12.261Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-03T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--90293941-b72f-42d3-ba1b-b3688657e173",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.37.183.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:05:13.000Z",
      "valid_until": "2026-04-04T17:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T16:40:41.059Z",
      "x_nadsec_last_seen": "2026-03-03T16:47:40.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-03T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=48642; asn_org=Joint stock company For",
      "id": "indicator--23a8aaa0-6652-4228-a9a9-7da79856ee06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.36.23.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:05:13.000Z",
      "valid_until": "2026-04-04T17:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T16:24:18.967Z",
      "x_nadsec_last_seen": "2026-03-03T16:26:26.191Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48642"
      ],
      "x_nadsec_orgs": [
        "Joint stock company For"
      ]
    },
    {
      "created": "2026-03-03T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--28d65b6d-52b8-4d3e-b92e-f01f5cac77d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.85.241.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:05:13.000Z",
      "valid_until": "2026-04-04T17:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-03T17:03:41.123Z",
      "x_nadsec_last_seen": "2026-03-28T04:17:47.361Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-03-03T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=JP; asn=2497; asn_org=Internet Initiative Japan Inc.",
      "id": "indicator--1e9989a0-40b4-4968-a520-7db9c70ee99f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.128.132.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:05:13.000Z",
      "valid_until": "2026-04-04T18:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-03T17:39:48.548Z",
      "x_nadsec_last_seen": "2026-03-18T07:48:35.689Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "2497"
      ],
      "x_nadsec_orgs": [
        "Internet Initiative Japan Inc."
      ]
    },
    {
      "created": "2026-03-03T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5aa3e11a-8164-453e-b008-90414cbac928",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.180.45.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:05:13.000Z",
      "valid_until": "2026-04-04T18:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T17:08:01.210Z",
      "x_nadsec_last_seen": "2026-03-03T17:10:05.888Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-03T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--0411850e-ac1d-4701-ae00-7ab0205445bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:05:13.000Z",
      "valid_until": "2026-04-04T18:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T17:18:15.751Z",
      "x_nadsec_last_seen": "2026-03-03T17:18:15.751Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-03T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--9f68e0d0-d947-4150-88e0-a70649467e3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:05:13.000Z",
      "valid_until": "2026-04-04T18:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T17:07:39.534Z",
      "x_nadsec_last_seen": "2026-03-03T17:09:47.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-03-03T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GB; asn=203851; asn_org=CSD Network Services Ltd",
      "id": "indicator--d75a13f5-f242-49be-a237-d0553a2d0d80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.87.212.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:05:13.000Z",
      "valid_until": "2026-04-04T18:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-03T17:29:32.262Z",
      "x_nadsec_last_seen": "2026-03-23T06:45:13.576Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "203851"
      ],
      "x_nadsec_orgs": [
        "CSD Network Services Ltd"
      ]
    },
    {
      "created": "2026-03-03T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3313db43-ae0f-4e1f-9f48-b34e46be2411",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:05:13.000Z",
      "valid_until": "2026-04-04T18:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T17:55:17.151Z",
      "x_nadsec_last_seen": "2026-03-03T17:55:17.151Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-03T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--53ffec28-d4e2-49db-817e-af88c4650150",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:05:13.000Z",
      "valid_until": "2026-04-04T18:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T17:55:17.880Z",
      "x_nadsec_last_seen": "2026-03-03T17:55:17.880Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-03T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--79b94aa4-f50e-44f1-9731-11aca4d75734",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:05:13.000Z",
      "valid_until": "2026-04-04T18:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T17:11:59.741Z",
      "x_nadsec_last_seen": "2026-03-24T18:17:29.095Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-03T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BJ; asn=328228; asn_org=SBIN-AS",
      "id": "indicator--2bffc05f-5ca9-4bcc-ac2a-f830e2d0ee32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.91.232.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:05:13.000Z",
      "valid_until": "2026-04-04T18:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T17:45:01.323Z",
      "x_nadsec_last_seen": "2026-03-03T17:45:01.365Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BJ"
      ],
      "x_nadsec_asns": [
        "328228"
      ],
      "x_nadsec_orgs": [
        "SBIN-AS"
      ]
    },
    {
      "created": "2026-03-03T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--0a70c5b6-4efb-4f65-b9c1-baea0615176a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.182.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T18:05:13.000Z",
      "valid_until": "2026-04-04T18:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T17:33:55.184Z",
      "x_nadsec_last_seen": "2026-03-03T17:33:55.703Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c72b69f4-f2cc-4f65-98d2-d25e6b6f2e5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.36.97.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T18:45:19.477Z",
      "x_nadsec_last_seen": "2026-03-03T18:45:48.813Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--549bb524-14a1-4310-9596-580b931dbae7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.250.158.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T18:38:35.920Z",
      "x_nadsec_last_seen": "2026-03-03T18:40:42.274Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e476c3c2-33c9-4876-962a-e9061b4f2afc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.193.59.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T18:57:21.112Z",
      "x_nadsec_last_seen": "2026-03-03T18:57:41.334Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--d0f5fe60-d525-4059-8a51-84cc8d16ba82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.71.137.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T18:08:31.313Z",
      "x_nadsec_last_seen": "2026-03-03T18:10:36.856Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--b83c4bc2-ac81-4979-bd43-385c942d8e2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.226.38.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-03T18:14:05.410Z",
      "x_nadsec_last_seen": "2026-03-27T22:29:40.147Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2cad1e8e-d6c1-4405-87f0-fefd0c342dcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.207.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T18:35:48.044Z",
      "x_nadsec_last_seen": "2026-03-03T18:36:17.458Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--20d7e53f-f2f9-4179-b98a-a435fda573e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.80.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T18:49:22.103Z",
      "x_nadsec_last_seen": "2026-03-03T18:49:25.392Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--dc6bae7f-e2fc-4218-a40c-3494decdb990",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T18:17:41.103Z",
      "x_nadsec_last_seen": "2026-03-03T18:18:11.105Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--1b60a3ae-2989-4199-8832-934c0d72a6aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.129.74.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-03T18:56:52.650Z",
      "x_nadsec_last_seen": "2026-03-16T06:50:49.983Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--786aa87b-4dbb-4d2c-b48d-6a57895dc29b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.241.154.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-03-03T19:03:57.705Z",
      "x_nadsec_last_seen": "2026-03-03T19:06:46.466Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--52ff7a91-3eb8-42e1-9d9c-18e1efd2e52a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.107.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T18:16:50.336Z",
      "x_nadsec_last_seen": "2026-03-03T18:16:50.336Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--1d97ad79-ca6b-4ca2-87f7-784f98db5cfe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.83.19.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-03T18:58:34.023Z",
      "x_nadsec_last_seen": "2026-03-18T14:07:03.448Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--81328fbc-5c1b-4aed-969e-a01f5601be22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.72.73.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-03T18:40:35.416Z",
      "x_nadsec_last_seen": "2026-03-20T09:40:39.973Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--7c7b40be-80ac-45ce-95ef-e282428e41e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.211.199.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T18:26:47.054Z",
      "x_nadsec_last_seen": "2026-03-07T11:58:24.978Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--ed4b3f8b-9e41-4ff4-942a-52b369402d21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.43.58.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-03T18:58:29.103Z",
      "x_nadsec_last_seen": "2026-03-03T19:33:44.975Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-03-03T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--469214dc-f310-473f-863f-b6482ad5d688",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.109.43.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:05:13.000Z",
      "valid_until": "2026-04-04T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T18:48:58.390Z",
      "x_nadsec_last_seen": "2026-03-03T18:51:05.104Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-03T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f6f4fb69-e71e-4828-8ede-0412d1a56d9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.193.47.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:05:12.000Z",
      "valid_until": "2026-04-04T20:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T19:28:12.622Z",
      "x_nadsec_last_seen": "2026-03-03T19:28:32.196Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-03T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=IN; asn=141148; asn_org=MYBHARAT NET PRIVATE LIMITED; user(top)=**",
      "id": "indicator--9726c8f5-1a13-40ed-986d-fed588a0d099",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.61.72.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:05:12.000Z",
      "valid_until": "2026-04-04T20:05:11.000Z",
      "x_nadsec_event_count": 150,
      "x_nadsec_first_seen": "2026-03-03T19:14:15.737Z",
      "x_nadsec_last_seen": "2026-03-27T09:46:14.364Z",
      "x_nadsec_ports": [
        "3306",
        "1433"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135175",
        "141148"
      ],
      "x_nadsec_orgs": [
        "Facts Online Pvt Ltd",
        "MYBHARAT NET PRIVATE LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-03T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--442bbc9f-f730-4bf3-a78f-633bb70593ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:05:12.000Z",
      "valid_until": "2026-04-04T20:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-03T19:41:57.465Z",
      "x_nadsec_last_seen": "2026-03-07T04:23:50.692Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-03-03T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--52977cb2-7839-404f-a8f5-4b733194305f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.95.255.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:05:12.000Z",
      "valid_until": "2026-04-04T20:05:11.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-03T19:49:39.670Z",
      "x_nadsec_last_seen": "2026-03-03T19:49:47.292Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-03-03T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--16b884a3-d3bc-4c88-abc9-66d36c714b6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.238.57.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:05:12.000Z",
      "valid_until": "2026-04-04T20:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T19:28:33.334Z",
      "x_nadsec_last_seen": "2026-03-03T19:28:37.923Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-03T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--59596866-caba-4832-ae80-7ca9fb429254",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.219.238.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:05:12.000Z",
      "valid_until": "2026-04-04T20:05:11.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-03T19:15:47.895Z",
      "x_nadsec_last_seen": "2026-03-29T11:00:59.364Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-03T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--09e030a5-6888-4301-8171-2a5f7199c6c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.221.207.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:05:12.000Z",
      "valid_until": "2026-04-04T20:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T19:22:27.220Z",
      "x_nadsec_last_seen": "2026-03-03T19:22:34.240Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-03-03T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--dd361783-959a-4618-9b54-98871cbb828a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.6.65.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:05:12.000Z",
      "valid_until": "2026-04-04T20:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T19:29:59.272Z",
      "x_nadsec_last_seen": "2026-03-03T19:32:04.374Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-03-03T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c1b4eb44-6f6f-446b-ab7b-aee02ba971e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:05:12.000Z",
      "valid_until": "2026-04-04T20:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T19:30:53.411Z",
      "x_nadsec_last_seen": "2026-03-03T19:38:20.418Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-03T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--895b3627-7970-4d76-a017-8ddbd4da8fe0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.72.31.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:05:12.000Z",
      "valid_until": "2026-04-04T20:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T19:22:53.281Z",
      "x_nadsec_last_seen": "2026-03-03T19:29:34.811Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-03T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--faccec54-c492-44f1-abfe-43ac813b5af4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.74.212.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:05:12.000Z",
      "valid_until": "2026-04-04T20:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T19:12:59.751Z",
      "x_nadsec_last_seen": "2026-03-03T19:13:00.401Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-03T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--6d86b696-c9b7-4a66-a49d-8a0b55317e87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:05:12.000Z",
      "valid_until": "2026-04-04T20:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T19:38:57.268Z",
      "x_nadsec_last_seen": "2026-03-03T19:38:57.268Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-03T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=33363; asn_org=Charter Communications, Inc",
      "id": "indicator--8dae792e-d457-4222-96f7-c2896cb5d4f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '97.71.249.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:05:12.000Z",
      "valid_until": "2026-04-04T20:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T19:56:26.679Z",
      "x_nadsec_last_seen": "2026-03-03T19:58:32.195Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "33363"
      ],
      "x_nadsec_orgs": [
        "Charter Communications, Inc"
      ]
    },
    {
      "created": "2026-03-03T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BA; asn=25144; asn_org=Telekomunikacije Republike Srpske akcionarsko drustvo Banja Luka",
      "id": "indicator--02165f82-453f-4a9f-a5cc-1409ab0c8a4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.165.156.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:05:13.000Z",
      "valid_until": "2026-04-04T21:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-03T20:49:43.451Z",
      "x_nadsec_last_seen": "2026-03-03T21:44:27.170Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BA"
      ],
      "x_nadsec_asns": [
        "25144"
      ],
      "x_nadsec_orgs": [
        "Telekomunikacije Republike Srpske akcionarsko drustvo Banja Luka"
      ]
    },
    {
      "created": "2026-03-03T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=135407; asn_org=Trans World Enterprise Services Private Limited",
      "id": "indicator--220f8733-c351-4c77-bb55-22c538fc85e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.73.110.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:05:13.000Z",
      "valid_until": "2026-04-04T21:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-03T20:31:47.534Z",
      "x_nadsec_last_seen": "2026-03-22T18:01:44.556Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "135407"
      ],
      "x_nadsec_orgs": [
        "Trans World Enterprise Services Private Limited"
      ]
    },
    {
      "created": "2026-03-03T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--559227d6-7891-4ac8-a346-2824bad38fef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.169.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:05:13.000Z",
      "valid_until": "2026-04-04T21:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T20:45:12.099Z",
      "x_nadsec_last_seen": "2026-03-03T20:45:12.099Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-03T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.",
      "id": "indicator--9885c9b1-9f27-4a41-9c8f-38272be5852f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.244.149.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:05:13.000Z",
      "valid_until": "2026-04-04T21:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T20:28:56.150Z",
      "x_nadsec_last_seen": "2026-03-03T20:28:56.150Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11172"
      ],
      "x_nadsec_orgs": [
        "Alestra, S. de R.L. de C.V."
      ]
    },
    {
      "created": "2026-03-03T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UG; asn=37063; asn_org=Roke Investments International",
      "id": "indicator--11df5009-dcde-4205-8536-3bd75db34eca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.0.131.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:05:13.000Z",
      "valid_until": "2026-04-04T21:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T20:44:49.254Z",
      "x_nadsec_last_seen": "2026-03-03T20:46:57.013Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UG"
      ],
      "x_nadsec_asns": [
        "37063"
      ],
      "x_nadsec_orgs": [
        "Roke Investments International"
      ]
    },
    {
      "created": "2026-03-03T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=UG; asn=327724; asn_org=NITA; user(top)=**",
      "id": "indicator--90b9c24d-6fce-484d-b622-287e5a792688",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.72.193.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:05:13.000Z",
      "valid_until": "2026-04-04T21:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T20:18:22.771Z",
      "x_nadsec_last_seen": "2026-03-03T20:18:24.635Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UG"
      ],
      "x_nadsec_asns": [
        "327724"
      ],
      "x_nadsec_orgs": [
        "NITA"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-03T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7229f2bd-6ff9-4a8d-9c3c-b0f3c20953a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:05:13.000Z",
      "valid_until": "2026-04-04T21:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T20:33:30.722Z",
      "x_nadsec_last_seen": "2026-03-03T20:33:30.722Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-03T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.116.101.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:05:13.000Z",
      "valid_until": "2026-04-04T21:05:12.000Z",
      "x_nadsec_event_count": 178,
      "x_nadsec_first_seen": "2026-03-03T20:44:42.656Z",
      "x_nadsec_last_seen": "2026-03-31T21:22:25.367Z",
      "x_nadsec_ports": [
        "1433",
        "3306",
        "445",
        "81",
        "1723",
        "27017",
        "21"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld",
        "smbd",
        "httpd",
        "pptpd",
        "mongod",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-03T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=SV; asn=26617; asn_org=Navega.com S.A.",
      "id": "indicator--b8c31255-eca5-45ff-955a-26034e9f02d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.32.100.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:05:13.000Z",
      "valid_until": "2026-04-04T21:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T20:25:43.088Z",
      "x_nadsec_last_seen": "2026-03-04T01:14:28.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SV"
      ],
      "x_nadsec_asns": [
        "26617"
      ],
      "x_nadsec_orgs": [
        "Navega.com S.A."
      ]
    },
    {
      "created": "2026-03-03T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=11014; asn_org=CPS",
      "id": "indicator--27941a85-e92c-4cb0-946d-2ed351286054",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.104.223.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:05:13.000Z",
      "valid_until": "2026-04-04T21:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T20:13:39.578Z",
      "x_nadsec_last_seen": "2026-03-03T20:15:46.520Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11014"
      ],
      "x_nadsec_orgs": [
        "CPS"
      ]
    },
    {
      "created": "2026-03-03T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6b3ccc9f-b0b7-4352-a725-84d4458b898b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:05:13.000Z",
      "valid_until": "2026-04-04T21:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T20:14:35.322Z",
      "x_nadsec_last_seen": "2026-03-11T03:19:38.640Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-03T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--7aaf61c5-c4f5-454d-bab7-6cf5c152c621",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.130.236.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:05:13.000Z",
      "valid_until": "2026-04-04T21:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T20:59:07.403Z",
      "x_nadsec_last_seen": "2026-03-03T21:03:20.821Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-03T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--8728196c-7a69-437a-8976-460063c903dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.244.252.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:05:13.000Z",
      "valid_until": "2026-04-04T21:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T20:13:33.441Z",
      "x_nadsec_last_seen": "2026-03-03T20:13:33.441Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-03T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=epmapper; ports=135; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited",
      "id": "indicator--8dfee77e-4063-4ab7-9a72-097c4a1fdb8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:05:13.000Z",
      "valid_until": "2026-04-04T21:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-03T20:48:39.541Z",
      "x_nadsec_last_seen": "2026-03-03T20:49:20.015Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "212512"
      ],
      "x_nadsec_orgs": [
        "Detai Prosperous Technologies Limited"
      ]
    },
    {
      "created": "2026-03-03T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--a3c395ac-db85-4b3a-9e7d-52cf20536227",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:05:13.000Z",
      "valid_until": "2026-04-04T22:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T21:18:03.717Z",
      "x_nadsec_last_seen": "2026-03-03T21:18:03.717Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-03T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=GB; asn=42624; asn_org=Global-Data System IT Corporation",
      "id": "indicator--99a13c9f-e64f-4302-a151-21a6fc8361c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.196.10.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:05:13.000Z",
      "valid_until": "2026-04-04T22:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T21:06:12.625Z",
      "x_nadsec_last_seen": "2026-03-25T05:04:11.363Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "42624"
      ],
      "x_nadsec_orgs": [
        "Global-Data System IT Corporation"
      ]
    },
    {
      "created": "2026-03-03T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=GB; asn=42624; asn_org=Global-Data System IT Corporation",
      "id": "indicator--f728a434-77b5-445c-b165-6aefc4129f89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.196.9.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:05:13.000Z",
      "valid_until": "2026-04-04T22:05:12.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-03T21:06:08.736Z",
      "x_nadsec_last_seen": "2026-03-25T05:08:11.642Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "42624"
      ],
      "x_nadsec_orgs": [
        "Global-Data System IT Corporation"
      ]
    },
    {
      "created": "2026-03-03T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--39f5860b-1363-4c6e-9c3c-463604d82a9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.81.217.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:05:13.000Z",
      "valid_until": "2026-04-04T22:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T21:22:56.973Z",
      "x_nadsec_last_seen": "2026-03-03T21:22:56.973Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-03T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia; user(top)=**",
      "id": "indicator--4870cdc2-2f56-4f49-8587-125d92e428f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.81.72.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:05:13.000Z",
      "valid_until": "2026-04-04T22:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T21:44:27.529Z",
      "x_nadsec_last_seen": "2026-03-03T21:44:27.529Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-03T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=SC; asn=42624; asn_org=Global-Data System IT Corporation",
      "id": "indicator--e16e7c44-0adf-4345-987c-b16fb2ec014d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '69.5.189.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:05:13.000Z",
      "valid_until": "2026-04-04T22:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T21:07:31.451Z",
      "x_nadsec_last_seen": "2026-03-25T05:08:45.444Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "42624"
      ],
      "x_nadsec_orgs": [
        "Global-Data System IT Corporation"
      ]
    },
    {
      "created": "2026-03-03T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--6912e978-60e6-43a4-9ca0-a5d778b48cc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.235.221.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T22:05:13.000Z",
      "valid_until": "2026-04-04T22:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T21:17:07.024Z",
      "x_nadsec_last_seen": "2026-03-03T21:19:13.672Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-03T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e712b1ae-a0d2-4043-9672-2e0aab0a41c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.160.27.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:05:14.000Z",
      "valid_until": "2026-04-04T23:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T22:45:01.425Z",
      "x_nadsec_last_seen": "2026-03-03T22:51:53.084Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-03T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--865aa813-c684-4227-8145-b6c53472478d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.161.84.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:05:14.000Z",
      "valid_until": "2026-04-04T23:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T22:48:29.101Z",
      "x_nadsec_last_seen": "2026-03-03T22:48:53.472Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-03T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=48524; asn_org=INTERRA telecommunications group, Ltd.",
      "id": "indicator--9863086f-7765-4c64-a98e-41310d2e1982",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.211.177.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:05:14.000Z",
      "valid_until": "2026-04-04T23:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T22:27:57.889Z",
      "x_nadsec_last_seen": "2026-03-03T22:30:04.753Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48524"
      ],
      "x_nadsec_orgs": [
        "INTERRA telecommunications group, Ltd."
      ]
    },
    {
      "created": "2026-03-03T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--908c080b-fa15-4609-901c-a0d67b8e769f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.71.94.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:05:14.000Z",
      "valid_until": "2026-04-04T23:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T22:26:44.209Z",
      "x_nadsec_last_seen": "2026-03-03T22:33:55.862Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-03T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=264628; asn_org=CORPORACION FIBEX TELECOM, C.A.",
      "id": "indicator--cc709ada-12b9-4c72-805e-56867cb5fed7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.8.164.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:05:14.000Z",
      "valid_until": "2026-04-04T23:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T22:26:27.058Z",
      "x_nadsec_last_seen": "2026-03-03T22:34:46.671Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "264628"
      ],
      "x_nadsec_orgs": [
        "CORPORACION FIBEX TELECOM, C.A."
      ]
    },
    {
      "created": "2026-03-03T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--d4f54fd0-49b1-4392-a6b6-19f925cd9f58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.79.124.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:05:14.000Z",
      "valid_until": "2026-04-04T23:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T22:29:15.642Z",
      "x_nadsec_last_seen": "2026-03-03T22:29:15.642Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-03T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--18d5b803-a3fa-422b-b6c1-530c19c10436",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.88.88.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:05:14.000Z",
      "valid_until": "2026-04-04T23:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T22:09:40.925Z",
      "x_nadsec_last_seen": "2026-03-03T22:10:04.760Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-03T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--788e1e14-6fe0-4aae-9c18-86cbb7f2474b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-03T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:05:14.000Z",
      "valid_until": "2026-04-04T23:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T22:30:45.098Z",
      "x_nadsec_last_seen": "2026-03-03T22:30:45.098Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-04T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--cf2a72b5-c232-46d1-8c29-e9679830df33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.4.228.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:05:12.000Z",
      "valid_until": "2026-04-05T00:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T23:31:27.900Z",
      "x_nadsec_last_seen": "2026-03-03T23:33:33.510Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-04T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=34267; asn_org=Rostelecom",
      "id": "indicator--40afe9d5-1a1c-45db-b090-3d662f2e9578",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.198.193.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:05:12.000Z",
      "valid_until": "2026-04-05T00:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T23:33:22.566Z",
      "x_nadsec_last_seen": "2026-03-03T23:35:29.609Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "34267"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-04T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KR; asn=4766; asn_org=Korea Telecom; user(top)=**",
      "id": "indicator--e43f50ba-18ac-47c9-a339-7ceb18fdd8bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.23.123.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:05:12.000Z",
      "valid_until": "2026-04-05T00:05:11.000Z",
      "x_nadsec_event_count": 144,
      "x_nadsec_first_seen": "2026-03-04T00:00:15.915Z",
      "x_nadsec_last_seen": "2026-03-16T07:56:57.534Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "4766"
      ],
      "x_nadsec_orgs": [
        "Korea Telecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--e044d4e1-bec8-4a3e-9081-925087295410",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.26.175.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:05:12.000Z",
      "valid_until": "2026-04-05T00:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-03T23:29:59.612Z",
      "x_nadsec_last_seen": "2026-03-03T23:32:04.213Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-04T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4243b226-464a-453a-b139-04104fd9b50a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.161.0.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:05:12.000Z",
      "valid_until": "2026-04-05T00:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T23:48:20.133Z",
      "x_nadsec_last_seen": "2026-03-03T23:48:20.187Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=265312; asn_org=Portal Conexao Ltda",
      "id": "indicator--b8339c72-f64c-49fb-a141-301a9a6770b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '168.121.138.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:05:12.000Z",
      "valid_until": "2026-04-05T00:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T23:21:47.110Z",
      "x_nadsec_last_seen": "2026-03-03T23:26:59.269Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "265312"
      ],
      "x_nadsec_orgs": [
        "Portal Conexao Ltda"
      ]
    },
    {
      "created": "2026-03-04T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mongod; ports=27017; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--23612ece-de51-47c0-93f7-5aaf3d5f97d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:05:12.000Z",
      "valid_until": "2026-04-05T00:05:11.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-03-03T23:30:02.275Z",
      "x_nadsec_last_seen": "2026-03-26T01:37:09.811Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-04T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--526182cd-09d2-4b56-8a5f-cfc18b4329a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:05:12.000Z",
      "valid_until": "2026-04-05T00:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-03T23:30:34.666Z",
      "x_nadsec_last_seen": "2026-03-26T01:34:02.953Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-04T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--0b1f330f-5f83-46b3-8f03-d524d7bc3f1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:05:12.000Z",
      "valid_until": "2026-04-05T00:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T23:30:18.297Z",
      "x_nadsec_last_seen": "2026-03-26T01:36:21.184Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-04T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mongod; ports=27017; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--d0bec879-9da1-408a-bdde-9ec9e0b89f28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:05:12.000Z",
      "valid_until": "2026-04-05T00:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-03T23:30:01.651Z",
      "x_nadsec_last_seen": "2026-03-26T01:32:11.685Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-04T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--13714d57-791f-47a1-89cd-55e14b371818",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.13.28.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:05:12.000Z",
      "valid_until": "2026-04-05T00:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T00:02:11.669Z",
      "x_nadsec_last_seen": "2026-03-04T00:09:42.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-03-04T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=JP; asn=8075; asn_org=Microsoft Corporation; user(top)=**",
      "id": "indicator--7d225213-bdcb-4e2c-9f61-bd9fd063126a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.191.189.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:05:12.000Z",
      "valid_until": "2026-04-05T00:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-03T23:58:27.406Z",
      "x_nadsec_last_seen": "2026-03-03T23:58:27.406Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T00:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c6877959-f461-4748-bc7f-004bc68f8a76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T00:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T00:05:12.000Z",
      "valid_until": "2026-04-05T00:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-03T23:18:24.168Z",
      "x_nadsec_last_seen": "2026-03-24T17:02:11.603Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--6cb46c0b-266b-40a5-a47a-6b0063060198",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.0.126.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:05:13.000Z",
      "valid_until": "2026-04-05T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T00:33:19.437Z",
      "x_nadsec_last_seen": "2026-03-04T00:33:19.437Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-03-04T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--fa383c44-4722-446c-9f09-295ceda0486b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.69.124.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:05:13.000Z",
      "valid_until": "2026-04-05T01:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T00:34:36.411Z",
      "x_nadsec_last_seen": "2026-03-04T00:36:40.864Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-04T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6388b17c-e9af-426b-9ad5-327b5021b6b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.87.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:05:13.000Z",
      "valid_until": "2026-04-05T01:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T00:25:51.782Z",
      "x_nadsec_last_seen": "2026-03-04T00:27:56.465Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--22051bd6-75d3-4aa5-a522-0b491386e66a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:05:13.000Z",
      "valid_until": "2026-04-05T01:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T00:06:56.719Z",
      "x_nadsec_last_seen": "2026-03-13T09:35:49.748Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-03-04T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--45cf0bf6-9ea1-4e57-a9cc-077a22a73722",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.241.128.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:05:13.000Z",
      "valid_until": "2026-04-05T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T00:11:49.712Z",
      "x_nadsec_last_seen": "2026-03-04T00:11:49.712Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-04T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b0a88399-2294-488d-9d6a-a90b556c9b29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.83.48.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:05:13.000Z",
      "valid_until": "2026-04-05T01:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T00:21:13.068Z",
      "x_nadsec_last_seen": "2026-03-04T00:21:23.262Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-04T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CO; asn=19429; asn_org=Colombia",
      "id": "indicator--6a2ad340-a226-4286-a82f-51ca31012993",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.69.103.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:05:13.000Z",
      "valid_until": "2026-04-05T01:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T00:39:40.394Z",
      "x_nadsec_last_seen": "2026-03-04T00:39:44.855Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "19429"
      ],
      "x_nadsec_orgs": [
        "Colombia"
      ]
    },
    {
      "created": "2026-03-04T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--41b18ad1-9a42-4237-a000-abfe417fdeb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.226.155.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:05:13.000Z",
      "valid_until": "2026-04-05T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T00:48:37.478Z",
      "x_nadsec_last_seen": "2026-03-04T00:48:37.478Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-04T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PE; asn=274294; asn_org=CABLE VISION MAGES S.A.C.",
      "id": "indicator--bb62b251-67cf-482f-be76-475d777ca0fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.137.192.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:05:13.000Z",
      "valid_until": "2026-04-05T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T00:40:29.429Z",
      "x_nadsec_last_seen": "2026-03-04T00:40:29.429Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "274294"
      ],
      "x_nadsec_orgs": [
        "CABLE VISION MAGES S.A.C."
      ]
    },
    {
      "created": "2026-03-04T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--39bfb757-c089-4cc9-a42a-b90eeb5c3cc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.80.211.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:05:12.000Z",
      "valid_until": "2026-04-05T02:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T01:09:36.239Z",
      "x_nadsec_last_seen": "2026-03-04T01:11:43.754Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-03-04T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d3077520-7af0-4ecd-bb7f-56045b78fc90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.161.5.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:05:12.000Z",
      "valid_until": "2026-04-05T02:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T01:55:46.319Z",
      "x_nadsec_last_seen": "2026-03-04T02:02:12.924Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--20733a24-f560-445c-8a05-cb85be93a9c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.191.33.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:05:12.000Z",
      "valid_until": "2026-04-05T02:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T01:32:53.857Z",
      "x_nadsec_last_seen": "2026-03-04T01:39:28.953Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--be976e5c-7f61-4ed2-a6c0-110130d4cb95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.77.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:05:12.000Z",
      "valid_until": "2026-04-05T02:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T01:46:04.775Z",
      "x_nadsec_last_seen": "2026-03-24T10:06:53.537Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-03-04T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--cfab599e-ed24-4d3e-b944-f9d7d8172b84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.230.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:05:12.000Z",
      "valid_until": "2026-04-05T02:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T01:36:12.748Z",
      "x_nadsec_last_seen": "2026-03-04T01:36:12.748Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-04T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--85436ae5-20b2-4863-9aee-3ef82b4955c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.101.138.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:05:12.000Z",
      "valid_until": "2026-04-05T02:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T02:00:26.107Z",
      "x_nadsec_last_seen": "2026-03-04T02:07:43.097Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-04T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--b48bff72-45e4-460b-b663-744c0dcab0a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.240.94.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:05:12.000Z",
      "valid_until": "2026-04-05T02:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T01:41:49.487Z",
      "x_nadsec_last_seen": "2026-03-04T07:28:08.030Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-04T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7ac3e886-c209-476c-bd17-4f18786e99a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:05:12.000Z",
      "valid_until": "2026-04-05T02:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T01:12:28.930Z",
      "x_nadsec_last_seen": "2026-03-04T01:12:28.930Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-04T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e1ef4e6f-891c-4cb0-904e-b981d91f2439",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:05:12.000Z",
      "valid_until": "2026-04-05T02:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T01:11:50.516Z",
      "x_nadsec_last_seen": "2026-03-04T01:11:50.516Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-04T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--24609302-afd6-4ec2-983c-460d2e561599",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:05:12.000Z",
      "valid_until": "2026-04-05T02:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T01:11:50.773Z",
      "x_nadsec_last_seen": "2026-03-04T01:11:50.773Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-04T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--85edcc56-17ca-40ad-9c28-63e1e23da451",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:05:12.000Z",
      "valid_until": "2026-04-05T02:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T01:12:18.665Z",
      "x_nadsec_last_seen": "2026-03-04T01:12:18.665Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-04T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--98fbd9ae-67d2-4adc-9869-7cfc93a5acc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.77.249.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:05:12.000Z",
      "valid_until": "2026-04-05T02:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T01:09:26.592Z",
      "x_nadsec_last_seen": "2026-03-04T01:11:32.696Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-04T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mqttd; ports=1883; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited",
      "id": "indicator--2505a098-300b-4d24-920a-048ca2c1439a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:05:12.000Z",
      "valid_until": "2026-04-05T02:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T01:07:33.466Z",
      "x_nadsec_last_seen": "2026-03-04T01:07:44.819Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "212512"
      ],
      "x_nadsec_orgs": [
        "Detai Prosperous Technologies Limited"
      ]
    },
    {
      "created": "2026-03-04T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--10b7b6d7-7797-4fbb-8697-96c0c086c23e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.191.190.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T02:05:12.000Z",
      "valid_until": "2026-04-05T02:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T01:39:18.117Z",
      "x_nadsec_last_seen": "2026-03-04T01:39:18.490Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=138754; asn_org=Kerala Vision Broad Band Private Limited",
      "id": "indicator--6f572be5-6d33-4ab2-842d-522095f3975e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.170.55.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T02:34:07.860Z",
      "x_nadsec_last_seen": "2026-03-04T02:41:23.162Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138754"
      ],
      "x_nadsec_orgs": [
        "Kerala Vision Broad Band Private Limited"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--c4a70e8f-d027-4c40-ad9f-45ecc7ba8f03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.99.254.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T02:22:11.044Z",
      "x_nadsec_last_seen": "2026-03-04T02:24:16.380Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--94ec991b-24db-48bc-8a11-348d95a73f2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.69.133.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T02:50:48.052Z",
      "x_nadsec_last_seen": "2026-03-04T02:57:31.023Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9905; asn_org=Linknet ASN",
      "id": "indicator--b7602daf-b3f5-4565-8686-c6ce7e9ca68d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.255.26.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T02:19:49.342Z",
      "x_nadsec_last_seen": "2026-03-04T02:21:54.779Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9905"
      ],
      "x_nadsec_orgs": [
        "Linknet ASN"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=16135; asn_org=Turkcell Iletisim Hizmetleri A.s.",
      "id": "indicator--1ae6ba84-f458-46ba-a55e-6644c3474c9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.196.72.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T02:55:31.777Z",
      "x_nadsec_last_seen": "2026-03-04T02:57:38.647Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "16135"
      ],
      "x_nadsec_orgs": [
        "Turkcell Iletisim Hizmetleri A.s."
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7778318d-9605-473d-a37d-0d8aa916f2c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T02:11:44.053Z",
      "x_nadsec_last_seen": "2026-03-30T19:36:58.916Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--9e8d7a25-8d5d-4179-8bd2-4c8ab9c27082",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.192.41.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T02:30:27.808Z",
      "x_nadsec_last_seen": "2026-03-04T02:32:32.880Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--e5d2739a-8111-4d53-bfd3-8d8978d54a5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.248.0.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T03:02:30.016Z",
      "x_nadsec_last_seen": "2026-03-04T03:02:30.358Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8fe26c43-3c3f-4218-946e-4a30c8aef002",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.249.102.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T02:46:13.218Z",
      "x_nadsec_last_seen": "2026-03-04T02:46:13.564Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--8e1cfcd5-7ae1-4fd6-8700-4c444a099855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.177.241.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T02:14:42.794Z",
      "x_nadsec_last_seen": "2026-03-04T02:16:48.714Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--d0211642-c6cd-4565-8f1e-c62224662245",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.253.223.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T03:02:25.678Z",
      "x_nadsec_last_seen": "2026-03-04T03:04:32.120Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7bd474ad-605f-48d8-a536-7d8c7fe2a861",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.83.151.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T02:28:36.002Z",
      "x_nadsec_last_seen": "2026-03-04T02:28:46.417Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CA; asn=7794; asn_org=Execulink Telecom Inc.",
      "id": "indicator--170a13e6-9053-4572-b2e9-a96c08a3ffb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '209.239.26.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T03:02:37.891Z",
      "x_nadsec_last_seen": "2026-03-04T03:09:29.499Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "7794"
      ],
      "x_nadsec_orgs": [
        "Execulink Telecom Inc."
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JO; asn=9038; asn_org=Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co",
      "id": "indicator--b8864b0a-2e7b-4cb2-963c-5e5d219d7fb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.118.18.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T02:27:12.352Z",
      "x_nadsec_last_seen": "2026-03-04T02:29:19.080Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "9038"
      ],
      "x_nadsec_orgs": [
        "Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2034; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--1d8ae1e0-01fe-46fe-8f5d-43173c06f16a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.247.240.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 3115,
      "x_nadsec_first_seen": "2026-03-04T02:30:21.274Z",
      "x_nadsec_last_seen": "2026-03-04T03:22:34.168Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--ff23ddcf-86de-42bf-99f8-a0000f4fbf54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.247.245.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-04T02:40:38.581Z",
      "x_nadsec_last_seen": "2026-03-15T23:01:34.479Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--61141ba2-ce23-4802-852f-e026b312f911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.216.189.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-04T02:34:33.289Z",
      "x_nadsec_last_seen": "2026-03-29T23:42:40.454Z",
      "x_nadsec_ports": [
        "21",
        "3306",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--b4bf01d0-acc8-4a9e-84e3-ac7a709ad8f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T02:15:50.844Z",
      "x_nadsec_last_seen": "2026-03-04T02:17:03.386Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--a3a2c154-7168-4b76-b650-c630ba4f8cfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T02:16:11.078Z",
      "x_nadsec_last_seen": "2026-03-04T02:17:19.502Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--a660f61f-b8d4-4ce9-a1f8-16deb3114a36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T02:16:11.622Z",
      "x_nadsec_last_seen": "2026-03-04T02:17:26.798Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=24164; asn_org=UNION BROADBAND NETWORK",
      "id": "indicator--17582faf-9af7-4b65-984b-b1cd6e18ae65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.158.76.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T02:47:45.357Z",
      "x_nadsec_last_seen": "2026-03-17T02:11:10.544Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "24164"
      ],
      "x_nadsec_orgs": [
        "UNION BROADBAND NETWORK"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--d14e47c2-9203-4b88-99b9-210cfe5ae7a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T02:57:09.789Z",
      "x_nadsec_last_seen": "2026-03-26T07:57:28.961Z",
      "x_nadsec_ports": [
        "1883",
        "81",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mqttd",
        "httpd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--e338e350-3f7f-49d5-bd16-2cfec2ea8c8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '84.36.21.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T02:35:41.708Z",
      "x_nadsec_last_seen": "2026-03-04T02:37:48.237Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-03-04T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--142d4952-27e4-4641-b045-d19b8a1e5313",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:05:14.000Z",
      "valid_until": "2026-04-05T03:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T02:47:45.787Z",
      "x_nadsec_last_seen": "2026-03-04T02:47:45.787Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-04T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--e4952f61-f6b3-4052-a7c3-6b2596230f90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.144.223.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:05:12.000Z",
      "valid_until": "2026-04-05T04:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T03:20:51.026Z",
      "x_nadsec_last_seen": "2026-03-08T07:32:43.369Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-03-04T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--b0dd12b6-ee30-448e-a8b0-2814879121ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.77.145.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:05:12.000Z",
      "valid_until": "2026-04-05T04:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T03:36:40.089Z",
      "x_nadsec_last_seen": "2026-03-04T03:38:45.095Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-04T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0db0a101-b408-4699-a799-8305fb23e7dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.175.244.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:05:12.000Z",
      "valid_until": "2026-04-05T04:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T03:44:32.117Z",
      "x_nadsec_last_seen": "2026-03-18T00:22:42.867Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8b88b331-3b45-4e0e-91fd-41713ac6831d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.164.39.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:05:12.000Z",
      "valid_until": "2026-04-05T04:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T03:57:52.341Z",
      "x_nadsec_last_seen": "2026-03-04T03:59:58.190Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-04T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--4224ba3c-00a2-4022-9735-869694f3fbd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.25.57.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:05:12.000Z",
      "valid_until": "2026-04-05T04:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T04:00:34.737Z",
      "x_nadsec_last_seen": "2026-03-10T04:49:01.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-04T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MY; asn=133014; asn_org=Universiti Teknologi Malaysia",
      "id": "indicator--9a56e364-d232-4b73-affb-356916e00eca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.139.101.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:05:12.000Z",
      "valid_until": "2026-04-05T04:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T03:39:02.922Z",
      "x_nadsec_last_seen": "2026-03-04T08:11:07.061Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "133014"
      ],
      "x_nadsec_orgs": [
        "Universiti Teknologi Malaysia"
      ]
    },
    {
      "created": "2026-03-04T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--acba6f87-3a1f-4137-b859-9e05df4f6924",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.63.92.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:05:12.000Z",
      "valid_until": "2026-04-05T04:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T03:36:26.954Z",
      "x_nadsec_last_seen": "2026-03-04T03:38:33.186Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-03-04T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=BR; asn=53158; asn_org=Net Turbo Telecom",
      "id": "indicator--cb592ed9-640a-4f5a-b4ee-f5a8925bef9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.209.51.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:05:12.000Z",
      "valid_until": "2026-04-05T04:05:11.000Z",
      "x_nadsec_event_count": 3153,
      "x_nadsec_first_seen": "2026-03-04T03:49:44.580Z",
      "x_nadsec_last_seen": "2026-03-05T20:23:08.947Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53158"
      ],
      "x_nadsec_orgs": [
        "Net Turbo Telecom"
      ]
    },
    {
      "created": "2026-03-04T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17911; asn_org=Brain Telecommunication Ltd.",
      "id": "indicator--3b0741da-748a-439a-bcdd-38e1660e51de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.128.31.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:05:12.000Z",
      "valid_until": "2026-04-05T04:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T03:40:21.473Z",
      "x_nadsec_last_seen": "2026-03-04T03:42:28.311Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17911"
      ],
      "x_nadsec_orgs": [
        "Brain Telecommunication Ltd."
      ]
    },
    {
      "created": "2026-03-04T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--d6d09943-961e-4c6a-86d6-6e9698d988d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:05:12.000Z",
      "valid_until": "2026-04-05T04:05:11.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-04T03:11:11.012Z",
      "x_nadsec_last_seen": "2026-03-30T12:54:43.267Z",
      "x_nadsec_ports": [
        "81",
        "3306",
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld",
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-04T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0c10f81c-470b-43a1-853e-6ab780b2e20c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.255.206.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:05:12.000Z",
      "valid_until": "2026-04-05T04:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T03:22:11.346Z",
      "x_nadsec_last_seen": "2026-03-04T03:24:16.123Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--06f165f0-69c4-48b9-a07e-ddfc32d112c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.73.185.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:05:12.000Z",
      "valid_until": "2026-04-05T04:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T03:51:07.205Z",
      "x_nadsec_last_seen": "2026-03-04T03:53:13.486Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-04T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--dacf72af-39d5-4d1b-ba90-2adadd490217",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.111.188.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:05:12.000Z",
      "valid_until": "2026-04-05T04:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T03:10:12.407Z",
      "x_nadsec_last_seen": "2026-03-22T16:51:56.227Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-04T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MQ; asn=3215; asn_org=Orange",
      "id": "indicator--65eea94f-ef4e-4413-a009-ef0606d8721e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.248.4.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T04:05:12.000Z",
      "valid_until": "2026-04-05T04:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T03:38:36.193Z",
      "x_nadsec_last_seen": "2026-03-17T23:36:14.824Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MQ"
      ],
      "x_nadsec_asns": [
        "3215"
      ],
      "x_nadsec_orgs": [
        "Orange"
      ]
    },
    {
      "created": "2026-03-04T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134863; asn_org=SP INTERNET TECHNOLOGIES PRIVATE LTD",
      "id": "indicator--6e87ce75-b466-429e-8b07-12f04391d996",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.207.4.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:05:12.000Z",
      "valid_until": "2026-04-05T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T04:23:35.068Z",
      "x_nadsec_last_seen": "2026-03-04T04:25:41.196Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134863"
      ],
      "x_nadsec_orgs": [
        "SP INTERNET TECHNOLOGIES PRIVATE LTD"
      ]
    },
    {
      "created": "2026-03-04T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--79252f26-81ac-4796-8be9-0cc86ed19d53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.168.163.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:05:12.000Z",
      "valid_until": "2026-04-05T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T04:46:13.212Z",
      "x_nadsec_last_seen": "2026-03-04T04:48:18.058Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--553cc2da-e52a-4c8f-b855-a222b2ed0eb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.16.70.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:05:12.000Z",
      "valid_until": "2026-04-05T05:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T04:09:06.965Z",
      "x_nadsec_last_seen": "2026-03-04T04:16:23.520Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--67c9a5f8-b347-4d52-8f6d-b43e59f1fd82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.187.225.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:05:12.000Z",
      "valid_until": "2026-04-05T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T05:01:17.209Z",
      "x_nadsec_last_seen": "2026-03-04T05:03:21.961Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--bd579c42-2e22-4d01-9baf-46ff83f8530a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:05:12.000Z",
      "valid_until": "2026-04-05T05:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T04:19:17.989Z",
      "x_nadsec_last_seen": "2026-03-27T22:18:59.217Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=150008; asn_org=Pioneer Elabs Ltd.",
      "id": "indicator--9621ff4d-2b89-4e5f-9a79-7d9b2fc8a287",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.210.225.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:05:12.000Z",
      "valid_until": "2026-04-05T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T04:32:25.163Z",
      "x_nadsec_last_seen": "2026-03-04T04:36:59.861Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "150008"
      ],
      "x_nadsec_orgs": [
        "Pioneer Elabs Ltd."
      ]
    },
    {
      "created": "2026-03-04T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--83e8a9f6-80d3-4e4b-84af-e03bf5ffe3a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.187.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:05:12.000Z",
      "valid_until": "2026-04-05T05:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T04:31:57.989Z",
      "x_nadsec_last_seen": "2026-03-04T04:31:57.989Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-04T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--aa5a0c8f-e8db-4089-a003-1bb514452c0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.192.80.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:05:12.000Z",
      "valid_until": "2026-04-05T05:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T04:27:58.676Z",
      "x_nadsec_last_seen": "2026-03-04T04:34:32.946Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-04T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--c676dfb8-c399-497d-8330-a215b9664d37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.44.204.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:05:12.000Z",
      "valid_until": "2026-04-05T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T04:54:12.747Z",
      "x_nadsec_last_seen": "2026-03-04T04:56:19.450Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-04T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=27947; asn_org=Telconet S.A",
      "id": "indicator--36f2e2da-37c0-4ae5-a06d-68e2d1254e96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.3.240.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:05:12.000Z",
      "valid_until": "2026-04-05T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T04:11:50.254Z",
      "x_nadsec_last_seen": "2026-03-04T04:13:56.765Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "27947"
      ],
      "x_nadsec_orgs": [
        "Telconet S.A"
      ]
    },
    {
      "created": "2026-03-04T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--37e67c93-4350-4962-adf9-e96957a0c68f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.91.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:05:12.000Z",
      "valid_until": "2026-04-05T05:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T05:01:13.844Z",
      "x_nadsec_last_seen": "2026-03-04T05:01:13.844Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-04T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BG; asn=8866; asn_org=Vivacom Bulgaria EAD",
      "id": "indicator--d1d5f81e-9e17-4208-8b8a-9c307819e48e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.130.93.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:05:12.000Z",
      "valid_until": "2026-04-05T05:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T04:47:22.557Z",
      "x_nadsec_last_seen": "2026-03-04T05:07:47.693Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "8866"
      ],
      "x_nadsec_orgs": [
        "Vivacom Bulgaria EAD"
      ]
    },
    {
      "created": "2026-03-04T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--3a563456-4155-430f-82b3-15c3866e1aad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.239.85.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:05:12.000Z",
      "valid_until": "2026-04-05T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T04:53:09.972Z",
      "x_nadsec_last_seen": "2026-03-04T04:55:16.166Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-04T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mysqld; ports=3306; cc=NL; asn=49870; asn_org=Alsycon B.V.; user(top)=c**n",
      "id": "indicator--bf6cb5d9-87e8-4541-8f03-64f490a9294a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.81.23.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:05:12.000Z",
      "valid_until": "2026-04-05T05:05:11.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-04T04:16:58.590Z",
      "x_nadsec_last_seen": "2026-03-04T04:38:17.709Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t",
        "c**n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--21214d56-f488-479d-bd4f-5104d5fc8289",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.12.218.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T05:05:12.000Z",
      "valid_until": "2026-04-05T05:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T05:03:08.897Z",
      "x_nadsec_last_seen": "2026-03-04T05:03:08.897Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=37100; asn_org=SEACOM-AS",
      "id": "indicator--ca18463d-d5b9-4d2f-82b2-bede3b0429eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.27.152.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T05:25:34.077Z",
      "x_nadsec_last_seen": "2026-03-04T05:27:42.907Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37100"
      ],
      "x_nadsec_orgs": [
        "SEACOM-AS"
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--45050564-9fa7-41c0-8045-ed960b9056f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.160.250.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-04T05:10:47.347Z",
      "x_nadsec_last_seen": "2026-03-09T13:24:47.560Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--632b18c7-a1b7-42ce-9144-b3d3c8d8b79a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T05:18:46.088Z",
      "x_nadsec_last_seen": "2026-03-21T21:38:18.911Z",
      "x_nadsec_ports": [
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NG; asn=327898; asn_org=CBC-EMEA",
      "id": "indicator--fbc6f133-1d4e-46f1-8989-4b247d558641",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '169.255.236.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T05:27:53.851Z",
      "x_nadsec_last_seen": "2026-03-04T05:27:54.129Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "327898"
      ],
      "x_nadsec_orgs": [
        "CBC-EMEA"
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17754; asn_org=Excellmedia",
      "id": "indicator--db10d25c-509f-4b14-85cb-bc415c0b6217",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '175.101.11.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T05:08:56.963Z",
      "x_nadsec_last_seen": "2026-03-04T05:11:02.974Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17754"
      ],
      "x_nadsec_orgs": [
        "Excellmedia"
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--06146909-4fbc-446d-8527-ff74c7c59977",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.85.166.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T05:18:02.593Z",
      "x_nadsec_last_seen": "2026-03-04T05:20:10.001Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CO; asn=262191; asn_org=LIBERTY NETWORKS DE COLOMBIA S.A.S",
      "id": "indicator--820a9062-554a-43c7-921c-d289fe84c356",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.109.26.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T05:06:12.468Z",
      "x_nadsec_last_seen": "2026-03-04T05:10:27.832Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "262191"
      ],
      "x_nadsec_orgs": [
        "LIBERTY NETWORKS DE COLOMBIA S.A.S"
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a9b79176-8859-42de-aea3-b3afe98f9245",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T05:32:34.513Z",
      "x_nadsec_last_seen": "2026-03-04T05:32:34.513Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--a46faf9c-1f1a-44bf-a609-5974d35b454c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.228.154.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-04T05:14:12.348Z",
      "x_nadsec_last_seen": "2026-03-26T23:39:04.059Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d898b5a4-e90a-4019-9e54-46781252e9ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.168.0.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T05:55:07.421Z",
      "x_nadsec_last_seen": "2026-03-04T05:55:07.421Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--55ef1665-28dd-422c-aa98-7cddf52f31f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T05:16:36.009Z",
      "x_nadsec_last_seen": "2026-03-04T05:16:36.359Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--30d1c40c-a3be-42ce-808b-f7fd506db4bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T05:05:52.717Z",
      "x_nadsec_last_seen": "2026-03-04T05:05:52.717Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=JO; asn=9038; asn_org=Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co",
      "id": "indicator--3ffa42cb-536b-4968-92fc-250839c07eb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.118.18.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T05:06:34.449Z",
      "x_nadsec_last_seen": "2026-03-04T05:07:25.680Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "9038"
      ],
      "x_nadsec_orgs": [
        "Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co"
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=47; services=smbd; ports=445; cc=GE; asn=16010; asn_org=Magticom Ltd.",
      "id": "indicator--ce76b180-cdf3-489f-b4cf-4c7f199f57b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.58.103.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 47,
      "x_nadsec_first_seen": "2026-03-04T05:55:17.259Z",
      "x_nadsec_last_seen": "2026-03-04T06:01:39.788Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "16010"
      ],
      "x_nadsec_orgs": [
        "Magticom Ltd."
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--53f6c7d4-9cd4-4111-b468-70ee0dc20dd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.79.173.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T06:00:19.355Z",
      "x_nadsec_last_seen": "2026-03-05T02:04:30.910Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--fac62ffe-5ce5-48ce-90c1-888cd87a9845",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.233.94.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T06:00:18.709Z",
      "x_nadsec_last_seen": "2026-03-04T06:00:18.709Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=55836; asn_org=Reliance Jio Infocomm Limited; user(top)=**",
      "id": "indicator--37f5edae-2fbf-4c87-baae-5bb06012c5ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.37.109.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T05:29:31.805Z",
      "x_nadsec_last_seen": "2026-03-04T05:29:31.805Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55836"
      ],
      "x_nadsec_orgs": [
        "Reliance Jio Infocomm Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--e6ee1dbf-dfde-4437-86d4-8bcf22b4b68a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '86.98.220.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T05:41:36.310Z",
      "x_nadsec_last_seen": "2026-03-04T07:23:10.744Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-03-04T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=49531; asn_org=NetCom-R LLC",
      "id": "indicator--1c983802-58ad-415b-a6ca-2d2e7548fd3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.159.47.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:05:12.000Z",
      "valid_until": "2026-04-05T06:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T05:29:16.260Z",
      "x_nadsec_last_seen": "2026-03-30T19:26:19.897Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "49531"
      ],
      "x_nadsec_orgs": [
        "NetCom-R LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--8beb7599-ba7e-465b-925e-e18d694c8e1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.250.229.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:05:13.000Z",
      "valid_until": "2026-04-05T07:05:12.000Z",
      "x_nadsec_event_count": 22,
      "x_nadsec_first_seen": "2026-03-04T06:19:41.196Z",
      "x_nadsec_last_seen": "2026-03-14T14:13:06.325Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-04T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--c5c4f6c8-c988-487f-982f-b16b90cfcb5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.185.101.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:05:13.000Z",
      "valid_until": "2026-04-05T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T07:03:36.051Z",
      "x_nadsec_last_seen": "2026-03-04T07:05:42.327Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-04T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=epmapper; ports=135; cc=PH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--0ae7faeb-8737-46b6-aa5f-ee4544e33652",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.100.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:05:13.000Z",
      "valid_until": "2026-04-05T07:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-04T06:08:24.040Z",
      "x_nadsec_last_seen": "2026-03-04T06:24:18.789Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-04T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0b2b50f9-f48d-4ad0-a834-8e43f2e490b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.38.35.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:05:13.000Z",
      "valid_until": "2026-04-05T07:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T06:28:44.837Z",
      "x_nadsec_last_seen": "2026-03-04T06:28:54.990Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-04T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=10834; asn_org=Telefonica de Argentina",
      "id": "indicator--8e204c17-e91a-4f35-8ba2-8dcb731c59a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.41.185.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:05:13.000Z",
      "valid_until": "2026-04-05T07:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T06:36:01.070Z",
      "x_nadsec_last_seen": "2026-03-04T06:43:12.343Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "10834"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-04T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--9ea370a7-88b2-44f7-b4c7-c2e26a434450",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.138.201.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:05:13.000Z",
      "valid_until": "2026-04-05T07:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T06:19:33.968Z",
      "x_nadsec_last_seen": "2026-03-04T06:19:36.967Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-04T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--8ef1ac3a-34ba-48eb-acbc-44fa293a2de1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.251.10.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:05:13.000Z",
      "valid_until": "2026-04-05T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T06:25:32.910Z",
      "x_nadsec_last_seen": "2026-03-04T06:27:40.286Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-04T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MY; asn=4788; asn_org=TM TECHNOLOGY SERVICES SDN. BHD.",
      "id": "indicator--77362598-031c-4b92-878a-042151cfbd48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '219.93.41.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:05:13.000Z",
      "valid_until": "2026-04-05T07:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T06:38:18.291Z",
      "x_nadsec_last_seen": "2026-03-04T06:43:00.463Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "4788"
      ],
      "x_nadsec_orgs": [
        "TM TECHNOLOGY SERVICES SDN. BHD."
      ]
    },
    {
      "created": "2026-03-04T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--aa777e3e-2d3c-4812-a8d0-4a222ba6b456",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.150.63.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:05:13.000Z",
      "valid_until": "2026-04-05T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T06:18:12.712Z",
      "x_nadsec_last_seen": "2026-03-04T06:20:19.227Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-04T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d02f7028-e9b4-491d-9aa8-ed2987a326f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:05:13.000Z",
      "valid_until": "2026-04-05T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T06:07:39.357Z",
      "x_nadsec_last_seen": "2026-03-10T03:27:59.974Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-04T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=KH; asn=131207; asn_org=SINET, Cambodias specialist Internet and Telecom Service Provider.",
      "id": "indicator--e062c7cb-e32e-4604-8f3e-f1f5a73cb2bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.245.202.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:05:13.000Z",
      "valid_until": "2026-04-05T07:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T06:38:19.590Z",
      "x_nadsec_last_seen": "2026-03-04T06:59:27.172Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KH"
      ],
      "x_nadsec_asns": [
        "131207"
      ],
      "x_nadsec_orgs": [
        "SINET, Cambodias specialist Internet and Telecom Service Provider."
      ]
    },
    {
      "created": "2026-03-04T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--6592ab0d-aeed-4d7c-9242-36d68c936f87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.69.224.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:05:13.000Z",
      "valid_until": "2026-04-05T07:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T06:10:33.888Z",
      "x_nadsec_last_seen": "2026-03-04T06:10:33.888Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-04T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--ade54173-077c-4741-8f4c-3ee512b20fff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.152.106.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:05:13.000Z",
      "valid_until": "2026-04-05T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T06:32:50.893Z",
      "x_nadsec_last_seen": "2026-03-04T06:35:00.171Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-04T08:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--199e1d95-c02e-48ea-b3be-b4525a964eec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.2.227.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:05:07.000Z",
      "valid_until": "2026-04-05T08:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T07:51:39.308Z",
      "x_nadsec_last_seen": "2026-03-04T07:53:43.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-04T08:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=133982; asn_org=Excitel Broadband Private Limited",
      "id": "indicator--131e7782-8ef3-47d2-b00a-f3b8bc8e018d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.214.61.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:05:07.000Z",
      "valid_until": "2026-04-05T08:05:06.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T07:16:51.976Z",
      "x_nadsec_last_seen": "2026-03-04T07:23:28.227Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133982"
      ],
      "x_nadsec_orgs": [
        "Excitel Broadband Private Limited"
      ]
    },
    {
      "created": "2026-03-04T08:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--78f9aaa7-4e98-4086-a159-f171659e7135",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.53.234.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:05:07.000Z",
      "valid_until": "2026-04-05T08:05:06.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-04T07:05:43.524Z",
      "x_nadsec_last_seen": "2026-03-04T07:10:14.147Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "*"
      ]
    },
    {
      "created": "2026-03-04T08:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--c55bc643-818b-4fa7-a9c7-92b56c88c212",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.252.134.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:05:07.000Z",
      "valid_until": "2026-04-05T08:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T07:20:22.664Z",
      "x_nadsec_last_seen": "2026-03-04T07:22:28.124Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-04T08:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--270ba5bb-25a9-4ceb-974e-22764faf8b30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.181.161.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:05:07.000Z",
      "valid_until": "2026-04-05T08:05:06.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T07:07:07.122Z",
      "x_nadsec_last_seen": "2026-03-04T07:13:52.816Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T08:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--970f53c2-7b3e-4637-8a73-48ed05d4cabb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.122.68.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:05:07.000Z",
      "valid_until": "2026-04-05T08:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T07:31:37.971Z",
      "x_nadsec_last_seen": "2026-03-04T07:31:40.942Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-04T08:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--43030a83-ab1c-4499-805e-f61a45c0c4d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.249.163.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:05:07.000Z",
      "valid_until": "2026-04-05T08:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T07:32:54.317Z",
      "x_nadsec_last_seen": "2026-03-04T07:34:59.586Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-04T08:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--fd891d94-55bf-45d5-b2d4-ebd0fdf30973",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.245.222.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:05:07.000Z",
      "valid_until": "2026-04-05T08:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T07:15:33.862Z",
      "x_nadsec_last_seen": "2026-03-04T07:17:40.107Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-04T08:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--71472ab1-19da-41c6-a10f-f331f3b8c6cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.74.51.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:05:07.000Z",
      "valid_until": "2026-04-05T08:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T07:30:35.870Z",
      "x_nadsec_last_seen": "2026-03-04T07:32:42.080Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-04T08:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--c09f6f5b-d6f2-4324-b7e8-0fe99055bb99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:05:07.000Z",
      "valid_until": "2026-04-05T08:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T07:30:23.089Z",
      "x_nadsec_last_seen": "2026-03-04T07:30:23.089Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-04T08:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23974; asn_org=Ministry of education",
      "id": "indicator--d1b69e28-e0fd-443e-9643-d536cb5cc75f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.172.228.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:05:07.000Z",
      "valid_until": "2026-04-05T08:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T07:06:13.037Z",
      "x_nadsec_last_seen": "2026-03-04T07:08:17.891Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23974"
      ],
      "x_nadsec_orgs": [
        "Ministry of education"
      ]
    },
    {
      "created": "2026-03-04T08:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--766028ae-a34f-4543-9fbf-ed6517a18987",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:05:07.000Z",
      "valid_until": "2026-04-05T08:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T07:27:24.775Z",
      "x_nadsec_last_seen": "2026-03-18T04:41:18.041Z",
      "x_nadsec_ports": [
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-04T08:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=NL; asn=205759; asn_org=Ghosty Networks LLC",
      "id": "indicator--0793acd2-c4e4-4047-a9e3-358238a4766a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:05:07.000Z",
      "valid_until": "2026-04-05T08:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T07:35:39.657Z",
      "x_nadsec_last_seen": "2026-03-04T07:36:13.883Z",
      "x_nadsec_ports": [
        "135",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "205759"
      ],
      "x_nadsec_orgs": [
        "Ghosty Networks LLC"
      ]
    },
    {
      "created": "2026-03-04T08:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--d80ea41d-7391-4f22-acdf-3eba7a0cd3fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T08:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T08:05:07.000Z",
      "valid_until": "2026-04-05T08:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T07:07:29.668Z",
      "x_nadsec_last_seen": "2026-03-05T17:02:20.990Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--fe8fb1aa-d686-414a-9cd4-3b087800d764",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.0.145.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T08:56:49.422Z",
      "x_nadsec_last_seen": "2026-03-04T08:56:49.578Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--eb70823d-a094-4ff0-8b0b-6804811efbf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.89.83.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T08:23:31.972Z",
      "x_nadsec_last_seen": "2026-03-04T08:25:39.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--88bf42ca-f625-4011-8864-ae36de70fdfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.134.191.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T08:40:44.418Z",
      "x_nadsec_last_seen": "2026-03-04T08:42:50.747Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--0ffee85a-ee26-477a-aa79-e9e64ce920c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.70.81.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T08:22:39.732Z",
      "x_nadsec_last_seen": "2026-03-04T08:29:29.955Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2f15c0b2-1ca7-43d5-bc4f-0a996c78310e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.16.237.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T08:58:02.671Z",
      "x_nadsec_last_seen": "2026-03-04T09:00:07.809Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=138505; asn_org=DNS",
      "id": "indicator--deec83ab-fc6c-4b2f-af7d-7aaa6a179bee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '163.223.21.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T08:09:39.379Z",
      "x_nadsec_last_seen": "2026-03-04T08:11:43.989Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "138505"
      ],
      "x_nadsec_orgs": [
        "DNS"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=134887; asn_org=Aristo Telenet Private Limited",
      "id": "indicator--a4246ecf-bdc0-4109-bc55-02e0b46459e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '163.61.252.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T08:45:19.437Z",
      "x_nadsec_last_seen": "2026-03-19T09:37:04.498Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134887"
      ],
      "x_nadsec_orgs": [
        "Aristo Telenet Private Limited"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--29345f21-d527-4aca-bcbc-ff797a4f7ae7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.149.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T08:20:53.679Z",
      "x_nadsec_last_seen": "2026-03-04T08:20:53.679Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SY; asn=29256; asn_org=Syrian Telecommunication Private Closed Joint Stock Company",
      "id": "indicator--da7bdcd2-f5ed-46a3-8bca-1a1691c13082",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.253.95.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-04T08:13:36.363Z",
      "x_nadsec_last_seen": "2026-03-17T06:40:23.289Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SY"
      ],
      "x_nadsec_asns": [
        "29256"
      ],
      "x_nadsec_orgs": [
        "Syrian Telecommunication Private Closed Joint Stock Company"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--d439117a-be11-445f-ae74-f0787df13bc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.168.70.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T09:03:28.463Z",
      "x_nadsec_last_seen": "2026-03-04T09:05:34.313Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=21299; asn_org=Kar-Tel LLC",
      "id": "indicator--dcc2c3b3-49f7-4404-91a5-8ebd2b0869c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.247.213.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T08:10:06.585Z",
      "x_nadsec_last_seen": "2026-03-04T08:10:09.868Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "21299"
      ],
      "x_nadsec_orgs": [
        "Kar-Tel LLC"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--29620663-efab-4f66-8170-45c6002b21ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T08:57:10.383Z",
      "x_nadsec_last_seen": "2026-03-04T08:57:10.383Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2c95d3a5-7224-4dc5-b4cb-99b9c7f79caa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T08:44:13.236Z",
      "x_nadsec_last_seen": "2026-03-04T08:44:13.236Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--96afcd90-2090-4ff0-9a3b-207a55075e50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T08:44:14.046Z",
      "x_nadsec_last_seen": "2026-03-04T08:44:14.046Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--168cf1eb-f736-4a0e-b1c7-a8650383f172",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T08:57:10.784Z",
      "x_nadsec_last_seen": "2026-03-04T08:57:10.784Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6408d2fe-59a7-43cf-80dc-241398150576",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.216.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T08:27:43.282Z",
      "x_nadsec_last_seen": "2026-03-04T08:27:53.442Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=6306; asn_org=TELEFONICA VENEZOLANA, C.A.",
      "id": "indicator--b4889467-5f9d-4eb8-9cbd-4083bce3b516",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.35.109.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 25,
      "x_nadsec_first_seen": "2026-03-04T08:31:28.475Z",
      "x_nadsec_last_seen": "2026-03-29T14:33:51.800Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "6306"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA VENEZOLANA, C.A."
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--b18579c3-eb08-42db-bae2-55d5bdec871a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.132.118.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T08:35:26.413Z",
      "x_nadsec_last_seen": "2026-03-25T05:16:57.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--d6a8a2da-344f-4a4c-bc57-783c99bbca73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.106.128.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T08:49:46.652Z",
      "x_nadsec_last_seen": "2026-03-04T08:51:53.504Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TZ; asn=33765; asn_org=TTCLDATA",
      "id": "indicator--84ae8ca8-ff8c-4561-9593-20dd230dac1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.59.97.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T08:19:03.332Z",
      "x_nadsec_last_seen": "2026-03-04T08:19:09.888Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TZ"
      ],
      "x_nadsec_asns": [
        "33765"
      ],
      "x_nadsec_orgs": [
        "TTCLDATA"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PE; asn=263189; asn_org=GLG PERU SAC",
      "id": "indicator--e0b812a2-03cc-42b6-85d5-21f2238ad41a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.177.196.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T08:50:12.470Z",
      "x_nadsec_last_seen": "2026-03-04T08:57:16.457Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "263189"
      ],
      "x_nadsec_orgs": [
        "GLG PERU SAC"
      ]
    },
    {
      "created": "2026-03-04T09:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e7a66f59-7564-4b15-b818-2f78c61a5747",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T09:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.223.108.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:05:12.000Z",
      "valid_until": "2026-04-05T09:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T08:26:35.089Z",
      "x_nadsec_last_seen": "2026-03-04T08:27:57.644Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=IN; asn=146852; asn_org=SBSYSTEMS",
      "id": "indicator--efaa75a6-9aad-4354-90ed-64f50f5774e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.171.73.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-03-04T09:56:31.881Z",
      "x_nadsec_last_seen": "2026-03-04T09:59:04.859Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "146852"
      ],
      "x_nadsec_orgs": [
        "SBSYSTEMS"
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=45773; asn_org=PERN AS Content Servie Provider, Islamabad, Pakistan",
      "id": "indicator--38e1a339-0488-4053-9421-850483ff1e1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.68.110.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T09:15:18.483Z",
      "x_nadsec_last_seen": "2026-03-04T09:15:18.483Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "45773"
      ],
      "x_nadsec_orgs": [
        "PERN AS Content Servie Provider, Islamabad, Pakistan"
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=9260; asn_org=Multinet Pakistan Pvt. Ltd.",
      "id": "indicator--227a9145-2471-42bf-a6d0-be0ae5a7c82b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.209.87.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T09:54:46.463Z",
      "x_nadsec_last_seen": "2026-03-04T09:54:46.463Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9260"
      ],
      "x_nadsec_orgs": [
        "Multinet Pakistan Pvt. Ltd."
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--12f366f5-3a5f-40af-8c66-3fcadbcc9e6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.185.192.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-04T09:55:42.864Z",
      "x_nadsec_last_seen": "2026-03-17T06:26:21.006Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f6968214-4086-42a0-b1d2-6d27957c3d07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '136.111.123.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T10:02:01.129Z",
      "x_nadsec_last_seen": "2026-03-04T10:02:01.380Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1a053b2c-81cd-4010-b9f9-c9dad1967385",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.177.89.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T09:51:13.523Z",
      "x_nadsec_last_seen": "2026-03-12T17:11:16.866Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--00753a6c-26b3-403e-a9bd-3ee94ae53c53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.226.150.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T09:07:00.375Z",
      "x_nadsec_last_seen": "2026-03-04T09:09:04.935Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--da587325-269f-4116-8f7b-75281b560267",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T09:52:44.195Z",
      "x_nadsec_last_seen": "2026-03-11T06:35:04.340Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--09a86d2f-f399-4db7-b14c-4883e5f577a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.176.109.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T09:58:05.616Z",
      "x_nadsec_last_seen": "2026-03-04T09:58:49.084Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KZ; asn=35104; asn_org=Jusan Mobile JSC",
      "id": "indicator--4e21a029-7603-403a-9bf2-a4b79d65eaf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.48.149.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T09:08:18.913Z",
      "x_nadsec_last_seen": "2026-03-04T09:14:15.990Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "35104"
      ],
      "x_nadsec_orgs": [
        "Jusan Mobile JSC"
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=263008; asn_org=RIO CABLE CORPORATE LTDA - ME",
      "id": "indicator--4b49196e-7b4e-4c74-bc4e-52448b804f8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.226.214.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T09:32:42.075Z",
      "x_nadsec_last_seen": "2026-03-28T12:46:45.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263008"
      ],
      "x_nadsec_orgs": [
        "RIO CABLE CORPORATE LTDA - ME"
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--1691ba26-a255-4d87-9b32-f25363186abd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.53.157.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-04T09:56:34.681Z",
      "x_nadsec_last_seen": "2026-03-29T09:57:19.641Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=17670; asn_org=PT. MNC Kabel Mediacom",
      "id": "indicator--9ff87776-4108-420a-a821-4ec539b52289",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.147.206.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T09:21:53.412Z",
      "x_nadsec_last_seen": "2026-03-04T09:22:28.104Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17670"
      ],
      "x_nadsec_orgs": [
        "PT. MNC Kabel Mediacom"
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a956a6f7-ea2a-417e-b59d-d038c02e05fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T09:07:43.111Z",
      "x_nadsec_last_seen": "2026-03-28T06:14:43.497Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--9a5dbb15-92fc-43de-b5e4-4662abda4939",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.91.94.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T09:33:43.693Z",
      "x_nadsec_last_seen": "2026-03-04T09:38:36.748Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=210135; asn_org=Yug-Telecom-K Ltd.",
      "id": "indicator--a7b13c8e-2af9-41ae-ab62-6b18e5608fab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.180.19.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-04T09:57:23.538Z",
      "x_nadsec_last_seen": "2026-03-26T12:47:07.011Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "210135"
      ],
      "x_nadsec_orgs": [
        "Yug-Telecom-K Ltd."
      ]
    },
    {
      "created": "2026-03-04T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--4549dd28-f3c4-425b-b4f7-21e308309440",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.59.28.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:05:06.000Z",
      "valid_until": "2026-04-05T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T09:19:49.940Z",
      "x_nadsec_last_seen": "2026-03-04T09:21:56.551Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-04T11:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6b159607-f629-4c32-aa4e-1ba968a950ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T11:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.52.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:05:06.000Z",
      "valid_until": "2026-04-05T11:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T10:08:26.225Z",
      "x_nadsec_last_seen": "2026-03-04T10:11:40.582Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T11:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--5e31d29f-5355-4000-9f4d-87c6191c9d35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T11:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.185.110.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:05:06.000Z",
      "valid_until": "2026-04-05T11:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T10:22:20.588Z",
      "x_nadsec_last_seen": "2026-03-04T10:24:37.793Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-04T11:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--90bbff36-ea0c-4b16-a8df-73d4461231a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T11:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.163.113.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:05:06.000Z",
      "valid_until": "2026-04-05T11:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T10:43:46.430Z",
      "x_nadsec_last_seen": "2026-03-04T10:48:43.145Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-04T11:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--594bea72-c99f-4692-a249-4ba42bba6d32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T11:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.167.203.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:05:06.000Z",
      "valid_until": "2026-04-05T11:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T10:28:22.142Z",
      "x_nadsec_last_seen": "2026-03-04T10:28:22.473Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-04T11:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--85368a59-4d63-48d9-a1e3-b65b7cb76bd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T11:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.80.226.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:05:06.000Z",
      "valid_until": "2026-04-05T11:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T10:21:09.573Z",
      "x_nadsec_last_seen": "2026-03-04T10:21:16.072Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-04T11:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--e2d502bb-1fb9-4410-ae9b-62c62781c986",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T11:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.88.252.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:05:06.000Z",
      "valid_until": "2026-04-05T11:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T10:56:44.804Z",
      "x_nadsec_last_seen": "2026-03-04T10:59:55.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-04T11:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7d9aeb4d-2377-4b95-a996-d02d2dd83c38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T11:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.106.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:05:06.000Z",
      "valid_until": "2026-04-05T11:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T10:11:21.287Z",
      "x_nadsec_last_seen": "2026-03-04T10:11:21.287Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-04T11:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--f640bf6c-b12c-46bd-a500-4d1cbf62d9b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T11:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.21.227.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:05:06.000Z",
      "valid_until": "2026-04-05T11:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T10:12:24.870Z",
      "x_nadsec_last_seen": "2026-03-04T10:12:24.870Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-04T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e4632b74-77f2-4db9-beca-10a91441603f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.224.182.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:05:14.000Z",
      "valid_until": "2026-04-05T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T11:48:37.008Z",
      "x_nadsec_last_seen": "2026-03-04T11:50:41.703Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f79441e6-873d-4448-b141-6162a152b56c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.223.102.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:05:14.000Z",
      "valid_until": "2026-04-05T12:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T12:00:42.375Z",
      "x_nadsec_last_seen": "2026-03-04T12:00:42.375Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-04T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=263432; asn_org=CORPORATIVA TELECOMUNICACOES EIRELI ME",
      "id": "indicator--ccd16eec-41f5-4de5-adca-2fc0b25ce8ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.91.76.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:05:14.000Z",
      "valid_until": "2026-04-05T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T11:43:24.807Z",
      "x_nadsec_last_seen": "2026-03-04T11:45:31.528Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263432"
      ],
      "x_nadsec_orgs": [
        "CORPORATIVA TELECOMUNICACOES EIRELI ME"
      ]
    },
    {
      "created": "2026-03-04T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--56968bf8-e3a2-4a9d-bf7a-476f4db45f21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.79.210.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:05:14.000Z",
      "valid_until": "2026-04-05T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T11:54:32.061Z",
      "x_nadsec_last_seen": "2026-03-04T11:56:38.416Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-04T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--77765037-2a3e-4e6f-ba25-9d0ec843b107",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.241.159.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:05:14.000Z",
      "valid_until": "2026-04-05T12:05:12.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-03-04T11:57:50.741Z",
      "x_nadsec_last_seen": "2026-03-04T12:00:39.358Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-04T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KG; asn=12997; asn_org=OJSC Kyrgyztelecom",
      "id": "indicator--13b4fda0-522a-46aa-875f-d38173d12119",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.145.157.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:05:14.000Z",
      "valid_until": "2026-04-05T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T11:16:51.503Z",
      "x_nadsec_last_seen": "2026-03-04T11:18:58.636Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "12997"
      ],
      "x_nadsec_orgs": [
        "OJSC Kyrgyztelecom"
      ]
    },
    {
      "created": "2026-03-04T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--581bc00a-1a5d-4421-86a8-23eb17898f1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.239.91.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:05:14.000Z",
      "valid_until": "2026-04-05T12:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-04T11:27:19.132Z",
      "x_nadsec_last_seen": "2026-03-04T11:27:29.983Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "i******u"
      ]
    },
    {
      "created": "2026-03-04T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:05:14.000Z",
      "valid_until": "2026-04-05T12:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T11:57:03.746Z",
      "x_nadsec_last_seen": "2026-03-27T08:52:54.710Z",
      "x_nadsec_ports": [
        "81",
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-04T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--a5cc8906-0702-4edc-89f8-0c84ed2ca7eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '84.235.83.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:05:14.000Z",
      "valid_until": "2026-04-05T12:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T11:15:14.303Z",
      "x_nadsec_last_seen": "2026-03-14T23:35:16.959Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-04T12:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--7bb558a1-b9a9-4f84-ba46-34daa3cb0cb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T12:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.255.224.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T12:05:14.000Z",
      "valid_until": "2026-04-05T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T11:22:15.631Z",
      "x_nadsec_last_seen": "2026-03-04T11:24:22.230Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-04T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--df33fe35-6941-4863-809f-2aa2072127bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.115.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:05:06.000Z",
      "valid_until": "2026-04-05T13:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T12:15:32.480Z",
      "x_nadsec_last_seen": "2026-03-04T12:23:23.621Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-04T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=133623; asn_org=Planet Cable Inc.",
      "id": "indicator--3844d00c-d879-4171-89af-92a10129c144",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.36.17.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:05:06.000Z",
      "valid_until": "2026-04-05T13:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T12:49:03.908Z",
      "x_nadsec_last_seen": "2026-03-04T12:51:08.337Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "133623"
      ],
      "x_nadsec_orgs": [
        "Planet Cable Inc."
      ]
    },
    {
      "created": "2026-03-04T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--e62da9a7-40d0-454d-a6b2-2c37805d27b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.43.17.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:05:06.000Z",
      "valid_until": "2026-04-05T13:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T12:53:06.897Z",
      "x_nadsec_last_seen": "2026-03-04T12:53:06.983Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-03-04T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=27651; asn_org=ENTEL CHILE S.A.",
      "id": "indicator--4a329022-3943-4b13-a2d8-56ca7829920a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.151.99.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:05:06.000Z",
      "valid_until": "2026-04-05T13:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T12:09:54.176Z",
      "x_nadsec_last_seen": "2026-03-04T12:12:00.948Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "27651"
      ],
      "x_nadsec_orgs": [
        "ENTEL CHILE S.A."
      ]
    },
    {
      "created": "2026-03-04T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--bbe08ae0-e6fd-47d2-992c-a0304d2aa188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.178.31.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:05:06.000Z",
      "valid_until": "2026-04-05T13:05:05.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-03-04T12:46:19.337Z",
      "x_nadsec_last_seen": "2026-03-04T12:50:00.745Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-04T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--3233008b-e615-49f9-a913-a851c8e045d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.188.243.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:05:06.000Z",
      "valid_until": "2026-04-05T13:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T12:19:35.310Z",
      "x_nadsec_last_seen": "2026-03-04T12:27:55.680Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-04T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--21423ac1-e0e6-4081-9d97-bab8d7953f67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.221.201.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:05:06.000Z",
      "valid_until": "2026-04-05T13:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T12:40:33.036Z",
      "x_nadsec_last_seen": "2026-03-04T12:40:33.408Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-03-04T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=53164; asn_org=UNIVERSIDADE FEDERAL DA BAHIA",
      "id": "indicator--377658de-75ab-4bfb-a4c8-b001f1344fb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.128.81.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:05:06.000Z",
      "valid_until": "2026-04-05T13:05:05.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T12:46:57.764Z",
      "x_nadsec_last_seen": "2026-03-28T10:14:04.867Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53164"
      ],
      "x_nadsec_orgs": [
        "UNIVERSIDADE FEDERAL DA BAHIA"
      ]
    },
    {
      "created": "2026-03-04T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--5d5657c6-d75b-4cd4-bb08-71aa6a5e33e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.103.37.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:05:06.000Z",
      "valid_until": "2026-04-05T13:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T12:53:15.026Z",
      "x_nadsec_last_seen": "2026-03-04T12:55:20.656Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-04T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=62642; asn_org=Bigleaf Networks, Inc.",
      "id": "indicator--25533590-6b86-41dd-8ea8-27daf890ddde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '204.80.194.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:05:06.000Z",
      "valid_until": "2026-04-05T13:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T12:22:27.440Z",
      "x_nadsec_last_seen": "2026-03-04T12:22:27.440Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "62642"
      ],
      "x_nadsec_orgs": [
        "Bigleaf Networks, Inc."
      ]
    },
    {
      "created": "2026-03-04T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC; user(top)=**",
      "id": "indicator--b960f8d4-d26b-4348-8f10-305395dfd531",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.132.219.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:05:06.000Z",
      "valid_until": "2026-04-05T13:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T12:32:50.944Z",
      "x_nadsec_last_seen": "2026-03-04T12:32:50.944Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--e48ad00b-087f-47fd-a0d5-6ba6856f4bfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.83.71.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:05:06.000Z",
      "valid_until": "2026-04-05T13:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T12:05:46.707Z",
      "x_nadsec_last_seen": "2026-03-04T12:07:52.851Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-04T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SA; asn=35819; asn_org=Etihad Etisalat, a joint stock company",
      "id": "indicator--96404cf8-4a3b-4772-9539-fcebc848c9b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.152.10.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:05:06.000Z",
      "valid_until": "2026-04-05T13:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T12:51:04.113Z",
      "x_nadsec_last_seen": "2026-03-04T12:51:04.180Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "35819"
      ],
      "x_nadsec_orgs": [
        "Etihad Etisalat, a joint stock company"
      ]
    },
    {
      "created": "2026-03-04T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--50878037-694c-4728-bdca-f49bc6a7d507",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.10.12.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:05:06.000Z",
      "valid_until": "2026-04-05T13:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T12:42:38.305Z",
      "x_nadsec_last_seen": "2026-03-04T12:42:40.207Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-04T13:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--ff490523-79b0-48c9-9b69-e5c1129e308a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T13:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.10.62.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:05:06.000Z",
      "valid_until": "2026-04-05T13:05:05.000Z",
      "x_nadsec_event_count": 3149,
      "x_nadsec_first_seen": "2026-03-04T12:30:12.841Z",
      "x_nadsec_last_seen": "2026-03-04T15:01:36.231Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-04T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=401696; asn_org=cognetcloud INC",
      "id": "indicator--de1cb447-5945-4ddd-94c6-6170bf0a4226",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.148.244.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:05:07.000Z",
      "valid_until": "2026-04-05T14:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T13:25:51.326Z",
      "x_nadsec_last_seen": "2026-03-04T13:27:57.009Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "401696"
      ],
      "x_nadsec_orgs": [
        "cognetcloud INC"
      ]
    },
    {
      "created": "2026-03-04T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=140464; asn_org=PT Widara Media Informasi",
      "id": "indicator--adf65fec-35f0-40e3-80c0-8d9a354f761f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.153.135.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:05:07.000Z",
      "valid_until": "2026-04-05T14:05:06.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T13:33:36.040Z",
      "x_nadsec_last_seen": "2026-03-04T13:39:54.539Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "140464"
      ],
      "x_nadsec_orgs": [
        "PT Widara Media Informasi"
      ]
    },
    {
      "created": "2026-03-04T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=135407; asn_org=Trans World Enterprise Services Private Limited",
      "id": "indicator--edd95a2b-2840-4ed9-a343-8d889f76643a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.93.230.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:05:07.000Z",
      "valid_until": "2026-04-05T14:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T13:24:42.719Z",
      "x_nadsec_last_seen": "2026-03-04T13:26:48.816Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "135407"
      ],
      "x_nadsec_orgs": [
        "Trans World Enterprise Services Private Limited"
      ]
    },
    {
      "created": "2026-03-04T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--d390289b-0993-4ff9-b36f-215aa3cba74a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.193.7.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:05:07.000Z",
      "valid_until": "2026-04-05T14:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T13:56:04.429Z",
      "x_nadsec_last_seen": "2026-03-04T13:58:11.300Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-04T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=epmapper; ports=135; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--506fda16-4386-444b-87a1-32533aee0f29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.203.30.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:05:07.000Z",
      "valid_until": "2026-04-05T14:05:06.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-04T13:54:20.301Z",
      "x_nadsec_last_seen": "2026-03-04T13:55:58.531Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "27017",
        "42697"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-04T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=ftpd; ports=21; cc=US; asn=5650; asn_org=Frontier Communications of America, Inc.",
      "id": "indicator--13c7dbe2-ddab-4eb0-8058-3f7d9651aa8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.99.61.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:05:07.000Z",
      "valid_until": "2026-04-05T14:05:06.000Z",
      "x_nadsec_event_count": 21,
      "x_nadsec_first_seen": "2026-03-04T13:27:12.188Z",
      "x_nadsec_last_seen": "2026-03-18T12:33:33.064Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "1433",
        "3306",
        "34781",
        "41141",
        "44163"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "5650"
      ],
      "x_nadsec_orgs": [
        "Frontier Communications of America, Inc."
      ]
    },
    {
      "created": "2026-03-04T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--37c8446e-4b37-492c-95de-5c21a8c16f72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '175.107.254.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:05:07.000Z",
      "valid_until": "2026-04-05T14:05:06.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T13:30:07.758Z",
      "x_nadsec_last_seen": "2026-03-05T07:49:23.388Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--17c286e1-c7d0-4dca-bed2-01db6b741f1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.16.198.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:05:07.000Z",
      "valid_until": "2026-04-05T14:05:06.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T13:26:09.405Z",
      "x_nadsec_last_seen": "2026-03-04T13:31:26.053Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-04T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--bb3d7c6b-3e19-4867-8071-521f675003cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.120.190.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:05:07.000Z",
      "valid_until": "2026-04-05T14:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T14:01:59.488Z",
      "x_nadsec_last_seen": "2026-03-04T14:02:06.080Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-03-04T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:05:07.000Z",
      "valid_until": "2026-04-05T14:05:06.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-04T13:45:29.284Z",
      "x_nadsec_last_seen": "2026-03-31T13:00:13.112Z",
      "x_nadsec_ports": [
        "445",
        "135",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-04T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--505c024b-5378-47c7-8893-7bb14b16faeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.133.6.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:05:07.000Z",
      "valid_until": "2026-04-05T14:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T13:39:39.735Z",
      "x_nadsec_last_seen": "2026-03-04T13:39:46.094Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-04T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--8d6218e5-814d-4bad-b6a5-f6b8d178475c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.52.219.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:05:07.000Z",
      "valid_until": "2026-04-05T14:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T13:27:55.283Z",
      "x_nadsec_last_seen": "2026-03-04T13:27:55.283Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--40bd01e0-afa7-42de-ad06-fdc26292a817",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.33.199.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:05:07.000Z",
      "valid_until": "2026-04-05T14:05:06.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-04T13:06:05.180Z",
      "x_nadsec_last_seen": "2026-03-09T07:35:09.933Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-04T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--99709ffd-100d-45e3-becb-170aef59b4eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:05:13.000Z",
      "valid_until": "2026-04-05T15:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T14:37:56.654Z",
      "x_nadsec_last_seen": "2026-03-07T12:38:22.416Z",
      "x_nadsec_ports": [
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-04T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--82dda49b-5aa1-4120-bf24-052458ac1169",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:05:13.000Z",
      "valid_until": "2026-04-05T15:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T14:44:09.929Z",
      "x_nadsec_last_seen": "2026-03-04T14:44:14.851Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-04T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=103; services=mysqld; ports=3306; cc=TW; asn=24163; asn_org=UNION BROADBAND NETWORK; user(top)=p********n",
      "id": "indicator--fdf6e9a6-d421-4573-ab6a-7ace63137a23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.218.252.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:05:13.000Z",
      "valid_until": "2026-04-05T15:05:12.000Z",
      "x_nadsec_event_count": 122,
      "x_nadsec_first_seen": "2026-03-04T14:53:13.007Z",
      "x_nadsec_last_seen": "2026-03-04T15:07:13.333Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "24163"
      ],
      "x_nadsec_orgs": [
        "UNION BROADBAND NETWORK"
      ],
      "x_nadsec_usernames_attempted": [
        "p********n",
        "p************v"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=52312; asn_org=TV MUSIC HOUSE JUJUY",
      "id": "indicator--19c79e24-29d7-4cc7-8ee5-e0bee4541319",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.177.192.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:05:13.000Z",
      "valid_until": "2026-04-05T15:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T14:07:01.197Z",
      "x_nadsec_last_seen": "2026-03-04T14:09:09.900Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "52312"
      ],
      "x_nadsec_orgs": [
        "TV MUSIC HOUSE JUJUY"
      ]
    },
    {
      "created": "2026-03-04T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=28509; asn_org=Cablemas Telecomunicaciones SA de CV",
      "id": "indicator--de7d7774-addf-4748-ac71-eac57fba962b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.221.229.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:05:13.000Z",
      "valid_until": "2026-04-05T15:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T14:49:40.843Z",
      "x_nadsec_last_seen": "2026-03-04T14:56:23.729Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "28509"
      ],
      "x_nadsec_orgs": [
        "Cablemas Telecomunicaciones SA de CV"
      ]
    },
    {
      "created": "2026-03-04T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=11014; asn_org=CPS",
      "id": "indicator--e3d0cb46-d34f-4a26-9d3b-08fcf22b4c8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.104.201.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:05:13.000Z",
      "valid_until": "2026-04-05T15:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T14:25:56.145Z",
      "x_nadsec_last_seen": "2026-03-04T14:26:02.943Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11014"
      ],
      "x_nadsec_orgs": [
        "CPS"
      ]
    },
    {
      "created": "2026-03-04T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MG; asn=37037; asn_org=Orange Madagascar",
      "id": "indicator--bb4ff5bf-f781-4e5c-9d78-0236b13b586b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.63.147.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:05:13.000Z",
      "valid_until": "2026-04-05T15:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T14:44:04.137Z",
      "x_nadsec_last_seen": "2026-03-04T14:44:04.137Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MG"
      ],
      "x_nadsec_asns": [
        "37037"
      ],
      "x_nadsec_orgs": [
        "Orange Madagascar"
      ]
    },
    {
      "created": "2026-03-04T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=BR; asn=268552; asn_org=NETSBRASIL LTDA",
      "id": "indicator--600be6a4-4c0c-4213-a532-8494abc4c099",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.163.106.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:05:13.000Z",
      "valid_until": "2026-04-05T15:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T14:45:09.427Z",
      "x_nadsec_last_seen": "2026-03-04T14:45:10.702Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "268552"
      ],
      "x_nadsec_orgs": [
        "NETSBRASIL LTDA"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--19c19658-3848-4f2b-a598-9ea1d355ea0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.16.3.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:05:13.000Z",
      "valid_until": "2026-04-05T15:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T14:41:45.666Z",
      "x_nadsec_last_seen": "2026-03-04T14:48:51.362Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-03-04T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--d12455f3-4034-45a7-8754-218e065bbe12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T15:05:13.000Z",
      "valid_until": "2026-04-05T15:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T14:06:34.429Z",
      "x_nadsec_last_seen": "2026-03-27T12:21:07.995Z",
      "x_nadsec_ports": [
        "81",
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "httpd",
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-04T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--8cac8842-3f04-41ba-9d44-7d1fa99539d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.145.141.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:05:13.000Z",
      "valid_until": "2026-04-05T16:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T15:24:33.255Z",
      "x_nadsec_last_seen": "2026-03-07T08:36:07.477Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-03-04T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fc99becc-59f9-426e-80c0-2de8311be3fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.237.126.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:05:13.000Z",
      "valid_until": "2026-04-05T16:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T15:28:44.723Z",
      "x_nadsec_last_seen": "2026-03-04T15:35:19.357Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--d6c74618-9aa2-42cf-b4b0-bd6629278bb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.237.221.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:05:13.000Z",
      "valid_until": "2026-04-05T16:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T15:32:08.550Z",
      "x_nadsec_last_seen": "2026-03-04T15:34:14.214Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-04T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f3d24905-4623-4a8e-bf50-f9b402db272b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.106.56.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:05:13.000Z",
      "valid_until": "2026-04-05T16:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T15:42:56.353Z",
      "x_nadsec_last_seen": "2026-03-04T15:42:57.056Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-04T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=268516; asn_org=Midia Net Telecom",
      "id": "indicator--7916ac8e-cf57-4d13-8afa-8e5da361bcc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.162.106.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:05:13.000Z",
      "valid_until": "2026-04-05T16:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T15:24:15.585Z",
      "x_nadsec_last_seen": "2026-03-04T15:24:19.595Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "268516"
      ],
      "x_nadsec_orgs": [
        "Midia Net Telecom"
      ]
    },
    {
      "created": "2026-03-04T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--eba188c9-2c5c-4880-83cc-56239497a9fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.181.177.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:05:13.000Z",
      "valid_until": "2026-04-05T16:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T15:22:05.987Z",
      "x_nadsec_last_seen": "2026-03-04T15:24:13.588Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-03-04T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=RU; asn=210259; asn_org=LLC Applied Computational Technologies",
      "id": "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:05:13.000Z",
      "valid_until": "2026-04-05T16:05:11.000Z",
      "x_nadsec_event_count": 23,
      "x_nadsec_first_seen": "2026-03-04T15:38:58.437Z",
      "x_nadsec_last_seen": "2026-03-27T03:02:44.606Z",
      "x_nadsec_ports": [
        "21",
        "1883",
        "445",
        "1433",
        "135",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd",
        "smbd",
        "mssqld",
        "epmapper",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "210259"
      ],
      "x_nadsec_orgs": [
        "LLC Applied Computational Technologies"
      ],
      "x_nadsec_usernames_attempted": [
        "***",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=36245; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--88dd206c-0548-43e5-979a-970f730a4c72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:05:13.000Z",
      "valid_until": "2026-04-05T16:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T15:32:13.533Z",
      "x_nadsec_last_seen": "2026-03-04T15:32:13.537Z",
      "x_nadsec_ports": [
        "42",
        "36245"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-04T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--4bc0c806-5d8b-406a-ab6e-68a45b8ce76f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:05:13.000Z",
      "valid_until": "2026-04-05T16:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T15:32:14.485Z",
      "x_nadsec_last_seen": "2026-03-04T15:32:14.489Z",
      "x_nadsec_ports": [
        "42",
        "35627"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-04T17:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--a02d1d24-1633-4a31-acbd-0244b8897f1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.174.133.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:05:16.000Z",
      "valid_until": "2026-04-05T17:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T16:07:07.309Z",
      "x_nadsec_last_seen": "2026-03-04T16:09:15.076Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-04T17:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1052; services=smbd; ports=445; cc=BY; asn=25106; asn_org=Mobile TeleSystems JLLC",
      "id": "indicator--5755ed62-f456-4229-b998-8c83e2ef0e5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.168.132.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:05:16.000Z",
      "valid_until": "2026-04-05T17:05:11.000Z",
      "x_nadsec_event_count": 3149,
      "x_nadsec_first_seen": "2026-03-04T16:45:18.630Z",
      "x_nadsec_last_seen": "2026-03-04T17:41:31.912Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "25106"
      ],
      "x_nadsec_orgs": [
        "Mobile TeleSystems JLLC"
      ]
    },
    {
      "created": "2026-03-04T17:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--88272d00-ffbe-40cb-ba36-9db511b27461",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:05:16.000Z",
      "valid_until": "2026-04-05T17:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T16:15:42.466Z",
      "x_nadsec_last_seen": "2026-03-04T16:15:42.466Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-03-04T17:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--9de347db-9131-4d73-b6ea-2a8c762e9254",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:05:16.000Z",
      "valid_until": "2026-04-05T17:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T16:15:42.926Z",
      "x_nadsec_last_seen": "2026-03-04T16:15:42.926Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-03-04T17:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--57bfcdb2-c12b-4591-ae6f-978422d67588",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:05:16.000Z",
      "valid_until": "2026-04-05T17:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T17:03:10.627Z",
      "x_nadsec_last_seen": "2026-03-04T17:03:10.627Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T17:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7bea7f73-7a20-4984-a820-3f7377458f38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:05:16.000Z",
      "valid_until": "2026-04-05T17:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T16:27:31.571Z",
      "x_nadsec_last_seen": "2026-03-04T16:27:31.571Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T17:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133982; asn_org=Excitel Broadband Private Limited",
      "id": "indicator--d3a874f8-de09-4ff5-b414-e68512bc398d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.254.184.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:05:16.000Z",
      "valid_until": "2026-04-05T17:05:11.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-04T16:54:40.702Z",
      "x_nadsec_last_seen": "2026-03-07T04:21:45.616Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133982"
      ],
      "x_nadsec_orgs": [
        "Excitel Broadband Private Limited"
      ]
    },
    {
      "created": "2026-03-04T17:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9956f8dd-40ef-4352-bacf-b891c5ff3fe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T17:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:05:16.000Z",
      "valid_until": "2026-04-05T17:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T16:09:12.842Z",
      "x_nadsec_last_seen": "2026-03-09T11:53:15.447Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-04T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=21299; asn_org=Kar-Tel LLC",
      "id": "indicator--bbd09e98-f551-4024-8ecc-0f210d705cbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.201.53.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:05:13.000Z",
      "valid_until": "2026-04-05T18:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T17:17:25.914Z",
      "x_nadsec_last_seen": "2026-03-04T17:19:33.012Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "21299"
      ],
      "x_nadsec_orgs": [
        "Kar-Tel LLC"
      ]
    },
    {
      "created": "2026-03-04T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--bc72ffe8-b04c-47d0-a2ae-b0701d8334d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.172.187.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:05:13.000Z",
      "valid_until": "2026-04-05T18:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T17:49:07.077Z",
      "x_nadsec_last_seen": "2026-03-04T17:51:11.734Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-04T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=138089; asn_org=PT.Global Media Data Prima",
      "id": "indicator--bcb01a81-9266-4a55-8bd6-cab3404bbbc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.20.252.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:05:13.000Z",
      "valid_until": "2026-04-05T18:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T17:37:17.856Z",
      "x_nadsec_last_seen": "2026-03-04T17:41:33.606Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "138089"
      ],
      "x_nadsec_orgs": [
        "PT.Global Media Data Prima"
      ]
    },
    {
      "created": "2026-03-04T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5da17bf9-2f26-4a3e-bf68-b39445398bdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:05:13.000Z",
      "valid_until": "2026-04-05T18:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T17:31:12.240Z",
      "x_nadsec_last_seen": "2026-03-23T04:13:31.336Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-04T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RS; asn=8400; asn_org=TELEKOM SRBIJA a.d.",
      "id": "indicator--7fb01dc8-4023-4d2d-a4ce-ed1d78338402",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.220.185.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:05:13.000Z",
      "valid_until": "2026-04-05T18:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T17:12:30.792Z",
      "x_nadsec_last_seen": "2026-03-04T17:14:37.324Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "8400"
      ],
      "x_nadsec_orgs": [
        "TELEKOM SRBIJA a.d."
      ]
    },
    {
      "created": "2026-03-04T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--320307c7-cbc9-4ad9-9be0-c16d8926544b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.69.102.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:05:13.000Z",
      "valid_until": "2026-04-05T18:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T17:11:29.790Z",
      "x_nadsec_last_seen": "2026-03-04T17:13:38.950Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-04T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=26210; asn_org=AXS Bolivia S. A.",
      "id": "indicator--4f5b00c3-dcc4-442b-8354-178a0e99d384",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.181.22.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:05:13.000Z",
      "valid_until": "2026-04-05T18:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T17:06:55.064Z",
      "x_nadsec_last_seen": "2026-03-31T12:45:57.461Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "26210"
      ],
      "x_nadsec_orgs": [
        "AXS Bolivia S. A."
      ]
    },
    {
      "created": "2026-03-04T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--916a0893-8cdb-4596-aa40-155a376efcbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.248.92.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:05:13.000Z",
      "valid_until": "2026-04-05T18:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T17:33:38.310Z",
      "x_nadsec_last_seen": "2026-03-22T13:29:15.776Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-03-04T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b8b2e9d8-ac57-41c9-a308-b89afaccf79d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:05:13.000Z",
      "valid_until": "2026-04-05T18:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T17:41:07.112Z",
      "x_nadsec_last_seen": "2026-03-04T17:41:07.112Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--253828da-5683-40bc-987d-da6523df9684",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.92.189.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:05:13.000Z",
      "valid_until": "2026-04-05T18:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T17:52:30.259Z",
      "x_nadsec_last_seen": "2026-03-16T07:47:56.460Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-04T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=KE; asn=30844; asn_org=Liquid Telecommunications Ltd",
      "id": "indicator--29b21615-c78e-43ec-8395-d07dff93e75b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.72.205.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:05:13.000Z",
      "valid_until": "2026-04-05T18:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-04T17:33:38.708Z",
      "x_nadsec_last_seen": "2026-03-22T15:55:45.274Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "30844"
      ],
      "x_nadsec_orgs": [
        "Liquid Telecommunications Ltd"
      ]
    },
    {
      "created": "2026-03-04T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--68ebda31-294a-4189-a0e4-4a32f4e72040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.240.236.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:05:13.000Z",
      "valid_until": "2026-04-05T18:05:12.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-03-04T17:45:39.154Z",
      "x_nadsec_last_seen": "2026-03-30T00:46:52.021Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "1433",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "mssqld",
        "mysqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-04T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--90d641f6-ba6d-4499-8ae1-5413036fc060",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.93.49.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T18:05:13.000Z",
      "valid_until": "2026-04-05T18:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T17:13:04.796Z",
      "x_nadsec_last_seen": "2026-03-04T17:15:12.042Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=SG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--fc81e133-4cf8-4141-a5cb-b5664a15df0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.72.147.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T18:36:01.483Z",
      "x_nadsec_last_seen": "2026-03-04T18:36:01.483Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--196ab323-794b-4d1f-b357-e71ddd31b9f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.194.250.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T19:00:55.881Z",
      "x_nadsec_last_seen": "2026-03-04T19:01:14.710Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--9f5619ee-66be-4923-8e2d-6716bca34431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.212.158.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T18:46:24.509Z",
      "x_nadsec_last_seen": "2026-03-04T22:36:24.306Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=BR; asn=264489; asn_org=P V VILARINHO CAMPELO PROVEDOR; user(top)=**",
      "id": "indicator--dae3c871-b39f-45e7-9477-3535292d1cc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '131.255.152.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T18:39:50.024Z",
      "x_nadsec_last_seen": "2026-03-26T00:22:56.371Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264489"
      ],
      "x_nadsec_orgs": [
        "P V VILARINHO CAMPELO PROVEDOR"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1fceb5d5-2c22-4f8b-99c3-766b27eb464c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T18:54:18.158Z",
      "x_nadsec_last_seen": "2026-03-17T07:32:25.555Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--9e6d12ba-42fa-4d89-9a13-9e7518af845a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.120.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T18:10:10.880Z",
      "x_nadsec_last_seen": "2026-03-22T19:11:49.246Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--d2d9c6b2-f26d-4430-a232-83fea541a5a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.164.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-04T18:21:58.424Z",
      "x_nadsec_last_seen": "2026-03-05T17:43:33.144Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--63bba9b8-41a4-4013-92d0-65fc6142ef00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.245.52.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T18:16:08.090Z",
      "x_nadsec_last_seen": "2026-03-04T18:18:13.176Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JO; asn=9038; asn_org=Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co",
      "id": "indicator--5d2bdef6-2e62-4183-b734-f5ddd08b0482",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.118.18.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-04T18:49:51.668Z",
      "x_nadsec_last_seen": "2026-03-06T08:57:56.935Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "9038"
      ],
      "x_nadsec_orgs": [
        "Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co"
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=8393; asn_org=astel Jsc",
      "id": "indicator--a9c6725c-a5cc-494a-ba8b-36ad3e5d7355",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.157.44.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T18:54:22.219Z",
      "x_nadsec_last_seen": "2026-03-18T16:06:32.623Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "8393"
      ],
      "x_nadsec_orgs": [
        "astel Jsc"
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--c89002b7-0fbe-4b4d-9ace-91e6f8d6e3f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.76.34.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-04T18:55:00.739Z",
      "x_nadsec_last_seen": "2026-03-08T22:24:27.451Z",
      "x_nadsec_ports": [
        "3306",
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "mysqld",
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--fb2f12ea-6a76-4bde-ad8d-e0287b03e3a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.140.212.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T18:56:29.600Z",
      "x_nadsec_last_seen": "2026-03-14T04:22:58.474Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f05308ba-132e-4bd3-8822-28e4e6512c5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T18:51:44.270Z",
      "x_nadsec_last_seen": "2026-03-04T18:51:44.270Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a65312aa-fe42-4a91-a7cd-4a4e5e661b42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T18:51:22.140Z",
      "x_nadsec_last_seen": "2026-03-04T18:51:22.140Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--cf9d5ab7-7309-4349-bf65-9d548a598296",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T18:51:43.865Z",
      "x_nadsec_last_seen": "2026-03-04T18:51:43.865Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9e6677d0-be36-4e8e-9389-932fae7b5832",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T18:51:22.481Z",
      "x_nadsec_last_seen": "2026-03-04T18:51:22.481Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=197394; asn_org=CJSC Telecommunications 21",
      "id": "indicator--4007b76c-590a-4777-9c3b-d9012b55e451",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.245.35.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T18:53:51.142Z",
      "x_nadsec_last_seen": "2026-03-05T16:02:12.586Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "197394"
      ],
      "x_nadsec_orgs": [
        "CJSC Telecommunications 21"
      ]
    },
    {
      "created": "2026-03-04T19:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--c331bbdd-4338-4b6d-8368-d25f94a1d316",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T19:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.9.104.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:05:05.000Z",
      "valid_until": "2026-04-05T19:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T18:51:36.511Z",
      "x_nadsec_last_seen": "2026-03-04T18:53:43.319Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-04T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--88187d56-0e33-45d7-989d-bd12aa874547",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.88.112.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:05:12.000Z",
      "valid_until": "2026-04-05T20:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T19:05:18.798Z",
      "x_nadsec_last_seen": "2026-03-04T19:11:01.481Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-04T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132924; asn_org=Ero Wide Comm Private Limited",
      "id": "indicator--43076200-cf54-4af6-9739-58e14037cc6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.59.135.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:05:12.000Z",
      "valid_until": "2026-04-05T20:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T19:36:17.136Z",
      "x_nadsec_last_seen": "2026-03-04T19:36:23.143Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132924"
      ],
      "x_nadsec_orgs": [
        "Ero Wide Comm Private Limited"
      ]
    },
    {
      "created": "2026-03-04T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f8f3e1b7-88a1-4adf-a1af-224027e479b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:05:12.000Z",
      "valid_until": "2026-04-05T20:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T19:28:36.787Z",
      "x_nadsec_last_seen": "2026-03-04T19:28:36.787Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--58503fd2-ccc0-4d81-a01d-4ceb48eaee09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.252.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:05:12.000Z",
      "valid_until": "2026-04-05T20:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T19:15:23.231Z",
      "x_nadsec_last_seen": "2026-03-04T19:15:23.231Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-04T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6adb11bb-ff88-4a9c-a46a-4752fc84d77b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.223.143.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:05:12.000Z",
      "valid_until": "2026-04-05T20:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T19:10:56.254Z",
      "x_nadsec_last_seen": "2026-03-05T00:33:31.026Z",
      "x_nadsec_ports": [
        "1883",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-04T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--222dd31c-2066-490d-9bc9-8e893247e03d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.65.187.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:05:12.000Z",
      "valid_until": "2026-04-05T20:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T19:32:55.745Z",
      "x_nadsec_last_seen": "2026-03-17T13:58:10.768Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-04T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f48c83aa-6b1c-4a25-988e-b2f24415c1fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.71.27.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:05:12.000Z",
      "valid_until": "2026-04-05T20:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T19:15:23.981Z",
      "x_nadsec_last_seen": "2026-03-04T19:15:23.981Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-04T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0d03c96f-8737-4428-9d58-d7b04d14819a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.128.148.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:05:12.000Z",
      "valid_until": "2026-04-05T20:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T19:10:44.335Z",
      "x_nadsec_last_seen": "2026-03-04T19:10:55.604Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-04T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZW; asn=37183; asn_org=UTANDE",
      "id": "indicator--095397e1-982a-44a6-8a24-d908a9112742",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.43.114.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:05:12.000Z",
      "valid_until": "2026-04-05T20:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T19:48:03.059Z",
      "x_nadsec_last_seen": "2026-03-04T19:49:04.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZW"
      ],
      "x_nadsec_asns": [
        "37183"
      ],
      "x_nadsec_orgs": [
        "UTANDE"
      ]
    },
    {
      "created": "2026-03-04T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EC; asn=19114; asn_org=Otecel S.A.",
      "id": "indicator--c0991963-9053-4313-83b4-c2fff060d14f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.24.202.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:05:12.000Z",
      "valid_until": "2026-04-05T20:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T19:59:02.809Z",
      "x_nadsec_last_seen": "2026-03-04T20:01:07.917Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "19114"
      ],
      "x_nadsec_orgs": [
        "Otecel S.A."
      ]
    },
    {
      "created": "2026-03-04T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=KR; asn=4766; asn_org=Korea Telecom; user(top)=**",
      "id": "indicator--15ebedc5-67bf-483a-b9fe-b132d32f7ebe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '221.147.200.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:05:12.000Z",
      "valid_until": "2026-04-05T20:05:11.000Z",
      "x_nadsec_event_count": 149,
      "x_nadsec_first_seen": "2026-03-04T19:31:18.472Z",
      "x_nadsec_last_seen": "2026-03-26T21:15:23.245Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "4766"
      ],
      "x_nadsec_orgs": [
        "Korea Telecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--6499bdf2-6092-44d0-a1e2-01c397e05235",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.125.89.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:05:12.000Z",
      "valid_until": "2026-04-05T20:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T19:27:54.844Z",
      "x_nadsec_last_seen": "2026-03-05T15:41:45.361Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-04T20:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--9a394da5-de57-4993-8e88-c0456aadf089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T20:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.46.169.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:05:12.000Z",
      "valid_until": "2026-04-05T20:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T19:14:20.130Z",
      "x_nadsec_last_seen": "2026-03-04T19:16:26.502Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-04T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--9aeaff7f-bfa8-4b0d-be17-3de96fc707b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.163.94.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:05:13.000Z",
      "valid_until": "2026-04-05T21:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T20:50:17.971Z",
      "x_nadsec_last_seen": "2026-03-04T20:50:18.745Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0349638d-26d3-4efc-844c-30ab40b0002c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.168.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:05:13.000Z",
      "valid_until": "2026-04-05T21:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T20:50:14.076Z",
      "x_nadsec_last_seen": "2026-03-04T20:50:14.212Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-04T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=SA; asn=39891; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--fea857de-7472-4959-b811-b85473dc70c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.54.153.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:05:13.000Z",
      "valid_until": "2026-04-05T21:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T20:44:41.953Z",
      "x_nadsec_last_seen": "2026-03-04T20:52:55.701Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "39891"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-04T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a5a8a12e-6a83-48b4-b17a-3bb28e99882a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:05:13.000Z",
      "valid_until": "2026-04-05T21:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T20:05:30.320Z",
      "x_nadsec_last_seen": "2026-03-04T20:05:40.643Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-04T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--178aa0ac-7c49-4033-97fa-ebc5113bc407",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:05:13.000Z",
      "valid_until": "2026-04-05T21:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T20:14:59.039Z",
      "x_nadsec_last_seen": "2026-03-18T23:41:48.951Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f492fed1-5f1d-4938-8a6d-737b7c9d2c4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:05:13.000Z",
      "valid_until": "2026-04-05T21:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T21:03:44.282Z",
      "x_nadsec_last_seen": "2026-03-04T21:03:44.282Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=11845; asn_org=Vox-Telecom",
      "id": "indicator--b2afd44d-89ec-4abb-b345-bf2a686c8c63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.193.198.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:05:13.000Z",
      "valid_until": "2026-04-05T21:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T20:35:20.497Z",
      "x_nadsec_last_seen": "2026-03-04T20:37:28.490Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "11845"
      ],
      "x_nadsec_orgs": [
        "Vox-Telecom"
      ]
    },
    {
      "created": "2026-03-04T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=28458; asn_org=IENTC S DE RL DE CV",
      "id": "indicator--f3fbde17-376f-4d6c-9a93-da2417e14e17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.195.79.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:05:13.000Z",
      "valid_until": "2026-04-05T21:05:12.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-04T20:51:35.488Z",
      "x_nadsec_last_seen": "2026-03-14T12:10:46.771Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "28458"
      ],
      "x_nadsec_orgs": [
        "IENTC S DE RL DE CV"
      ]
    },
    {
      "created": "2026-03-04T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; user(top)=**",
      "id": "indicator--12e0c679-7f5d-4b14-88ef-d5649c01ee21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.233.115.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:05:13.000Z",
      "valid_until": "2026-04-05T21:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T20:39:58.066Z",
      "x_nadsec_last_seen": "2026-03-04T20:39:58.066Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "45090"
      ],
      "x_nadsec_orgs": [
        "Shenzhen Tencent Computer Systems Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--8ee6a75d-23d1-41b1-ad36-f9d83380f202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:05:13.000Z",
      "valid_until": "2026-04-05T21:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T20:16:14.673Z",
      "x_nadsec_last_seen": "2026-03-16T14:31:49.364Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-04T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--2b5f87eb-10df-4157-aa18-f09f5f6e8584",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:05:13.000Z",
      "valid_until": "2026-04-05T21:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T20:52:28.012Z",
      "x_nadsec_last_seen": "2026-03-04T20:52:28.012Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-04T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4847; asn_org=China Networks Inter-Exchange; user(top)=**",
      "id": "indicator--e46ff6eb-f186-4679-9b80-016d998931fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.182.75.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:05:14.000Z",
      "valid_until": "2026-04-05T22:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T21:43:27.957Z",
      "x_nadsec_last_seen": "2026-03-04T21:43:29.214Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4847"
      ],
      "x_nadsec_orgs": [
        "China Networks Inter-Exchange"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-04T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--da976dfc-2dde-4143-baf2-b777e3fb5197",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.42.136.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:05:14.000Z",
      "valid_until": "2026-04-05T22:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T21:42:03.521Z",
      "x_nadsec_last_seen": "2026-03-04T21:42:03.521Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-04T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones",
      "id": "indicator--bd097c0c-13d9-4e89-a993-4c7425871690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.62.86.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:05:14.000Z",
      "valid_until": "2026-04-05T22:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T21:58:27.751Z",
      "x_nadsec_last_seen": "2026-03-04T23:33:08.289Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UY"
      ],
      "x_nadsec_asns": [
        "6057"
      ],
      "x_nadsec_orgs": [
        "Administracion Nacional de Telecomunicaciones"
      ]
    },
    {
      "created": "2026-03-04T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--89b61e60-60f3-4001-892c-0a49c9f24278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.215.144.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:05:14.000Z",
      "valid_until": "2026-04-05T22:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T21:55:16.986Z",
      "x_nadsec_last_seen": "2026-03-04T21:55:27.147Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-04T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DO; asn=6400; asn_org=Compania Dominicana de Telefonos S. A.",
      "id": "indicator--f576342c-9a40-4adf-b306-6bb1532c641a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.6.17.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:05:14.000Z",
      "valid_until": "2026-04-05T22:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T21:25:33.250Z",
      "x_nadsec_last_seen": "2026-03-10T15:45:24.845Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "6400"
      ],
      "x_nadsec_orgs": [
        "Compania Dominicana de Telefonos S. A."
      ]
    },
    {
      "created": "2026-03-04T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--82a0ec13-c874-4549-8024-3e14f40975f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.122.119.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:05:14.000Z",
      "valid_until": "2026-04-05T22:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-04T21:32:58.924Z",
      "x_nadsec_last_seen": "2026-03-30T07:22:56.772Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-04T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--32d00821-8f68-4173-a775-740ebedda8b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.232.153.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:05:14.000Z",
      "valid_until": "2026-04-05T22:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T21:54:03.103Z",
      "x_nadsec_last_seen": "2026-03-04T21:56:07.778Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-04T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NL; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1c75a434-7397-4925-8a99-975a64d308cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.174.144.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:05:14.000Z",
      "valid_until": "2026-04-05T22:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T21:39:31.174Z",
      "x_nadsec_last_seen": "2026-03-04T21:39:31.289Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-04T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AR; asn=3356; asn_org=Level 3 Parent, LLC",
      "id": "indicator--1a4b71d9-8d8b-4fe6-aa7b-5d06959684a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '8.243.5.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:05:14.000Z",
      "valid_until": "2026-04-05T22:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T21:07:50.209Z",
      "x_nadsec_last_seen": "2026-03-04T21:07:50.538Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "3356"
      ],
      "x_nadsec_orgs": [
        "Level 3 Parent, LLC"
      ]
    },
    {
      "created": "2026-03-04T22:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--7084af97-f8e7-4d3b-92e9-3e88170e18ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T22:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.250.7.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:05:14.000Z",
      "valid_until": "2026-04-05T22:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T21:32:10.106Z",
      "x_nadsec_last_seen": "2026-03-04T21:39:19.228Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-04T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--03b19e66-1dff-4fd0-b65f-adc4ac20ad10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.251.241.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:05:12.000Z",
      "valid_until": "2026-04-05T23:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T22:25:35.664Z",
      "x_nadsec_last_seen": "2026-03-04T22:27:41.622Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-04T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--81bd6631-6d15-48e5-a8d3-7800f6199752",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.110.28.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:05:12.000Z",
      "valid_until": "2026-04-05T23:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T22:28:41.041Z",
      "x_nadsec_last_seen": "2026-03-04T22:30:48.265Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-04T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=17494; asn_org=Telecom Operator & Internet Service Provider as well",
      "id": "indicator--7236d211-5b63-431a-b088-79f02ad4e7eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.112.217.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:05:12.000Z",
      "valid_until": "2026-04-05T23:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T22:42:58.888Z",
      "x_nadsec_last_seen": "2026-03-04T22:50:01.082Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "17494"
      ],
      "x_nadsec_orgs": [
        "Telecom Operator & Internet Service Provider as well"
      ]
    },
    {
      "created": "2026-03-04T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--008e660c-7260-4723-8365-f13b0ba5426a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:05:12.000Z",
      "valid_until": "2026-04-05T23:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T22:58:35.735Z",
      "x_nadsec_last_seen": "2026-03-14T21:01:46.801Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--95301305-ea18-4d33-9af8-ff0656222a07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:05:12.000Z",
      "valid_until": "2026-04-05T23:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T22:12:58.227Z",
      "x_nadsec_last_seen": "2026-03-04T22:12:59.001Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-04T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RS; asn=8400; asn_org=TELEKOM SRBIJA a.d.",
      "id": "indicator--a467a08e-c709-4b20-8684-c4a7fb531227",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.200.119.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:05:12.000Z",
      "valid_until": "2026-04-05T23:05:11.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-03-04T22:05:33.665Z",
      "x_nadsec_last_seen": "2026-03-22T06:24:06.051Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "8400"
      ],
      "x_nadsec_orgs": [
        "TELEKOM SRBIJA a.d."
      ]
    },
    {
      "created": "2026-03-04T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--d3bbd81b-8093-46bc-9212-8a0de5d0db01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '72.90.84.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:05:12.000Z",
      "valid_until": "2026-04-05T23:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-04T22:09:05.676Z",
      "x_nadsec_last_seen": "2026-03-04T22:09:05.722Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-03-04T23:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=RU; asn=44050; asn_org=Petersburg Internet Network ltd.",
      "id": "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-04T23:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.215.0.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:05:12.000Z",
      "valid_until": "2026-04-05T23:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-04T22:56:15.450Z",
      "x_nadsec_last_seen": "2026-03-24T20:32:58.798Z",
      "x_nadsec_ports": [
        "3306",
        "27017",
        "21"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "44050"
      ],
      "x_nadsec_orgs": [
        "Petersburg Internet Network ltd."
      ]
    },
    {
      "created": "2026-03-05T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=21788; asn_org=HIPOINT TECHNOLOGY SERVICES, INC.",
      "id": "indicator--3a450a7d-21ad-4bde-920a-6ea273feb5cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.142.30.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:05:13.000Z",
      "valid_until": "2026-04-06T00:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T23:06:59.398Z",
      "x_nadsec_last_seen": "2026-03-04T23:09:04.437Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "21788"
      ],
      "x_nadsec_orgs": [
        "HIPOINT TECHNOLOGY SERVICES, INC."
      ]
    },
    {
      "created": "2026-03-05T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=17625; asn_org=BlazeNets Network",
      "id": "indicator--4652cee6-9741-40bf-8960-fa13a3355347",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.54.190.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:05:13.000Z",
      "valid_until": "2026-04-06T00:05:12.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-04T23:27:35.424Z",
      "x_nadsec_last_seen": "2026-03-05T18:55:24.664Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17625"
      ],
      "x_nadsec_orgs": [
        "BlazeNets Network"
      ]
    },
    {
      "created": "2026-03-05T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--958f359f-3fb2-4ba2-a742-ab314ccb4e47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.206.3.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:05:13.000Z",
      "valid_until": "2026-04-06T00:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-04T23:18:15.911Z",
      "x_nadsec_last_seen": "2026-03-15T22:45:13.847Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-05T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--1932d63a-25d1-4dcc-9e45-9d514cd0be4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.82.107.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:05:13.000Z",
      "valid_until": "2026-04-06T00:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T23:10:55.514Z",
      "x_nadsec_last_seen": "2026-03-29T17:06:32.822Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-05T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=15774; asn_org=Limited Liability Company TTK-Svyaz",
      "id": "indicator--38451dea-989a-4149-ba74-9d1335796921",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.244.154.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:05:13.000Z",
      "valid_until": "2026-04-06T00:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-04T23:19:16.354Z",
      "x_nadsec_last_seen": "2026-03-04T23:20:27.105Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "15774"
      ],
      "x_nadsec_orgs": [
        "Limited Liability Company TTK-Svyaz"
      ]
    },
    {
      "created": "2026-03-05T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--164127fb-a74d-4933-a84b-6bfda8914636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:05:13.000Z",
      "valid_until": "2026-04-06T00:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-04T23:31:44.463Z",
      "x_nadsec_last_seen": "2026-03-04T23:31:44.463Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-05T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--854bb137-23f9-43fd-9005-ba406e7b4be2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.243.120.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:05:13.000Z",
      "valid_until": "2026-04-06T00:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-04T23:59:05.651Z",
      "x_nadsec_last_seen": "2026-03-05T00:01:10.174Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ]
    },
    {
      "created": "2026-03-05T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=23520; asn_org=Columbus Networks USA, Inc.",
      "id": "indicator--33a68fa6-e9de-4e25-971b-48e547f32d57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '63.245.45.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:05:13.000Z",
      "valid_until": "2026-04-06T00:05:12.000Z",
      "x_nadsec_event_count": 25,
      "x_nadsec_first_seen": "2026-03-04T23:34:17.970Z",
      "x_nadsec_last_seen": "2026-03-28T22:44:33.173Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US",
        "GD"
      ],
      "x_nadsec_asns": [
        "23520"
      ],
      "x_nadsec_orgs": [
        "Columbus Networks USA, Inc."
      ]
    },
    {
      "created": "2026-03-05T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--3111aa2b-0134-440d-9544-99023276fc68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.175.7.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:05:13.000Z",
      "valid_until": "2026-04-06T00:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-04T23:31:40.580Z",
      "x_nadsec_last_seen": "2026-03-05T08:28:31.781Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-03-05T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--d2e86bda-510e-4e01-bbd3-50f05af1660d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.43.153.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:05:13.000Z",
      "valid_until": "2026-04-06T00:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-04T23:43:10.432Z",
      "x_nadsec_last_seen": "2026-03-05T04:30:46.166Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-03-05T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=32; services=ftpd; ports=21; cc=CN; asn=4134; asn_org=Chinanet; user(top)=***; pass(top)=f*****u",
      "id": "indicator--7c3bf6e6-2c85-4273-a13a-cc49db5a19cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.185.171.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:05:13.000Z",
      "valid_until": "2026-04-06T01:05:12.000Z",
      "x_nadsec_event_count": 32,
      "x_nadsec_first_seen": "2026-03-05T00:52:17.166Z",
      "x_nadsec_last_seen": "2026-03-05T00:58:16.339Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        "0****0",
        "***",
        "1****3",
        "1****1",
        "1****6"
      ]
    },
    {
      "created": "2026-03-05T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4065b070-26d2-404e-a4c4-7d99fdb28342",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.190.77.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:05:13.000Z",
      "valid_until": "2026-04-06T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T00:33:23.051Z",
      "x_nadsec_last_seen": "2026-03-05T00:33:23.051Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-05T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=35104; asn_org=Jusan Mobile JSC",
      "id": "indicator--54ea3de1-bb06-4b55-b1af-bc215e825194",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.0.139.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:05:13.000Z",
      "valid_until": "2026-04-06T01:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T00:08:14.043Z",
      "x_nadsec_last_seen": "2026-03-05T00:10:21.224Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "35104"
      ],
      "x_nadsec_orgs": [
        "Jusan Mobile JSC"
      ]
    },
    {
      "created": "2026-03-05T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--5280637d-f44d-425e-a7a8-7a1a53451cc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.191.151.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:05:13.000Z",
      "valid_until": "2026-04-06T01:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-05T00:35:36.132Z",
      "x_nadsec_last_seen": "2026-03-23T05:54:01.178Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-05T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--4843d525-fcaf-43ec-a271-0f20ffb0c42f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.191.151.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:05:13.000Z",
      "valid_until": "2026-04-06T01:05:12.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-05T00:30:21.090Z",
      "x_nadsec_last_seen": "2026-03-26T11:13:21.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-05T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--8067bf73-c7d0-4a7b-ab16-836a20eb3902",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.50.223.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:05:13.000Z",
      "valid_until": "2026-04-06T01:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T00:54:36.646Z",
      "x_nadsec_last_seen": "2026-03-05T00:56:41.704Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-03-05T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--b1158292-5590-4205-bfaf-5c123c090da2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.137.91.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:05:13.000Z",
      "valid_until": "2026-04-06T01:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T00:37:14.571Z",
      "x_nadsec_last_seen": "2026-03-05T00:39:19.271Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-05T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UG; asn=20294; asn_org=MTN",
      "id": "indicator--128923a3-0435-4cad-acba-52954a3f7c61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.210.143.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:05:13.000Z",
      "valid_until": "2026-04-06T01:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T00:15:18.296Z",
      "x_nadsec_last_seen": "2026-03-05T00:17:27.473Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UG"
      ],
      "x_nadsec_asns": [
        "20294"
      ],
      "x_nadsec_orgs": [
        "MTN"
      ]
    },
    {
      "created": "2026-03-05T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=894; services=smbd; ports=445; cc=SA; asn=39891; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--78a974a1-84fd-4a91-bef2-cbbe63544c23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.156.134.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:05:13.000Z",
      "valid_until": "2026-04-06T01:05:12.000Z",
      "x_nadsec_event_count": 894,
      "x_nadsec_first_seen": "2026-03-05T00:21:26.529Z",
      "x_nadsec_last_seen": "2026-03-05T00:41:00.566Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "39891"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-05T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--a67d44cc-cde4-49ed-9c10-24301ceaab0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.201.219.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:05:13.000Z",
      "valid_until": "2026-04-06T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T00:49:56.439Z",
      "x_nadsec_last_seen": "2026-03-05T00:49:56.439Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-05T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--949d3df9-0dac-4085-b87a-fea898e403f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.208.114.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:05:13.000Z",
      "valid_until": "2026-04-06T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T00:38:56.065Z",
      "x_nadsec_last_seen": "2026-03-05T00:38:56.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-05T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--53449598-c98c-4301-a106-d8ae08a877b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.105.167.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:05:13.000Z",
      "valid_until": "2026-04-06T01:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T00:31:57.895Z",
      "x_nadsec_last_seen": "2026-03-05T00:34:02.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-05T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--1c49fbae-e91d-4161-974d-8fa650395dcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:05:13.000Z",
      "valid_until": "2026-04-06T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T00:53:59.433Z",
      "x_nadsec_last_seen": "2026-03-05T00:53:59.433Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-05T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ee828333-c1c3-4212-9b6a-cb05249fa823",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:05:13.000Z",
      "valid_until": "2026-04-06T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T00:54:09.807Z",
      "x_nadsec_last_seen": "2026-03-05T00:54:09.807Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-05T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e5739a89-e847-40f2-b08d-f1363f614038",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.164.209.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:05:12.000Z",
      "valid_until": "2026-04-06T02:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T01:18:05.926Z",
      "x_nadsec_last_seen": "2026-03-05T01:20:12.150Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-05T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8dc7106b-6fc7-4635-b5b4-a86c41d0e32f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:05:12.000Z",
      "valid_until": "2026-04-06T02:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T01:52:28.852Z",
      "x_nadsec_last_seen": "2026-03-05T01:52:28.856Z",
      "x_nadsec_ports": [
        "42",
        "34237"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-05T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7688fcaa-e97c-4d80-87bf-c5be53d7e1af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:05:12.000Z",
      "valid_until": "2026-04-06T02:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T01:27:16.333Z",
      "x_nadsec_last_seen": "2026-03-05T01:27:16.333Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-05T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--737c298e-b791-4da6-b1bc-494a23a45b76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:05:12.000Z",
      "valid_until": "2026-04-06T02:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T01:34:57.224Z",
      "x_nadsec_last_seen": "2026-03-21T16:40:51.874Z",
      "x_nadsec_ports": [
        "445",
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-05T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IE; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--19cc3782-2e09-4660-ae62-6f70698b922f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.82.185.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:05:12.000Z",
      "valid_until": "2026-04-06T02:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T01:34:38.022Z",
      "x_nadsec_last_seen": "2026-03-07T13:01:03.738Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IE"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-05T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BN; asn=10094; asn_org=Unified National Networks",
      "id": "indicator--1fffff24-40b0-4707-ac3a-b619faeb94f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.160.38.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:05:12.000Z",
      "valid_until": "2026-04-06T02:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T01:07:50.794Z",
      "x_nadsec_last_seen": "2026-03-05T01:07:56.642Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BN"
      ],
      "x_nadsec_asns": [
        "10094"
      ],
      "x_nadsec_orgs": [
        "Unified National Networks"
      ]
    },
    {
      "created": "2026-03-05T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=209059; asn_org=G COM Ltd.",
      "id": "indicator--12e87400-30ac-4984-81cf-df2f66913043",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.177.126.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:05:12.000Z",
      "valid_until": "2026-04-06T02:05:11.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-05T01:51:59.284Z",
      "x_nadsec_last_seen": "2026-03-22T23:55:18.816Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "209059"
      ],
      "x_nadsec_orgs": [
        "G COM Ltd."
      ]
    },
    {
      "created": "2026-03-05T02:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=49531; asn_org=NetCom-R LLC",
      "id": "indicator--aad757f3-9f2f-485a-b6e4-8d91c34fac0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T02:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.159.44.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:05:12.000Z",
      "valid_until": "2026-04-06T02:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-05T01:51:47.725Z",
      "x_nadsec_last_seen": "2026-03-13T17:02:13.744Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "49531"
      ],
      "x_nadsec_orgs": [
        "NetCom-R LLC"
      ]
    },
    {
      "created": "2026-03-05T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5765fedc-e381-420c-b997-792cc870b2e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.244.187.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:05:03.000Z",
      "valid_until": "2026-04-06T03:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T02:37:17.889Z",
      "x_nadsec_last_seen": "2026-03-05T02:37:17.889Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-05T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ab162248-41f8-4759-aeaf-c016087a8d26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.202.104.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:05:03.000Z",
      "valid_until": "2026-04-06T03:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T02:45:32.030Z",
      "x_nadsec_last_seen": "2026-03-05T02:45:32.030Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-05T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UA; asn=21256; asn_org=Luxlink ltd",
      "id": "indicator--e7deabfe-869c-4e41-ab7c-ddecfc5bf6ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.109.145.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:05:03.000Z",
      "valid_until": "2026-04-06T03:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T03:00:04.843Z",
      "x_nadsec_last_seen": "2026-03-05T03:02:11.874Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "21256"
      ],
      "x_nadsec_orgs": [
        "Luxlink ltd"
      ]
    },
    {
      "created": "2026-03-05T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=57658; asn_org=Joint Stock Company AUTOASSISTANCE",
      "id": "indicator--0933ac42-0a52-445e-826a-925ac6ac7d32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.85.22.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:05:03.000Z",
      "valid_until": "2026-04-06T03:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T02:30:00.328Z",
      "x_nadsec_last_seen": "2026-03-05T02:32:11.592Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57658"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company AUTOASSISTANCE"
      ]
    },
    {
      "created": "2026-03-05T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37705; asn_org=TOPNET",
      "id": "indicator--6a230c3f-5a5f-40af-b01c-3ba8641faa23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.3.6.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:05:03.000Z",
      "valid_until": "2026-04-06T03:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T02:21:40.048Z",
      "x_nadsec_last_seen": "2026-03-05T02:23:47.652Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37705"
      ],
      "x_nadsec_orgs": [
        "TOPNET"
      ]
    },
    {
      "created": "2026-03-05T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GR; asn=6799; asn_org=OTEnet S.A.",
      "id": "indicator--4f5f2eb2-22ff-43f8-82c6-ed3c45df5b22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.129.109.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:05:03.000Z",
      "valid_until": "2026-04-06T03:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T02:13:20.405Z",
      "x_nadsec_last_seen": "2026-03-05T02:13:26.998Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GR"
      ],
      "x_nadsec_asns": [
        "6799"
      ],
      "x_nadsec_orgs": [
        "OTEnet S.A."
      ]
    },
    {
      "created": "2026-03-05T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133982; asn_org=Excitel Broadband Private Limited",
      "id": "indicator--ca34ab5b-b319-4d9a-8364-8e60202de21c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.87.57.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:05:13.000Z",
      "valid_until": "2026-04-06T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T03:47:23.752Z",
      "x_nadsec_last_seen": "2026-03-05T03:49:32.518Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133982"
      ],
      "x_nadsec_orgs": [
        "Excitel Broadband Private Limited"
      ]
    },
    {
      "created": "2026-03-05T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--54474002-cd9c-4166-a63c-be379e16e22c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.54.237.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:05:13.000Z",
      "valid_until": "2026-04-06T04:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T03:43:42.653Z",
      "x_nadsec_last_seen": "2026-03-05T03:51:06.771Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-05T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=2572; asn_org=University of Missouri - dba the Missouri Research and Education Network MOREnet",
      "id": "indicator--8db3e9c9-2bea-4f9a-b168-c213daa66222",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '150.199.194.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:05:13.000Z",
      "valid_until": "2026-04-06T04:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T03:27:12.113Z",
      "x_nadsec_last_seen": "2026-03-05T03:27:12.366Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "2572"
      ],
      "x_nadsec_orgs": [
        "University of Missouri - dba the Missouri Research and Education Network MOREnet"
      ]
    },
    {
      "created": "2026-03-05T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SC; asn=150706; asn_org=Hong Kong Zhengxing Technology Co., Ltd.",
      "id": "indicator--7dd6d80f-c28c-44fd-ae51-24a89748ff7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.218.7.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:05:13.000Z",
      "valid_until": "2026-04-06T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T03:38:38.884Z",
      "x_nadsec_last_seen": "2026-03-05T03:40:43.334Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "150706"
      ],
      "x_nadsec_orgs": [
        "Hong Kong Zhengxing Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-05T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=38758; asn_org=PT. HIPERNET INDODATA",
      "id": "indicator--9e1aeace-1ad7-4f78-830e-298bf455d4b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.178.99.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:05:13.000Z",
      "valid_until": "2026-04-06T04:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T04:00:50.496Z",
      "x_nadsec_last_seen": "2026-03-05T04:01:04.522Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "38758"
      ],
      "x_nadsec_orgs": [
        "PT. HIPERNET INDODATA"
      ]
    },
    {
      "created": "2026-03-05T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=269999; asn_org=UNIVERSIDAD MARIANA",
      "id": "indicator--84af225d-9ef8-4b82-bb41-676ce463141b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.100.191.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:05:13.000Z",
      "valid_until": "2026-04-06T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T03:47:12.481Z",
      "x_nadsec_last_seen": "2026-03-05T03:49:18.844Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "269999"
      ],
      "x_nadsec_orgs": [
        "UNIVERSIDAD MARIANA"
      ]
    },
    {
      "created": "2026-03-05T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--237e1bc9-bb03-4680-9717-c55ac98b8354",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:05:13.000Z",
      "valid_until": "2026-04-06T04:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T03:47:41.988Z",
      "x_nadsec_last_seen": "2026-03-05T03:47:41.988Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-05T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--cbe6e605-06ac-4fe6-b4c8-caa8d04496f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.93.62.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:05:13.000Z",
      "valid_until": "2026-04-06T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T03:42:24.551Z",
      "x_nadsec_last_seen": "2026-03-05T04:01:02.629Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-05T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--46f8e88e-9cb1-4c7f-a227-cc8a6d646ca5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:05:13.000Z",
      "valid_until": "2026-04-06T04:05:12.000Z",
      "x_nadsec_event_count": 22,
      "x_nadsec_first_seen": "2026-03-05T03:52:49.365Z",
      "x_nadsec_last_seen": "2026-03-25T21:23:10.317Z",
      "x_nadsec_ports": [
        "27017",
        "135",
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "mongod",
        "epmapper",
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-05T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=48642; asn_org=Joint stock company For",
      "id": "indicator--cd524bf6-4f52-428e-b863-7f7bb048a559",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.36.23.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:05:13.000Z",
      "valid_until": "2026-04-06T04:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-05T03:22:40.513Z",
      "x_nadsec_last_seen": "2026-03-05T04:19:36.711Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48642"
      ],
      "x_nadsec_orgs": [
        "Joint stock company For"
      ]
    },
    {
      "created": "2026-03-05T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--c13da072-6565-4ead-9d69-e44ad91e1854",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:05:13.000Z",
      "valid_until": "2026-04-06T04:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T03:05:10.320Z",
      "x_nadsec_last_seen": "2026-03-05T03:05:36.511Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-05T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b8de0a91-3a7e-4dfe-b646-769de1aeb66b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:05:13.000Z",
      "valid_until": "2026-04-06T04:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T03:05:36.173Z",
      "x_nadsec_last_seen": "2026-03-05T03:05:36.173Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--f1c73bf6-310f-4985-ae58-144547d91578",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.139.47.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 3154,
      "x_nadsec_first_seen": "2026-03-05T04:56:04.239Z",
      "x_nadsec_last_seen": "2026-03-05T05:34:36.320Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=133676; asn_org=Precious netcom pvt ltd",
      "id": "indicator--2c191e3d-05f8-4a70-b178-4ca3cc6c71c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.248.121.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T05:03:00.005Z",
      "x_nadsec_last_seen": "2026-03-05T05:05:05.816Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133676"
      ],
      "x_nadsec_orgs": [
        "Precious netcom pvt ltd"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--b3925b46-bfbe-4a49-a661-3fa3a393bc93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-05T04:42:29.548Z",
      "x_nadsec_last_seen": "2026-03-16T09:16:05.160Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--f2e1c297-7fb5-466c-a994-4ac4ee7178bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T04:42:33.278Z",
      "x_nadsec_last_seen": "2026-03-16T09:15:36.283Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--e4255cdc-bd7d-4c28-bb1d-af4cf127d6ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T04:41:56.091Z",
      "x_nadsec_last_seen": "2026-03-14T05:56:00.614Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--398366fd-2bf1-4b93-aed7-767e22c1d733",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T04:42:15.399Z",
      "x_nadsec_last_seen": "2026-03-14T05:56:20.949Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--43ce367b-f678-468c-a5b9-499c26a8157c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-05T04:42:04.935Z",
      "x_nadsec_last_seen": "2026-03-16T09:16:11.288Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--2e2cd62e-3d3b-4c70-a8b0-b08999c30d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-05T04:42:24.184Z",
      "x_nadsec_last_seen": "2026-03-16T09:16:10.843Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--536366f5-533f-48e3-9696-da5e6170c275",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-05T04:41:44.222Z",
      "x_nadsec_last_seen": "2026-03-14T05:55:53.216Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--f01b48ad-32a1-4a77-ab41-d7055c4d015a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T04:42:06.661Z",
      "x_nadsec_last_seen": "2026-03-16T09:15:39.745Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--60818349-d469-4c5f-98b2-7465db58f20c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T04:42:13.632Z",
      "x_nadsec_last_seen": "2026-03-16T09:15:57.562Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--46627576-84cd-4786-9c32-daab59e8e57d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-05T04:42:33.728Z",
      "x_nadsec_last_seen": "2026-03-16T09:16:25.395Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--94b91253-23d2-48bd-a05f-f9651e2cc163",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T04:42:01.289Z",
      "x_nadsec_last_seen": "2026-03-16T09:16:27.117Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--9d487fca-d9ee-435d-ace6-f6d3c27ea88e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T04:42:18.864Z",
      "x_nadsec_last_seen": "2026-03-14T05:56:32.973Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--68016460-722c-44e2-84b2-a8f2b9844860",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T04:41:53.168Z",
      "x_nadsec_last_seen": "2026-03-16T09:15:46.667Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--2bd04e6d-33e7-43bb-a069-b4437743e0a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T04:42:17.132Z",
      "x_nadsec_last_seen": "2026-03-14T05:56:04.047Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--fd6d3eac-e257-4ae3-9eb4-3b38f3e73dbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T04:41:59.562Z",
      "x_nadsec_last_seen": "2026-03-16T09:15:44.937Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--d720fe87-37b8-40bd-a5f0-58f51ef0110d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-05T04:42:11.330Z",
      "x_nadsec_last_seen": "2026-03-16T09:16:21.471Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--adcce9ed-1de2-46da-b0a7-d743dd8ba430",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.96.99.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-03-05T04:53:09.623Z",
      "x_nadsec_last_seen": "2026-03-14T15:28:52.875Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--aff37510-7dad-4687-9eb0-a9d0987a432f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.59.108.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T04:43:16.606Z",
      "x_nadsec_last_seen": "2026-03-05T07:31:37.991Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--5a36ac55-41e7-475c-a731-9e383478d466",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.4.176.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T04:29:02.312Z",
      "x_nadsec_last_seen": "2026-03-05T04:31:07.032Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--f90c23b4-e47a-4a2e-b9fa-48a7396d3e1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.154.232.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T05:01:29.324Z",
      "x_nadsec_last_seen": "2026-03-05T05:03:35.362Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--b08291ec-2cba-43e8-9301-9bd1b414f2c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.160.51.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T04:29:24.139Z",
      "x_nadsec_last_seen": "2026-03-05T04:31:29.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=28006; asn_org=CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP",
      "id": "indicator--4cfa0d95-35c1-4254-bbe6-73f40f911ea2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.112.34.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-05T04:19:24.265Z",
      "x_nadsec_last_seen": "2026-03-08T14:49:26.801Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "28006"
      ],
      "x_nadsec_orgs": [
        "CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--a6a170ee-9931-46f2-95a4-40c0382b36e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T04:12:45.396Z",
      "x_nadsec_last_seen": "2026-03-28T14:20:15.532Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--13198fbb-432a-4378-bfc7-29405c24cb6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.92.28.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T04:30:22.392Z",
      "x_nadsec_last_seen": "2026-03-05T04:32:29.300Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10429"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--53b35bf6-11cd-4285-93e2-144dcf803672",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.208.156.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T04:25:18.491Z",
      "x_nadsec_last_seen": "2026-03-05T04:32:27.512Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ac59adf1-9a48-4e61-8946-be96ad55166e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T04:35:21.338Z",
      "x_nadsec_last_seen": "2026-03-30T19:24:58.861Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--b3b507c9-65c2-4f35-9721-5cf4094d5905",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.73.248.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T04:41:53.286Z",
      "x_nadsec_last_seen": "2026-03-05T04:46:24.641Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**; pass(top)=!******x",
      "id": "indicator--7febe249-832a-4a5b-b171-9f5aaf673097",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.97.177.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-05T04:59:22.609Z",
      "x_nadsec_last_seen": "2026-03-05T05:00:23.070Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--91ae114b-8ca1-4a7c-85b3-3bb9e1e0efc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.33.56.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 33,
      "x_nadsec_first_seen": "2026-03-05T04:47:23.736Z",
      "x_nadsec_last_seen": "2026-03-30T21:31:03.905Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--74884359-f99c-417f-8079-2c6950255370",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.116.163.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T04:22:32.813Z",
      "x_nadsec_last_seen": "2026-03-05T04:22:39.387Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--4ab0f263-0fef-4155-932a-1632ba2dcf97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.97.211.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T04:56:08.615Z",
      "x_nadsec_last_seen": "2026-03-05T04:58:13.871Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-05T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--45f18fea-60e6-4248-9aea-b584b4816319",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T05:05:14.000Z",
      "valid_until": "2026-04-06T05:05:13.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T04:19:07.791Z",
      "x_nadsec_last_seen": "2026-03-12T01:56:11.581Z",
      "x_nadsec_ports": [
        "27017",
        "21"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-05T06:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--fc50d238-ea43-436e-94b2-18482c726358",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.173.221.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:05:16.000Z",
      "valid_until": "2026-04-06T06:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T05:55:44.838Z",
      "x_nadsec_last_seen": "2026-03-05T05:57:51.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-05T06:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45528; asn_org=Tikona Infinet Ltd.",
      "id": "indicator--7ffc6e27-83c1-465a-9e0e-42f07a43f877",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.23.185.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:05:16.000Z",
      "valid_until": "2026-04-06T06:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T05:32:20.685Z",
      "x_nadsec_last_seen": "2026-03-05T05:38:47.590Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45528"
      ],
      "x_nadsec_orgs": [
        "Tikona Infinet Ltd."
      ]
    },
    {
      "created": "2026-03-05T06:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=24378; asn_org=Total Access Communication PLC.",
      "id": "indicator--4ec03525-9c49-4e11-a521-73de539dcced",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.46.71.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:05:16.000Z",
      "valid_until": "2026-04-06T06:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T05:34:11.049Z",
      "x_nadsec_last_seen": "2026-03-05T05:40:52.689Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "24378"
      ],
      "x_nadsec_orgs": [
        "Total Access Communication PLC."
      ]
    },
    {
      "created": "2026-03-05T06:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=135139; asn_org=Skylink Fibernet Private Limited",
      "id": "indicator--7620aa2b-b280-47cb-a687-39404bd2f48c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.130.90.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:05:16.000Z",
      "valid_until": "2026-04-06T06:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T05:14:03.514Z",
      "x_nadsec_last_seen": "2026-03-05T05:22:16.311Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135139"
      ],
      "x_nadsec_orgs": [
        "Skylink Fibernet Private Limited"
      ]
    },
    {
      "created": "2026-03-05T06:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133676; asn_org=Precious netcom pvt ltd",
      "id": "indicator--8f623826-33da-48eb-be51-b1edc1dff8f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.226.201.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:05:16.000Z",
      "valid_until": "2026-04-06T06:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T05:14:22.478Z",
      "x_nadsec_last_seen": "2026-03-05T05:16:27.368Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133676"
      ],
      "x_nadsec_orgs": [
        "Precious netcom pvt ltd"
      ]
    },
    {
      "created": "2026-03-05T06:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1134b6ec-9982-40d7-b463-29e74bfecd04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.172.132.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:05:16.000Z",
      "valid_until": "2026-04-06T06:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T05:12:17.911Z",
      "x_nadsec_last_seen": "2026-03-05T05:12:17.911Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-05T06:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--066e8bdd-c4f1-4982-bc88-b0dadcf576d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:05:16.000Z",
      "valid_until": "2026-04-06T06:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T05:09:34.795Z",
      "x_nadsec_last_seen": "2026-03-05T05:09:34.795Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-05T06:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--09bb9485-e859-4b6a-9aac-4020465b7bf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.48.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:05:16.000Z",
      "valid_until": "2026-04-06T06:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T05:53:18.747Z",
      "x_nadsec_last_seen": "2026-03-05T05:53:19.035Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-05T06:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PA; asn=18809; asn_org=Cable Onda",
      "id": "indicator--b5068743-f98c-4bb0-ba40-c6aae7e6ba42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.46.22.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:05:16.000Z",
      "valid_until": "2026-04-06T06:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T05:35:37.409Z",
      "x_nadsec_last_seen": "2026-03-05T05:37:43.872Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PA"
      ],
      "x_nadsec_asns": [
        "18809"
      ],
      "x_nadsec_orgs": [
        "Cable Onda"
      ]
    },
    {
      "created": "2026-03-05T06:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--436d91cf-1320-47bc-86c0-bc9b00b90ef8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.175.72.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:05:16.000Z",
      "valid_until": "2026-04-06T06:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T05:49:00.172Z",
      "x_nadsec_last_seen": "2026-03-05T05:51:06.231Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-05T06:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--c1261704-0009-4127-92a5-a9bfc9c5ef1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.133.64.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:05:16.000Z",
      "valid_until": "2026-04-06T06:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T05:16:44.697Z",
      "x_nadsec_last_seen": "2026-03-05T05:18:50.102Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-05T06:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=12091; asn_org=MTNNS-1",
      "id": "indicator--e721ad00-303e-4943-abe1-a9b9211cd089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.113.7.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:05:16.000Z",
      "valid_until": "2026-04-06T06:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T05:54:17.835Z",
      "x_nadsec_last_seen": "2026-03-05T05:56:25.847Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "12091"
      ],
      "x_nadsec_orgs": [
        "MTNNS-1"
      ]
    },
    {
      "created": "2026-03-05T06:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--bbe9e1a0-ae0e-4835-8311-56a1f5f2e588",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T06:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.49.78.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:05:16.000Z",
      "valid_until": "2026-04-06T06:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T05:36:04.224Z",
      "x_nadsec_last_seen": "2026-03-05T05:40:17.537Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-05T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=137143; asn_org=Minnal Digital Network Private Limited",
      "id": "indicator--e1b31de5-e9d0-4d8d-9741-4f175950d88c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.105.43.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:05:14.000Z",
      "valid_until": "2026-04-06T07:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T06:15:40.973Z",
      "x_nadsec_last_seen": "2026-03-05T06:17:45.505Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "137143"
      ],
      "x_nadsec_orgs": [
        "Minnal Digital Network Private Limited"
      ]
    },
    {
      "created": "2026-03-05T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=149199; asn_org=Orange Technology Management",
      "id": "indicator--aa6cb11e-ab33-4f0c-8fc2-a4ff42741ac8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.178.44.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:05:14.000Z",
      "valid_until": "2026-04-06T07:05:13.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T06:14:39.668Z",
      "x_nadsec_last_seen": "2026-03-05T06:15:05.946Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "149199"
      ],
      "x_nadsec_orgs": [
        "Orange Technology Management"
      ]
    },
    {
      "created": "2026-03-05T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2ca75fb2-e7d5-4537-8237-aeb149981d9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.209.181.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:05:14.000Z",
      "valid_until": "2026-04-06T07:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T06:22:13.172Z",
      "x_nadsec_last_seen": "2026-03-05T06:22:13.172Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-05T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=139490; asn_org=Aspt Networks Pvt Ltd",
      "id": "indicator--2ca0206d-852a-4ddb-b316-d197fa8e40cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.192.13.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:05:14.000Z",
      "valid_until": "2026-04-06T07:05:13.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T06:17:04.660Z",
      "x_nadsec_last_seen": "2026-03-05T06:23:27.916Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "139490"
      ],
      "x_nadsec_orgs": [
        "Aspt Networks Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-05T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--11588082-e885-480c-92cd-5826ce52871b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.2.108.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:05:14.000Z",
      "valid_until": "2026-04-06T07:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T06:56:56.659Z",
      "x_nadsec_last_seen": "2026-03-05T06:59:04.000Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-03-05T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=39442; asn_org=JSC RDE Unico",
      "id": "indicator--110c1e7a-9038-4878-ae64-f75795493fdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.247.43.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:05:14.000Z",
      "valid_until": "2026-04-06T07:05:13.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T06:46:01.622Z",
      "x_nadsec_last_seen": "2026-03-05T06:53:50.354Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "39442"
      ],
      "x_nadsec_orgs": [
        "JSC RDE Unico"
      ]
    },
    {
      "created": "2026-03-05T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--d1b8f976-4c10-45ff-a65e-fe1351b5298a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.248.153.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:05:14.000Z",
      "valid_until": "2026-04-06T07:05:13.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T06:40:44.738Z",
      "x_nadsec_last_seen": "2026-03-21T11:09:52.246Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-05T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom; user(top)=**",
      "id": "indicator--f365d29b-da72-4f19-99ac-a51b9bcdcf37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.174.41.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:05:14.000Z",
      "valid_until": "2026-04-06T07:05:13.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T06:31:19.600Z",
      "x_nadsec_last_seen": "2026-03-14T01:51:16.997Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-05T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=8720; asn_org=Aspan telecom",
      "id": "indicator--803668c3-f5aa-4b6e-9d9b-4ce8351e6bcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.11.77.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:05:14.000Z",
      "valid_until": "2026-04-06T07:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T06:36:10.419Z",
      "x_nadsec_last_seen": "2026-03-05T06:38:17.703Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "8720"
      ],
      "x_nadsec_orgs": [
        "Aspan telecom"
      ]
    },
    {
      "created": "2026-03-05T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--c2edf3b5-a58a-445c-b156-4ee7eaa444b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:05:14.000Z",
      "valid_until": "2026-04-06T07:05:13.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-05T06:45:50.495Z",
      "x_nadsec_last_seen": "2026-03-15T22:05:06.584Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-05T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--b1c39a75-97bb-404d-88ad-d794975f4039",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.23.151.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:05:14.000Z",
      "valid_until": "2026-04-06T07:05:13.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T06:28:51.443Z",
      "x_nadsec_last_seen": "2026-03-05T06:30:03.304Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=58495; asn_org=PT Parsaoran Global Datatrans",
      "id": "indicator--e4087f08-ead8-4634-8435-c48ff97e01fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.137.65.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-05T07:05:16.645Z",
      "x_nadsec_last_seen": "2026-03-10T05:17:22.898Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "58495"
      ],
      "x_nadsec_orgs": [
        "PT Parsaoran Global Datatrans"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--dfb606d6-d339-44a8-86d4-75b541017dbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.138.53.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T07:09:47.825Z",
      "x_nadsec_last_seen": "2026-03-05T07:16:13.349Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--1396fcf5-a3b4-45ef-9a69-51e880e994e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.172.155.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T07:58:43.489Z",
      "x_nadsec_last_seen": "2026-03-05T08:00:48.135Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--7bb64dc1-f758-4006-9477-73ba2153cd17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.99.54.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T07:30:38.727Z",
      "x_nadsec_last_seen": "2026-03-05T07:32:44.002Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.",
      "id": "indicator--5fae13dd-05ff-4ad4-9eca-4018783b72bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.244.102.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T07:08:01.162Z",
      "x_nadsec_last_seen": "2026-03-05T07:10:05.769Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11172"
      ],
      "x_nadsec_orgs": [
        "Alestra, S. de R.L. de C.V."
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--51ddb591-92e7-427a-acc0-a989b56c957b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T07:34:39.749Z",
      "x_nadsec_last_seen": "2026-03-05T07:34:39.749Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262604; asn_org=Click.com telecomunicacoes ltda-me",
      "id": "indicator--41251f73-c685-4030-91a0-9b31a99485b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.101.5.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-05T07:52:16.060Z",
      "x_nadsec_last_seen": "2026-03-16T07:08:51.623Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262604"
      ],
      "x_nadsec_orgs": [
        "Click.com telecomunicacoes ltda-me"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--9c9fd80c-2193-4ebf-bd19-37726961653b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.108.74.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T07:22:17.501Z",
      "x_nadsec_last_seen": "2026-03-05T07:24:24.757Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10429"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--3bc25380-ea6f-4564-813c-e6bbca973c36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.112.150.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T07:36:34.682Z",
      "x_nadsec_last_seen": "2026-03-05T07:38:41.703Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--731bdb5c-9b99-4fa8-a378-73d7cd721c84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.210.240.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 21,
      "x_nadsec_first_seen": "2026-03-05T08:02:13.240Z",
      "x_nadsec_last_seen": "2026-03-12T16:55:31.410Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=24203; asn_org=PT XL Axiata",
      "id": "indicator--8edd2aac-4b91-4b02-b081-9b7ded94d7e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.78.114.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-05T07:59:57.871Z",
      "x_nadsec_last_seen": "2026-03-05T09:04:36.686Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "24203"
      ],
      "x_nadsec_orgs": [
        "PT XL Axiata"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133982; asn_org=Excitel Broadband Private Limited",
      "id": "indicator--5e78ed2e-8ae4-4be1-b275-097fc3dd5b9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.254.168.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T07:28:32.606Z",
      "x_nadsec_last_seen": "2026-03-05T07:30:38.226Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133982"
      ],
      "x_nadsec_orgs": [
        "Excitel Broadband Private Limited"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=137689; asn_org=IOT Jiangsu network, Chinatelecom, P.R.China.",
      "id": "indicator--109dbac5-dbe0-4e55-845a-da24ed8422ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.113.29.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T07:19:11.215Z",
      "x_nadsec_last_seen": "2026-03-05T07:19:11.215Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "137689"
      ],
      "x_nadsec_orgs": [
        "IOT Jiangsu network, Chinatelecom, P.R.China."
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--19a174a7-f5c4-48a4-a78e-89558f36519d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.186.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T07:50:10.709Z",
      "x_nadsec_last_seen": "2026-03-05T07:50:11.356Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=267185; asn_org=CCS Camboriu Cable System de Telecomunicacoes Ltda",
      "id": "indicator--74b70563-02cd-41c4-ab24-7c957bbac0ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.231.0.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T07:38:39.881Z",
      "x_nadsec_last_seen": "2026-03-05T07:38:39.881Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "267185"
      ],
      "x_nadsec_orgs": [
        "CCS Camboriu Cable System de Telecomunicacoes Ltda"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T07:35:50.205Z",
      "x_nadsec_last_seen": "2026-03-23T12:00:27.134Z",
      "x_nadsec_ports": [
        "445",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--8eab59b0-51aa-4d07-ae8a-be1ce3e09da8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.102.61.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T07:16:45.532Z",
      "x_nadsec_last_seen": "2026-03-05T07:18:52.711Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e0bf7e6c-01b7-4f0f-b931-b4867263d071",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T07:11:01.473Z",
      "x_nadsec_last_seen": "2026-03-05T07:11:01.473Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--0381d58a-c5ef-486d-a139-cc1c9f53ba93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T07:11:01.219Z",
      "x_nadsec_last_seen": "2026-03-05T07:11:01.219Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-05T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1218; services=smbd; ports=445; cc=TR; asn=12735; asn_org=TurkNet Iletisim Hizmetleri A.S.",
      "id": "indicator--1e037645-95f7-4372-b89b-2ae7bd6e8af3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.70.212.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:05:13.000Z",
      "valid_until": "2026-04-06T08:05:12.000Z",
      "x_nadsec_event_count": 3151,
      "x_nadsec_first_seen": "2026-03-05T07:11:04.217Z",
      "x_nadsec_last_seen": "2026-03-05T08:33:45.122Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "12735"
      ],
      "x_nadsec_orgs": [
        "TurkNet Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-05T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=151164; asn_org=Wireline Communication India Private Limited",
      "id": "indicator--a84c70d3-d520-4290-848a-ee3e0bb0f8c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.115.236.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T09:05:02.000Z",
      "valid_until": "2026-04-06T09:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-05T08:51:11.740Z",
      "x_nadsec_last_seen": "2026-03-28T11:25:16.818Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151164"
      ],
      "x_nadsec_orgs": [
        "Wireline Communication India Private Limited"
      ]
    },
    {
      "created": "2026-03-05T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=LA; asn=9873; asn_org=Lao Telecom Communication, LTC",
      "id": "indicator--e535b379-e62c-4c77-a1b6-0531fb529087",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.43.78.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T09:05:02.000Z",
      "valid_until": "2026-04-06T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T08:49:28.594Z",
      "x_nadsec_last_seen": "2026-03-05T08:55:56.568Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "9873"
      ],
      "x_nadsec_orgs": [
        "Lao Telecom Communication, LTC"
      ]
    },
    {
      "created": "2026-03-05T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5593d710-3abf-40d1-b5b0-227568c08c84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.25.21.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T09:05:02.000Z",
      "valid_until": "2026-04-06T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T08:16:32.475Z",
      "x_nadsec_last_seen": "2026-03-05T08:22:51.734Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-05T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5c561027-df47-4220-baaa-3f6a3b8de87f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T09:05:02.000Z",
      "valid_until": "2026-04-06T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T08:50:15.801Z",
      "x_nadsec_last_seen": "2026-03-14T17:58:29.883Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-05T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--33e74a66-7223-4fdb-9e70-86a7a5b87796",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T09:05:02.000Z",
      "valid_until": "2026-04-06T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T08:23:03.475Z",
      "x_nadsec_last_seen": "2026-03-15T16:06:00.339Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-05T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--4238a030-9902-44e1-9b20-ab8f852243b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T09:05:02.000Z",
      "valid_until": "2026-04-06T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T08:36:01.672Z",
      "x_nadsec_last_seen": "2026-03-13T22:27:54.576Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-05T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KZ; asn=60757; asn_org=Optinet LLP; user(top)=**",
      "id": "indicator--2a709429-711d-41c3-aeb4-88d85b2336cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.217.188.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T09:05:02.000Z",
      "valid_until": "2026-04-06T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T08:33:50.245Z",
      "x_nadsec_last_seen": "2026-03-17T02:44:18.934Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "60757"
      ],
      "x_nadsec_orgs": [
        "Optinet LLP"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-05T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--d524de20-e8b8-4043-b1a9-fa6397867db4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.79.127.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T09:05:02.000Z",
      "valid_until": "2026-04-06T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T08:37:27.316Z",
      "x_nadsec_last_seen": "2026-03-05T08:39:31.905Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-05T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GR; asn=6799; asn_org=OTEnet S.A.",
      "id": "indicator--52853767-0579-4c34-ab00-1ad7d9afed84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.235.189.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T09:05:02.000Z",
      "valid_until": "2026-04-06T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T08:41:10.615Z",
      "x_nadsec_last_seen": "2026-03-05T08:43:17.038Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GR"
      ],
      "x_nadsec_asns": [
        "6799"
      ],
      "x_nadsec_orgs": [
        "OTEnet S.A."
      ]
    },
    {
      "created": "2026-03-05T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25490; asn_org=Rostelecom",
      "id": "indicator--b0835c56-efa1-474a-b106-583d1e078fb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.239.79.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T09:05:02.000Z",
      "valid_until": "2026-04-06T09:05:01.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-03-05T08:38:48.902Z",
      "x_nadsec_last_seen": "2026-03-16T21:33:32.475Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25490"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-05T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--e94f1be8-c0fd-4313-9643-f5e131e75042",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.20.189.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:05:06.000Z",
      "valid_until": "2026-04-06T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T09:10:12.949Z",
      "x_nadsec_last_seen": "2026-03-05T09:12:18.776Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-05T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45916; asn_org=Gujarat Telelink Pvt Ltd",
      "id": "indicator--6106cd1c-44e1-432e-a039-398dd3592073",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '150.129.55.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:05:06.000Z",
      "valid_until": "2026-04-06T10:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T09:16:21.803Z",
      "x_nadsec_last_seen": "2026-03-05T09:16:21.803Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45916"
      ],
      "x_nadsec_orgs": [
        "Gujarat Telelink Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-05T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=GB; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--9b75d0b9-5229-4200-bd16-0deb2a202316",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.83.200.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:05:06.000Z",
      "valid_until": "2026-04-06T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T09:12:35.314Z",
      "x_nadsec_last_seen": "2026-03-25T15:20:44.277Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-03-05T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--a6389bb2-88b0-48f7-83f1-f8362b5b3d07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.180.59.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:05:06.000Z",
      "valid_until": "2026-04-06T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T09:23:37.314Z",
      "x_nadsec_last_seen": "2026-03-05T09:25:43.328Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-05T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--5e5db6aa-0012-4fc6-9fca-758ab155d7fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.88.219.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:05:06.000Z",
      "valid_until": "2026-04-06T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T09:28:47.290Z",
      "x_nadsec_last_seen": "2026-03-05T09:30:51.687Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-05T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=FR; asn=34177; asn_org=Celeste SAS",
      "id": "indicator--60fa3c33-100d-47e8-a520-7e6aa7a4b007",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.156.80.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:05:06.000Z",
      "valid_until": "2026-04-06T10:05:05.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-03-05T09:05:00.511Z",
      "x_nadsec_last_seen": "2026-03-12T19:02:03.116Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "34177"
      ],
      "x_nadsec_orgs": [
        "Celeste SAS"
      ]
    },
    {
      "created": "2026-03-05T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--8693a98e-6c65-4a82-a86a-0f4a40fb146f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.196.220.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:05:06.000Z",
      "valid_until": "2026-04-06T10:05:05.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-05T09:42:37.267Z",
      "x_nadsec_last_seen": "2026-03-23T11:43:05.153Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "42",
        "38823"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-03-05T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--15013f2c-9781-44f2-9d58-5beece3d36ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.224.188.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:05:06.000Z",
      "valid_until": "2026-04-06T10:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T09:46:36.433Z",
      "x_nadsec_last_seen": "2026-03-05T09:46:36.468Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-05T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--dc079bd3-847e-4b5c-a981-fc5b9cbdd94c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.134.174.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:05:06.000Z",
      "valid_until": "2026-04-06T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T09:25:22.616Z",
      "x_nadsec_last_seen": "2026-03-05T09:27:28.972Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-05T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6f786cb9-70a4-47eb-a3a4-0d6a761c6fe2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.106.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:05:06.000Z",
      "valid_until": "2026-04-06T10:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T09:15:11.584Z",
      "x_nadsec_last_seen": "2026-03-05T09:15:11.584Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-05T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=32475; asn_org=Internap Holding LLC",
      "id": "indicator--db1329b7-2e14-4a8e-a68a-c60ba5107d00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:05:06.000Z",
      "valid_until": "2026-04-06T10:05:05.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-05T09:57:08.134Z",
      "x_nadsec_last_seen": "2026-03-25T22:10:55.721Z",
      "x_nadsec_ports": [
        "135",
        "21",
        "1433",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mongod",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32475"
      ],
      "x_nadsec_orgs": [
        "Internap Holding LLC"
      ]
    },
    {
      "created": "2026-03-05T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--c9dcbb07-79f1-453d-8248-8d35904f64ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.216.183.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:05:06.000Z",
      "valid_until": "2026-04-06T10:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T09:11:42.888Z",
      "x_nadsec_last_seen": "2026-03-05T09:11:42.888Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-05T10:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--4c4c683a-518f-4dc2-99a6-e63b4617f343",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T10:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.120.238.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T10:05:06.000Z",
      "valid_until": "2026-04-06T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T10:00:46.212Z",
      "x_nadsec_last_seen": "2026-03-05T10:02:52.843Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=150008; asn_org=Pioneer Elabs Ltd.",
      "id": "indicator--31467423-0728-447a-9d95-41757719f4d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.122.61.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T10:20:48.272Z",
      "x_nadsec_last_seen": "2026-03-05T10:27:24.846Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "150008"
      ],
      "x_nadsec_orgs": [
        "Pioneer Elabs Ltd."
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--640ebcde-ad1b-4654-96e6-141cd9d43d8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.219.71.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-03-05T10:13:41.826Z",
      "x_nadsec_last_seen": "2026-03-14T11:36:37.750Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c12addf9-5a60-4ae0-b8e8-347be4262fd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.168.109.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T10:14:08.267Z",
      "x_nadsec_last_seen": "2026-03-05T10:16:13.118Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--617459d2-6f08-4614-9180-7dc5f727160f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.186.238.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-05T10:26:45.680Z",
      "x_nadsec_last_seen": "2026-03-11T06:31:32.767Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--29560c19-d88f-4408-8291-f544f87d09a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.250.64.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T10:27:40.335Z",
      "x_nadsec_last_seen": "2026-03-05T10:29:44.385Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HK; asn=134365; asn_org=Ansheng Network Technology Co., Limited",
      "id": "indicator--3e1ea4cd-1a34-4f78-948e-c2fd8b24eb69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.194.251.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T10:08:28.756Z",
      "x_nadsec_last_seen": "2026-03-05T10:08:28.826Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "134365"
      ],
      "x_nadsec_orgs": [
        "Ansheng Network Technology Co., Limited"
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=150008; asn_org=Pioneer Elabs Ltd.",
      "id": "indicator--cecffea4-91c6-4cea-a2c1-8c5416ace3ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.206.18.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T10:25:21.013Z",
      "x_nadsec_last_seen": "2026-03-05T10:27:25.620Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "150008"
      ],
      "x_nadsec_orgs": [
        "Pioneer Elabs Ltd."
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a69132ed-4c88-4b36-bf47-43738cdfd00b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.47.41.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-05T10:20:30.330Z",
      "x_nadsec_last_seen": "2026-03-26T08:50:48.582Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--644e3797-b71f-46c0-9b2b-669634a9ec9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.246.92.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 3146,
      "x_nadsec_first_seen": "2026-03-05T10:07:50.843Z",
      "x_nadsec_last_seen": "2026-03-05T15:00:48.370Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--3c2ae1dd-552e-40c9-8580-06054092b120",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.130.134.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-03-05T10:31:36.518Z",
      "x_nadsec_last_seen": "2026-03-05T10:34:23.828Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CZ; asn=25424; asn_org=CEZNET s.r.o.",
      "id": "indicator--c88b5002-0b7b-4d0d-b5f2-3319a5a0906f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.111.4.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T10:36:51.235Z",
      "x_nadsec_last_seen": "2026-03-05T10:36:58.680Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CZ"
      ],
      "x_nadsec_asns": [
        "25424"
      ],
      "x_nadsec_orgs": [
        "CEZNET s.r.o."
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--67a7682e-4093-4d2c-a7eb-e0300df34962",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.49.72.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T10:24:06.176Z",
      "x_nadsec_last_seen": "2026-03-05T10:26:10.546Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UA; asn=34700; asn_org=Maxnet Telecom, Ltd",
      "id": "indicator--7e0b2fd4-aa26-43b0-bf93-8d1396e9dfe1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.202.171.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T10:58:34.525Z",
      "x_nadsec_last_seen": "2026-03-05T11:00:43.943Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "34700"
      ],
      "x_nadsec_orgs": [
        "Maxnet Telecom, Ltd"
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=11845; asn_org=Vox-Telecom",
      "id": "indicator--0fb05c68-0f49-4b51-a701-4c41e9bb3351",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.193.171.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T10:12:04.500Z",
      "x_nadsec_last_seen": "2026-03-05T10:14:12.622Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "11845"
      ],
      "x_nadsec_orgs": [
        "Vox-Telecom"
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=271254; asn_org=ME TELECOM SERVICOS DE INTERNET LTDA",
      "id": "indicator--ee9138be-47c3-4189-92e6-557e40855691",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.232.87.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-05T10:30:36.000Z",
      "x_nadsec_last_seen": "2026-03-09T17:50:34.558Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "271254"
      ],
      "x_nadsec_orgs": [
        "ME TELECOM SERVICOS DE INTERNET LTDA"
      ]
    },
    {
      "created": "2026-03-05T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--15f20a79-1225-4330-ab36-8ec6b82f24d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '8.209.96.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:05:13.000Z",
      "valid_until": "2026-04-06T11:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T10:47:00.592Z",
      "x_nadsec_last_seen": "2026-03-05T10:47:00.592Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-05T12:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=56042; asn_org=China Mobile communications corporation",
      "id": "indicator--f0e1988f-2902-4cd7-af5b-cd64e3efd2e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.53.86.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:05:01.000Z",
      "valid_until": "2026-04-06T12:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T11:07:18.441Z",
      "x_nadsec_last_seen": "2026-03-05T11:07:18.441Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56042"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-03-05T12:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45769; asn_org=D-Vois Broadband Pvt Ltd",
      "id": "indicator--c715ccda-ee88-48f1-a000-9f2f96794c74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.48.206.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:05:01.000Z",
      "valid_until": "2026-04-06T12:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T11:09:26.129Z",
      "x_nadsec_last_seen": "2026-03-05T11:16:10.458Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45769"
      ],
      "x_nadsec_orgs": [
        "D-Vois Broadband Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-05T12:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--04fea1e9-03de-4f8a-b35c-85e0903a7296",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.83.176.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:05:01.000Z",
      "valid_until": "2026-04-06T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T12:01:15.347Z",
      "x_nadsec_last_seen": "2026-03-05T12:03:21.120Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-05T12:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DE; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--4f743586-e7a1-4c70-a5f4-83b17fb3c7a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.142.147.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:05:01.000Z",
      "valid_until": "2026-04-06T12:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T12:01:40.670Z",
      "x_nadsec_last_seen": "2026-03-06T01:49:13.251Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-03-05T12:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DE; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--d5812f57-fa1f-4724-89ca-889d0a27cb58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.142.147.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:05:01.000Z",
      "valid_until": "2026-04-06T12:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T11:51:20.565Z",
      "x_nadsec_last_seen": "2026-03-06T01:30:20.839Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-03-05T12:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=24203; asn_org=PT XL Axiata",
      "id": "indicator--b7585de6-b86f-46db-ac4a-a04312f614ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.78.114.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:05:01.000Z",
      "valid_until": "2026-04-06T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T11:35:24.545Z",
      "x_nadsec_last_seen": "2026-03-05T11:37:30.612Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "24203"
      ],
      "x_nadsec_orgs": [
        "PT XL Axiata"
      ]
    },
    {
      "created": "2026-03-05T12:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--61d314e1-2539-4de0-9250-10aeb3067170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.248.120.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:05:01.000Z",
      "valid_until": "2026-04-06T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T11:27:12.845Z",
      "x_nadsec_last_seen": "2026-03-05T11:29:19.691Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-03-05T12:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MG; asn=37037; asn_org=Orange Madagascar; user(top)=**",
      "id": "indicator--9bcb2f05-0c4d-4bc1-96d5-5d191d4dc5b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.63.156.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:05:01.000Z",
      "valid_until": "2026-04-06T12:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T11:29:04.710Z",
      "x_nadsec_last_seen": "2026-03-11T19:10:05.962Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MG"
      ],
      "x_nadsec_asns": [
        "37037"
      ],
      "x_nadsec_orgs": [
        "Orange Madagascar"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-05T12:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--00920327-b599-428c-a027-56ed02955d99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:05:01.000Z",
      "valid_until": "2026-04-06T12:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-05T11:55:26.757Z",
      "x_nadsec_last_seen": "2026-03-29T14:53:20.292Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "135",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "ftpd",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-05T12:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:05:01.000Z",
      "valid_until": "2026-04-06T12:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T12:01:54.084Z",
      "x_nadsec_last_seen": "2026-03-19T12:23:09.152Z",
      "x_nadsec_ports": [
        "445",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-05T12:05:01.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--cd34d225-1e6a-4d1c-95be-4e4d596541ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T12:05:01.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.59.161.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:05:01.000Z",
      "valid_until": "2026-04-06T12:05:00.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-03-05T11:45:16.091Z",
      "x_nadsec_last_seen": "2026-03-22T12:56:36.536Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-05T13:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=36873; asn_org=Celtel Nigeria Limited t.a ZAIN",
      "id": "indicator--457db42a-0424-4907-b039-46ebacdaebc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T13:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.112.208.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:05:07.000Z",
      "valid_until": "2026-04-06T13:05:06.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T12:47:16.584Z",
      "x_nadsec_last_seen": "2026-03-05T12:55:00.887Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "36873"
      ],
      "x_nadsec_orgs": [
        "Celtel Nigeria Limited t.a ZAIN"
      ]
    },
    {
      "created": "2026-03-05T13:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--eef76060-ad83-4b20-93e4-3c27ff2c090c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T13:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.161.30.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:05:07.000Z",
      "valid_until": "2026-04-06T13:05:06.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-05T12:33:31.873Z",
      "x_nadsec_last_seen": "2026-03-14T03:08:53.636Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-05T13:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DE; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--a902d64a-faac-4ffe-b152-d201b4f56b43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T13:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.142.147.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:05:07.000Z",
      "valid_until": "2026-04-06T13:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T12:21:51.645Z",
      "x_nadsec_last_seen": "2026-03-06T02:08:56.541Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-03-05T13:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DE; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--4c590774-1287-49d7-a9e6-111714545876",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T13:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.142.147.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:05:07.000Z",
      "valid_until": "2026-04-06T13:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T12:13:23.035Z",
      "x_nadsec_last_seen": "2026-03-06T06:24:59.725Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-03-05T13:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--2686ae04-abe8-4e9a-b1e4-f717c1530aef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T13:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.231.48.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:05:07.000Z",
      "valid_until": "2026-04-06T13:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T12:55:41.549Z",
      "x_nadsec_last_seen": "2026-03-05T12:55:48.485Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-03-05T13:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--116cd9c2-43ef-4ad9-abcf-ba0bc11dff70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T13:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.176.2.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:05:07.000Z",
      "valid_until": "2026-04-06T13:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T12:17:16.504Z",
      "x_nadsec_last_seen": "2026-03-05T12:19:21.450Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24186"
      ],
      "x_nadsec_orgs": [
        "RailTel Corporation of India Ltd"
      ]
    },
    {
      "created": "2026-03-05T13:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MN; asn=24320; asn_org=Commercial Center",
      "id": "indicator--99b3ae11-e348-4a3b-a85f-3e8963a024df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T13:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.72.243.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:05:07.000Z",
      "valid_until": "2026-04-06T13:05:06.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T12:35:00.999Z",
      "x_nadsec_last_seen": "2026-03-05T12:42:22.215Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "24320"
      ],
      "x_nadsec_orgs": [
        "Commercial Center"
      ]
    },
    {
      "created": "2026-03-05T13:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--95ff4f15-9ef3-4454-834e-67f309826ceb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T13:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '209.38.235.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:05:07.000Z",
      "valid_until": "2026-04-06T13:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T12:24:09.295Z",
      "x_nadsec_last_seen": "2026-03-05T12:24:12.603Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-05T13:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--9899701d-5591-4db8-97de-7523a3b54096",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T13:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:05:07.000Z",
      "valid_until": "2026-04-06T13:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T12:16:13.277Z",
      "x_nadsec_last_seen": "2026-03-05T12:16:13.277Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-05T13:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--4b6b9cd0-7cc0-4cd5-aedb-0902a76cef58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T13:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.250.246.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:05:07.000Z",
      "valid_until": "2026-04-06T13:05:06.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-05T12:57:06.041Z",
      "x_nadsec_last_seen": "2026-03-13T13:24:52.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-05T13:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T13:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:05:07.000Z",
      "valid_until": "2026-04-06T13:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T12:25:36.381Z",
      "x_nadsec_last_seen": "2026-03-08T14:55:37.640Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-05T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--76bb19c0-3352-4f15-b7be-223a8e2f57f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.88.112.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:05:13.000Z",
      "valid_until": "2026-04-06T15:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T14:49:23.231Z",
      "x_nadsec_last_seen": "2026-03-05T14:57:14.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-05T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=136969; asn_org=KK Networks Pvt Ltd.",
      "id": "indicator--22a12a9d-0080-4e1a-909c-9db9b001c526",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.12.197.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:05:13.000Z",
      "valid_until": "2026-04-06T15:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T14:42:03.541Z",
      "x_nadsec_last_seen": "2026-03-05T14:44:09.853Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "136969"
      ],
      "x_nadsec_orgs": [
        "KK Networks Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-05T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NL; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--95025079-06a8-4dcb-bb8f-0958e45f4737",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.196.220.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:05:13.000Z",
      "valid_until": "2026-04-06T15:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T14:13:39.273Z",
      "x_nadsec_last_seen": "2026-03-06T03:30:39.548Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-03-05T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4695ab49-ae4f-4dcc-819f-50a2db823fe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.51.245.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:05:13.000Z",
      "valid_until": "2026-04-06T15:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T14:14:32.239Z",
      "x_nadsec_last_seen": "2026-03-13T13:56:58.851Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-05T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--fe4d56ce-8abd-4ba5-9149-8a28c02c4e05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.71.171.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:05:13.000Z",
      "valid_until": "2026-04-06T15:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T14:50:27.247Z",
      "x_nadsec_last_seen": "2026-03-05T14:52:32.140Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-05T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=SN; asn=37196; asn_org=SUDATEL-SENEGAL",
      "id": "indicator--f4b9d443-8238-4f8a-bb24-9bdd9cd08188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.219.61.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:05:13.000Z",
      "valid_until": "2026-04-06T15:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T14:28:08.951Z",
      "x_nadsec_last_seen": "2026-03-05T14:36:06.290Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SN"
      ],
      "x_nadsec_asns": [
        "37196"
      ],
      "x_nadsec_orgs": [
        "SUDATEL-SENEGAL"
      ]
    },
    {
      "created": "2026-03-05T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BG; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--46716047-d6b8-4b44-9f5f-9b6441776a53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.8.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T15:05:13.000Z",
      "valid_until": "2026-04-06T15:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T14:25:39.541Z",
      "x_nadsec_last_seen": "2026-03-06T03:35:21.306Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-03-05T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=141148; asn_org=MYBHARAT NET PRIVATE LIMITED",
      "id": "indicator--b31fc539-340a-4f50-86ea-e8d6025df4de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.61.72.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:05:07.000Z",
      "valid_until": "2026-04-06T16:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T15:36:43.653Z",
      "x_nadsec_last_seen": "2026-03-05T15:36:43.953Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141148"
      ],
      "x_nadsec_orgs": [
        "MYBHARAT NET PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-05T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f4dfe12b-affc-4b32-b38c-07f4944feb5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:05:07.000Z",
      "valid_until": "2026-04-06T16:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T15:32:30.273Z",
      "x_nadsec_last_seen": "2026-03-10T19:42:30.457Z",
      "x_nadsec_ports": [
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-05T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262468; asn_org=Natel Telecom Ltda. - ME",
      "id": "indicator--8ab9b58f-d723-45ff-ba66-3faf2d6b6e54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.53.147.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:05:07.000Z",
      "valid_until": "2026-04-06T16:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T15:34:31.797Z",
      "x_nadsec_last_seen": "2026-03-05T15:36:38.008Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262468"
      ],
      "x_nadsec_orgs": [
        "Natel Telecom Ltda. - ME"
      ]
    },
    {
      "created": "2026-03-05T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--b9e063ed-f427-4f54-85b1-46f6f632f5b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.176.108.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:05:07.000Z",
      "valid_until": "2026-04-06T16:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T15:10:50.612Z",
      "x_nadsec_last_seen": "2026-03-05T15:12:57.965Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-05T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--d326ad50-b15d-44b6-ac38-009061f54392",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.131.48.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:05:07.000Z",
      "valid_until": "2026-04-06T16:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T15:19:57.205Z",
      "x_nadsec_last_seen": "2026-03-05T15:19:57.481Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-05T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--9e2165c3-6c74-4801-8dd6-fe2138f8e20f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.178.97.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:05:07.000Z",
      "valid_until": "2026-04-06T16:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T15:58:07.851Z",
      "x_nadsec_last_seen": "2026-03-05T16:04:54.453Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-05T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=37148; asn_org=globacom-as",
      "id": "indicator--e277d942-4bcd-4d32-9075-372073042b2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.211.63.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:05:07.000Z",
      "valid_until": "2026-04-06T16:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T15:46:19.454Z",
      "x_nadsec_last_seen": "2026-03-05T15:48:26.285Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37148"
      ],
      "x_nadsec_orgs": [
        "globacom-as"
      ]
    },
    {
      "created": "2026-03-05T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4514c081-6ed2-4ea1-8d82-24ce481cfef7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:05:07.000Z",
      "valid_until": "2026-04-06T16:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T15:05:16.770Z",
      "x_nadsec_last_seen": "2026-03-29T17:42:00.609Z",
      "x_nadsec_ports": [
        "1433",
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "mssqld",
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-05T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=9484; asn_org=Mobinet LLC. AS Mobinet Internet Service Provider",
      "id": "indicator--54e024fc-5f8a-4c26-81c4-1bff306ab8ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.131.242.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:05:07.000Z",
      "valid_until": "2026-04-06T16:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T15:08:46.204Z",
      "x_nadsec_last_seen": "2026-03-05T15:10:52.989Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "9484"
      ],
      "x_nadsec_orgs": [
        "Mobinet LLC. AS Mobinet Internet Service Provider"
      ]
    },
    {
      "created": "2026-03-05T16:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BG; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--1901706e-f61a-46cf-8693-687a1203bafc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T16:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.8.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:05:07.000Z",
      "valid_until": "2026-04-06T16:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T15:55:25.150Z",
      "x_nadsec_last_seen": "2026-03-06T05:34:55.237Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-03-05T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--94ee430a-8bfa-4259-b838-2aa048d801c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.100.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:05:14.000Z",
      "valid_until": "2026-04-06T17:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T16:51:40.320Z",
      "x_nadsec_last_seen": "2026-03-05T16:53:48.390Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-05T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=32475; asn_org=Internap Holding LLC",
      "id": "indicator--d44611ed-e469-4c1a-8178-f6ffe830b310",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '108.178.22.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:05:14.000Z",
      "valid_until": "2026-04-06T17:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T16:34:16.995Z",
      "x_nadsec_last_seen": "2026-03-05T16:34:17.229Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32475"
      ],
      "x_nadsec_orgs": [
        "Internap Holding LLC"
      ]
    },
    {
      "created": "2026-03-05T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--6b5a6e57-fad1-4c90-aa6d-4074fc79c667",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.250.7.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:05:14.000Z",
      "valid_until": "2026-04-06T17:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T16:25:54.996Z",
      "x_nadsec_last_seen": "2026-03-05T16:28:00.168Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-05T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b866de1c-e041-479b-a7da-20e7ed82d218",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.227.77.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:05:14.000Z",
      "valid_until": "2026-04-06T17:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T16:24:04.112Z",
      "x_nadsec_last_seen": "2026-03-05T16:26:12.255Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-05T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9199cb60-9b1d-462d-924e-76a69181ecb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:05:14.000Z",
      "valid_until": "2026-04-06T17:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T16:37:23.188Z",
      "x_nadsec_last_seen": "2026-03-05T16:37:23.511Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-05T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--6de8fa16-e81e-4609-b96f-41b0d495a992",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.126.225.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:05:14.000Z",
      "valid_until": "2026-04-06T17:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T16:37:02.837Z",
      "x_nadsec_last_seen": "2026-03-06T07:07:14.682Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-03-05T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DE; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--613ba6ec-3a3d-4519-ad1f-d48720a3348c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.134.225.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:05:14.000Z",
      "valid_until": "2026-04-06T17:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T16:16:59.152Z",
      "x_nadsec_last_seen": "2026-03-06T05:56:25.884Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-03-05T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=3356; asn_org=Level 3 Parent, LLC",
      "id": "indicator--57d11827-03f4-4273-98b8-b9a51aca24d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '50.59.99.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:05:14.000Z",
      "valid_until": "2026-04-06T17:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T16:57:52.582Z",
      "x_nadsec_last_seen": "2026-03-05T17:04:25.824Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "3356"
      ],
      "x_nadsec_orgs": [
        "Level 3 Parent, LLC"
      ]
    },
    {
      "created": "2026-03-05T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.",
      "id": "indicator--a7319f0b-2d96-4313-be65-71ef67793a4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.244.199.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:05:14.000Z",
      "valid_until": "2026-04-06T17:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T16:11:19.685Z",
      "x_nadsec_last_seen": "2026-03-05T16:11:20.268Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9269"
      ],
      "x_nadsec_orgs": [
        "Hong Kong Broadband Network Ltd."
      ]
    },
    {
      "created": "2026-03-05T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--83cf0401-2069-4004-b084-764a3e58a429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:05:14.000Z",
      "valid_until": "2026-04-06T17:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T17:01:28.938Z",
      "x_nadsec_last_seen": "2026-03-30T09:58:22.014Z",
      "x_nadsec_ports": [
        "3306",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-05T17:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--41497bfb-f484-42b8-8133-cca0a21ad78d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T17:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.133.68.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:05:14.000Z",
      "valid_until": "2026-04-06T17:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T16:24:39.847Z",
      "x_nadsec_last_seen": "2026-03-05T16:26:47.479Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-05T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.; user(top)=**",
      "id": "indicator--544a8398-86cf-44ac-a669-f9cb956425d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.213.114.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:05:13.000Z",
      "valid_until": "2026-04-06T18:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T17:18:14.855Z",
      "x_nadsec_last_seen": "2026-03-05T17:18:14.855Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-05T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dee900c7-cbd4-4dee-99dd-9eeae3a2be54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.89.125.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:05:13.000Z",
      "valid_until": "2026-04-06T18:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T17:28:30.086Z",
      "x_nadsec_last_seen": "2026-03-05T17:28:40.259Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-05T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d9e5b71f-6be2-4d28-a4df-f58cd78328dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:05:13.000Z",
      "valid_until": "2026-04-06T18:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T17:06:13.034Z",
      "x_nadsec_last_seen": "2026-03-23T01:39:19.364Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-05T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--1352d49c-9922-4802-924b-d13a0c67eb0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.120.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:05:13.000Z",
      "valid_until": "2026-04-06T18:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T17:53:16.277Z",
      "x_nadsec_last_seen": "2026-03-05T17:53:44.903Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-05T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--60da2ccf-5ef2-4d2c-bf88-a40d19ac1fad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.141.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:05:13.000Z",
      "valid_until": "2026-04-06T18:05:12.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-03-05T17:09:22.196Z",
      "x_nadsec_last_seen": "2026-03-14T23:47:06.522Z",
      "x_nadsec_ports": [
        "81",
        "3306",
        "1433",
        "445",
        "21",
        "42",
        "135",
        "1723",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld",
        "mssqld",
        "smbd",
        "epmapper",
        "ftpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-05T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SA; asn=50837; asn_org=Cloudsigma Ag",
      "id": "indicator--ac5d87fd-047b-4fba-9ef6-c607846187c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.230.208.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:05:13.000Z",
      "valid_until": "2026-04-06T18:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T17:06:49.159Z",
      "x_nadsec_last_seen": "2026-03-05T17:06:49.238Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "50837"
      ],
      "x_nadsec_orgs": [
        "Cloudsigma Ag"
      ]
    },
    {
      "created": "2026-03-05T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--5c253683-43cc-482c-a16c-28a388923470",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.3.9.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:05:13.000Z",
      "valid_until": "2026-04-06T18:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T18:03:24.959Z",
      "x_nadsec_last_seen": "2026-03-17T16:59:09.767Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-03-05T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DE; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--748c7b79-5130-4d7b-bbfc-a726bab49f03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.142.147.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:05:13.000Z",
      "valid_until": "2026-04-06T18:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T17:43:50.625Z",
      "x_nadsec_last_seen": "2026-03-05T17:43:50.625Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-03-05T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CZ; asn=200239; asn_org=Bogahost Bilisim ve Telekomunikasyon Hiz San ve Tic. Ltd. Sti; user(top)=**",
      "id": "indicator--08c8b472-d3c0-465b-8af9-fe0fe9d83330",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.87.91.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:05:13.000Z",
      "valid_until": "2026-04-06T18:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T17:07:56.266Z",
      "x_nadsec_last_seen": "2026-03-05T17:07:56.266Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CZ"
      ],
      "x_nadsec_asns": [
        "200239"
      ],
      "x_nadsec_orgs": [
        "Bogahost Bilisim ve Telekomunikasyon Hiz San ve Tic. Ltd. Sti"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-05T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--424e6334-0fc5-44d2-9d10-298c50c154fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:05:13.000Z",
      "valid_until": "2026-04-06T18:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T17:49:14.839Z",
      "x_nadsec_last_seen": "2026-03-05T17:49:24.998Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-05T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--9c46a9c6-8bf3-4fc9-bb31-297777e05f8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:05:13.000Z",
      "valid_until": "2026-04-06T18:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T17:42:02.981Z",
      "x_nadsec_last_seen": "2026-03-05T17:42:02.981Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-05T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--ec6fb90d-ec91-43b0-9143-b816fc7b95e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:05:13.000Z",
      "valid_until": "2026-04-06T18:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-05T17:41:06.020Z",
      "x_nadsec_last_seen": "2026-03-25T11:51:43.807Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "81",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "httpd",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-05T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=34187; asn_org=LLC Renome-Service",
      "id": "indicator--d28d98f3-08ae-45ad-9146-12facd8a1ada",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.26.151.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:05:13.000Z",
      "valid_until": "2026-04-06T18:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T17:33:00.486Z",
      "x_nadsec_last_seen": "2026-03-05T17:33:07.829Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "34187"
      ],
      "x_nadsec_orgs": [
        "LLC Renome-Service"
      ]
    },
    {
      "created": "2026-03-05T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BG; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--ad74f6f4-1568-4950-a274-1e71aad07c22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.8.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:05:13.000Z",
      "valid_until": "2026-04-06T18:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T17:45:00.184Z",
      "x_nadsec_last_seen": "2026-03-05T17:45:00.184Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-03-05T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--5d576bb1-008c-41a4-a864-50adce1d277e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.40.46.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:05:13.000Z",
      "valid_until": "2026-04-06T18:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T17:46:43.549Z",
      "x_nadsec_last_seen": "2026-03-05T17:48:50.075Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-03-05T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--b9e5c178-fa88-4bfc-8370-96af9025a5a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.104.11.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:05:06.000Z",
      "valid_until": "2026-04-06T19:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T18:20:43.450Z",
      "x_nadsec_last_seen": "2026-03-29T19:25:34.144Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-05T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--71445c6c-730f-414c-875f-20e5e4cd3044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.200.27.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:05:06.000Z",
      "valid_until": "2026-04-06T19:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T18:05:57.211Z",
      "x_nadsec_last_seen": "2026-03-21T10:15:21.207Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-05T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--056fc689-6f38-4467-ab49-5140ea6d5626",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.104.48.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:05:06.000Z",
      "valid_until": "2026-04-06T19:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T18:03:37.757Z",
      "x_nadsec_last_seen": "2026-03-17T16:59:11.678Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-03-05T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EC; asn=28006; asn_org=CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP",
      "id": "indicator--5ffd31f7-8afd-4dbe-a721-bd22b7475a58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.196.49.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:05:06.000Z",
      "valid_until": "2026-04-06T19:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T18:05:29.954Z",
      "x_nadsec_last_seen": "2026-03-05T18:12:32.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "28006"
      ],
      "x_nadsec_orgs": [
        "CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP"
      ]
    },
    {
      "created": "2026-03-05T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=263244; asn_org=Iperactive SA",
      "id": "indicator--a07ad855-77e8-478c-8a8b-e05c58169c41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.0.181.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:05:06.000Z",
      "valid_until": "2026-04-06T19:05:05.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-05T18:50:36.161Z",
      "x_nadsec_last_seen": "2026-03-17T13:53:51.948Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "263244"
      ],
      "x_nadsec_orgs": [
        "Iperactive SA"
      ]
    },
    {
      "created": "2026-03-05T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--43f7820e-ac19-4360-8bd5-bb3d2d6e2a4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.136.13.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:05:06.000Z",
      "valid_until": "2026-04-06T19:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T18:58:34.772Z",
      "x_nadsec_last_seen": "2026-03-05T18:58:34.998Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-05T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c9dec768-54fe-4627-828d-785930ef029a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:05:06.000Z",
      "valid_until": "2026-04-06T19:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T18:34:28.424Z",
      "x_nadsec_last_seen": "2026-03-05T18:34:28.424Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-05T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=16637; asn_org=MTN Business Solutions",
      "id": "indicator--bd73115f-95f3-4589-a08c-3fcd33c3f0e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.8.6.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:05:06.000Z",
      "valid_until": "2026-04-06T19:05:05.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-05T18:48:13.264Z",
      "x_nadsec_last_seen": "2026-03-05T20:02:41.671Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "16637"
      ],
      "x_nadsec_orgs": [
        "MTN Business Solutions"
      ]
    },
    {
      "created": "2026-03-05T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f96a4e81-2e42-4328-844a-d81d8c690b7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.249.178.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:05:06.000Z",
      "valid_until": "2026-04-06T19:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T18:42:21.250Z",
      "x_nadsec_last_seen": "2026-03-05T18:42:21.250Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-05T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--5d5295de-0990-4f61-9781-4d857887468a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.109.35.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:05:06.000Z",
      "valid_until": "2026-04-06T19:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T18:50:50.375Z",
      "x_nadsec_last_seen": "2026-03-05T18:52:57.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-05T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--afd7825b-7761-482a-9761-53072f04b5d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.51.124.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:05:13.000Z",
      "valid_until": "2026-04-06T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T19:47:26.989Z",
      "x_nadsec_last_seen": "2026-03-05T19:49:31.699Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-05T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--d5772af8-bae1-4f82-9ccd-0e5476d49734",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.193.47.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:05:13.000Z",
      "valid_until": "2026-04-06T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T19:05:55.068Z",
      "x_nadsec_last_seen": "2026-03-05T19:06:14.653Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-05T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--46035386-a1d3-4cc6-b20c-5eee2261543c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.197.40.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:05:13.000Z",
      "valid_until": "2026-04-06T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T19:55:41.157Z",
      "x_nadsec_last_seen": "2026-03-05T19:57:51.132Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-05T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=19871; asn_org=Network Solutions, LLC; user(top)=**",
      "id": "indicator--f7e0de80-04f7-45b2-b37e-2c32346b2c6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.241.241.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:05:13.000Z",
      "valid_until": "2026-04-06T20:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T19:41:32.245Z",
      "x_nadsec_last_seen": "2026-03-05T19:41:32.245Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "19871"
      ],
      "x_nadsec_orgs": [
        "Network Solutions, LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-05T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--107d2b11-fbb9-475b-84e8-3dab6cdf8efa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:05:13.000Z",
      "valid_until": "2026-04-06T20:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T19:29:36.495Z",
      "x_nadsec_last_seen": "2026-03-05T19:29:36.495Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-05T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=18734; asn_org=Operbes, S.A. de C.V.",
      "id": "indicator--a2791d6b-38e5-40dc-9a12-298012bbecc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.148.3.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:05:13.000Z",
      "valid_until": "2026-04-06T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T19:26:52.526Z",
      "x_nadsec_last_seen": "2026-03-05T19:28:58.235Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "18734"
      ],
      "x_nadsec_orgs": [
        "Operbes, S.A. de C.V."
      ]
    },
    {
      "created": "2026-03-05T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2079b724-e8e5-4010-9e92-9b40fcef05fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:05:13.000Z",
      "valid_until": "2026-04-06T20:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T19:37:52.337Z",
      "x_nadsec_last_seen": "2026-03-05T19:38:01.139Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-05T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--fa440400-61a2-4e41-8cef-85182a431eaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.72.245.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:05:13.000Z",
      "valid_until": "2026-04-06T20:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-05T19:44:54.935Z",
      "x_nadsec_last_seen": "2026-03-18T11:27:45.787Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-05T21:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--24951fd2-d712-4048-bcd0-7203cfa1a46a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.223.8.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:05:23.000Z",
      "valid_until": "2026-04-06T21:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T20:52:59.636Z",
      "x_nadsec_last_seen": "2026-03-05T20:55:04.735Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-03-05T21:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--cee95515-8be5-41a3-a4e2-c17d506aec45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.94.123.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:05:23.000Z",
      "valid_until": "2026-04-06T21:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-05T20:35:59.668Z",
      "x_nadsec_last_seen": "2026-03-26T07:20:01.860Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-03-05T21:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--90b84d7b-3d15-4462-959d-10d25c77f0a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.164.244.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:05:23.000Z",
      "valid_until": "2026-04-06T21:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T20:14:14.904Z",
      "x_nadsec_last_seen": "2026-03-05T20:16:19.546Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-05T21:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d3998ade-1797-4942-b91c-c4fb66dd8a6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.188.153.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:05:23.000Z",
      "valid_until": "2026-04-06T21:05:12.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-05T20:30:04.973Z",
      "x_nadsec_last_seen": "2026-03-07T19:11:49.548Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-05T21:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=9931; asn_org=National Telecom Public Company Limited",
      "id": "indicator--fe9826cb-3f2a-4a6b-9974-596ea8867b49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.155.79.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:05:23.000Z",
      "valid_until": "2026-04-06T21:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T20:24:18.882Z",
      "x_nadsec_last_seen": "2026-03-22T12:50:45.169Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "9931"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-05T21:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mqttd; ports=1883; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--aab783ee-ba73-4566-9e3e-7a4a197f3536",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.58.114.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:05:23.000Z",
      "valid_until": "2026-04-06T21:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-05T20:46:19.911Z",
      "x_nadsec_last_seen": "2026-03-05T20:46:20.538Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-05T21:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--131164af-24fc-47f2-a68e-b4eb0b01821f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:05:23.000Z",
      "valid_until": "2026-04-06T21:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T20:19:41.886Z",
      "x_nadsec_last_seen": "2026-03-05T20:19:41.886Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-05T21:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--b7de0452-5245-4ced-9a73-47f3fbebd88f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:05:23.000Z",
      "valid_until": "2026-04-06T21:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-05T20:35:32.136Z",
      "x_nadsec_last_seen": "2026-03-18T15:41:47.786Z",
      "x_nadsec_ports": [
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-05T21:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262773; asn_org=PROXXIMA TELECOMUNICACOES SA",
      "id": "indicator--88e18fde-dd13-4ce4-a330-2ebed0d7143c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.226.8.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:05:23.000Z",
      "valid_until": "2026-04-06T21:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T20:40:06.008Z",
      "x_nadsec_last_seen": "2026-03-05T20:42:12.182Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262773"
      ],
      "x_nadsec_orgs": [
        "PROXXIMA TELECOMUNICACOES SA"
      ]
    },
    {
      "created": "2026-03-05T21:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--06c4fe06-3693-4486-9b1a-da22c13cd0b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:05:23.000Z",
      "valid_until": "2026-04-06T21:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T20:53:55.130Z",
      "x_nadsec_last_seen": "2026-03-05T20:53:55.130Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-05T21:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3d4aaf52-8b48-4323-aa06-a39a926a6d21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:05:23.000Z",
      "valid_until": "2026-04-06T21:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T20:53:44.877Z",
      "x_nadsec_last_seen": "2026-03-05T20:53:44.877Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-05T21:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC",
      "id": "indicator--e31327a3-9333-492f-ada9-c867077f5dc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '50.207.191.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:05:23.000Z",
      "valid_until": "2026-04-06T21:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-05T20:52:10.700Z",
      "x_nadsec_last_seen": "2026-03-06T00:23:52.055Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "7922"
      ],
      "x_nadsec_orgs": [
        "Comcast Cable Communications, LLC"
      ]
    },
    {
      "created": "2026-03-05T21:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--10afebf2-e76c-47ae-b3fe-689bc99c9c36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.99.126.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:05:23.000Z",
      "valid_until": "2026-04-06T21:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-05T20:32:45.588Z",
      "x_nadsec_last_seen": "2026-03-24T19:17:08.957Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-05T21:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--86ad2ec9-35c1-4aa7-901d-98e783ee582c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T21:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.109.32.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:05:23.000Z",
      "valid_until": "2026-04-06T21:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T20:16:27.844Z",
      "x_nadsec_last_seen": "2026-03-05T20:18:34.576Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-05T22:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--f0b0e540-ba05-4b2b-a22a-cddebe1f204d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T22:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.109.80.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:05:15.000Z",
      "valid_until": "2026-04-06T22:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T21:08:29.154Z",
      "x_nadsec_last_seen": "2026-03-05T21:15:06.877Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-05T22:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--47f90aee-b7c8-4164-88b3-71e58a55317a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T22:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.93.220.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:05:15.000Z",
      "valid_until": "2026-04-06T22:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T21:21:41.996Z",
      "x_nadsec_last_seen": "2026-03-05T21:23:48.564Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-05T22:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=60980; asn_org=45KA LLC.",
      "id": "indicator--5520664c-4c13-4a72-bd31-2ab416f31367",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T22:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.226.247.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:05:15.000Z",
      "valid_until": "2026-04-06T22:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T21:38:01.137Z",
      "x_nadsec_last_seen": "2026-03-05T21:40:08.156Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "60980"
      ],
      "x_nadsec_orgs": [
        "45KA LLC."
      ]
    },
    {
      "created": "2026-03-05T22:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--2f21cb9a-d20d-4099-9924-79cd5ffb0708",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T22:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.97.105.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:05:15.000Z",
      "valid_until": "2026-04-06T22:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T21:16:06.496Z",
      "x_nadsec_last_seen": "2026-03-05T21:18:11.677Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-05T22:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--a089d1be-1808-4d9b-ab98-20e4692720ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T22:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.204.13.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:05:15.000Z",
      "valid_until": "2026-04-06T22:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T21:59:09.083Z",
      "x_nadsec_last_seen": "2026-03-05T22:01:15.496Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-05T22:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=12252; asn_org=America Movil Peru S.A.C.",
      "id": "indicator--ca41739e-600d-43a0-bf39-1b3a39287346",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T22:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.7.73.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:05:15.000Z",
      "valid_until": "2026-04-06T22:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T21:46:27.624Z",
      "x_nadsec_last_seen": "2026-03-05T21:48:38.519Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "12252"
      ],
      "x_nadsec_orgs": [
        "America Movil Peru S.A.C."
      ]
    },
    {
      "created": "2026-03-05T22:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7476c8a5-00f1-4cba-94b7-3c8338e8e9d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T22:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:05:15.000Z",
      "valid_until": "2026-04-06T22:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T21:19:16.012Z",
      "x_nadsec_last_seen": "2026-03-05T21:19:16.012Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-05T22:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--5062a79b-b85f-4d42-8cd8-ed3b120753ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T22:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.114.122.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:05:15.000Z",
      "valid_until": "2026-04-06T22:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T22:03:08.448Z",
      "x_nadsec_last_seen": "2026-03-05T22:05:15.114Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-03-05T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=PK; asn=134489; asn_org=S. B Link Network",
      "id": "indicator--c8157ad8-158b-4b9d-9271-96b6b8e2f9e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.161.48.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:05:13.000Z",
      "valid_until": "2026-04-06T23:05:12.000Z",
      "x_nadsec_event_count": 3148,
      "x_nadsec_first_seen": "2026-03-05T22:22:07.259Z",
      "x_nadsec_last_seen": "2026-03-06T00:07:18.123Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "134489"
      ],
      "x_nadsec_orgs": [
        "S. B Link Network"
      ]
    },
    {
      "created": "2026-03-05T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3e6e654a-e4ee-4a79-adad-5d114634b4e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.176.163.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:05:13.000Z",
      "valid_until": "2026-04-06T23:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-05T23:01:07.405Z",
      "x_nadsec_last_seen": "2026-03-05T23:07:28.514Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-05T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=39812; asn_org=Closed Joint Stock Company Radiotelephone",
      "id": "indicator--6c0b63e6-29b8-488e-8b40-a4178c752998",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.255.37.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:05:13.000Z",
      "valid_until": "2026-04-06T23:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T22:22:51.753Z",
      "x_nadsec_last_seen": "2026-03-05T22:24:58.962Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "39812"
      ],
      "x_nadsec_orgs": [
        "Closed Joint Stock Company Radiotelephone"
      ]
    },
    {
      "created": "2026-03-05T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f8c391c8-24df-4f7c-80cd-36c4c7a4882d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.122.81.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:05:13.000Z",
      "valid_until": "2026-04-06T23:05:12.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-05T22:46:28.181Z",
      "x_nadsec_last_seen": "2026-03-05T22:47:30.761Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-05T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--49a8e3fa-bdb4-4d42-93be-32d73086c8f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:05:13.000Z",
      "valid_until": "2026-04-06T23:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T22:33:30.112Z",
      "x_nadsec_last_seen": "2026-03-12T22:48:50.191Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-05T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--81bd426e-0787-4a5b-b57a-80fc0748ce44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.108.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:05:13.000Z",
      "valid_until": "2026-04-06T23:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T22:47:38.617Z",
      "x_nadsec_last_seen": "2026-03-05T22:47:39.189Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-05T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=22724; asn_org=PUNTONET S.A.",
      "id": "indicator--44e81021-8a61-4676-bfeb-7ca414459420",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.105.245.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:05:13.000Z",
      "valid_until": "2026-04-06T23:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-05T22:16:25.501Z",
      "x_nadsec_last_seen": "2026-03-30T07:09:58.867Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "22724"
      ],
      "x_nadsec_orgs": [
        "PUNTONET S.A."
      ]
    },
    {
      "created": "2026-03-05T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--074848f4-58f3-4d06-8282-b2bb0139ca46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.130.164.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:05:13.000Z",
      "valid_until": "2026-04-06T23:05:12.000Z",
      "x_nadsec_event_count": 3148,
      "x_nadsec_first_seen": "2026-03-05T22:41:51.369Z",
      "x_nadsec_last_seen": "2026-03-05T23:47:31.738Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-05T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=JM; asn=10292; asn_org=Cable & Wireless Jamaica",
      "id": "indicator--44f46184-0e1a-45d4-bf0a-3b51f1e0ef42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '208.131.166.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:05:13.000Z",
      "valid_until": "2026-04-06T23:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T23:02:33.182Z",
      "x_nadsec_last_seen": "2026-03-05T23:04:39.196Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JM"
      ],
      "x_nadsec_asns": [
        "10292"
      ],
      "x_nadsec_orgs": [
        "Cable & Wireless Jamaica"
      ]
    },
    {
      "created": "2026-03-05T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=KW; asn=42961; asn_org=Mobile Telecommunications Company K.S.C.P.",
      "id": "indicator--19ae6b43-35d8-4a72-b184-c1851c79f4d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.214.12.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:05:13.000Z",
      "valid_until": "2026-04-06T23:05:12.000Z",
      "x_nadsec_event_count": 3161,
      "x_nadsec_first_seen": "2026-03-05T22:27:46.952Z",
      "x_nadsec_last_seen": "2026-03-06T04:38:09.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KW"
      ],
      "x_nadsec_asns": [
        "42961"
      ],
      "x_nadsec_orgs": [
        "Mobile Telecommunications Company K.S.C.P."
      ]
    },
    {
      "created": "2026-03-05T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--21829a0f-edc5-44a8-a7b4-915cb7f249bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.131.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:05:13.000Z",
      "valid_until": "2026-04-06T23:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-05T22:59:46.533Z",
      "x_nadsec_last_seen": "2026-03-05T23:01:05.237Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-05T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--647c6cb6-e0e8-4b0a-bf59-d4d6952fac3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.131.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:05:13.000Z",
      "valid_until": "2026-04-06T23:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T22:59:52.420Z",
      "x_nadsec_last_seen": "2026-03-05T23:00:33.807Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-05T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=epmapper; ports=135; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--b48b8128-23f8-4af5-bcb0-8261e8a8e933",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.131.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:05:13.000Z",
      "valid_until": "2026-04-06T23:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T23:00:04.409Z",
      "x_nadsec_last_seen": "2026-03-05T23:00:49.828Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-05T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--c8566f98-c6c3-4dd8-a206-d08be48ffed3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.131.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:05:13.000Z",
      "valid_until": "2026-04-06T23:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-05T23:00:25.588Z",
      "x_nadsec_last_seen": "2026-03-05T23:00:25.588Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-05T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BH; asn=35568; asn_org=Nuetel Communications B.S.C",
      "id": "indicator--b7c0cbd5-cd61-47c9-8383-36df25ceae0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-05T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.140.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:05:13.000Z",
      "valid_until": "2026-04-06T23:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-05T22:24:20.047Z",
      "x_nadsec_last_seen": "2026-03-05T22:26:26.102Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BH"
      ],
      "x_nadsec_asns": [
        "35568"
      ],
      "x_nadsec_orgs": [
        "Nuetel Communications B.S.C"
      ]
    },
    {
      "created": "2026-03-06T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--732e6874-ef06-4582-9210-f91b7266de5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.21.108.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:05:36.000Z",
      "valid_until": "2026-04-07T01:05:12.000Z",
      "x_nadsec_event_count": 21,
      "x_nadsec_first_seen": "2026-03-06T00:38:15.541Z",
      "x_nadsec_last_seen": "2026-03-16T04:48:57.905Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-06T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7edbe240-57c1-4752-8d65-2b98083338d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.59.142.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:05:36.000Z",
      "valid_until": "2026-04-07T01:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T00:27:53.469Z",
      "x_nadsec_last_seen": "2026-03-06T00:27:54.063Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-06T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4c4dc928-579f-42ca-81c1-0d6710a5ff52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.97.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:05:36.000Z",
      "valid_until": "2026-04-07T01:05:12.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-06T00:26:42.892Z",
      "x_nadsec_last_seen": "2026-03-06T00:27:45.531Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-06T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--e99b6371-237a-426d-a018-4d001a31c772",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.125.70.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:05:36.000Z",
      "valid_until": "2026-04-07T01:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T00:16:55.773Z",
      "x_nadsec_last_seen": "2026-03-06T00:17:02.089Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-03-06T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--b316c3a7-fd19-4715-90df-7f2089143fec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.96.23.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:05:36.000Z",
      "valid_until": "2026-04-07T01:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T00:32:33.578Z",
      "x_nadsec_last_seen": "2026-03-06T00:34:39.020Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-06T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f3ef22c0-40db-45d7-972f-618c8e0f57ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:05:36.000Z",
      "valid_until": "2026-04-07T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T01:01:17.965Z",
      "x_nadsec_last_seen": "2026-03-06T01:01:17.965Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-06T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--991cca0d-45b4-4b79-96bb-dc5d6a29d9e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:05:36.000Z",
      "valid_until": "2026-04-07T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T00:12:33.923Z",
      "x_nadsec_last_seen": "2026-03-06T00:12:33.923Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-06T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PE; asn=271814; asn_org=NEXTNET SAC",
      "id": "indicator--0a4d4176-d7ab-4731-b268-fe14647ce493",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.43.152.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:05:36.000Z",
      "valid_until": "2026-04-07T01:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-06T00:19:25.175Z",
      "x_nadsec_last_seen": "2026-03-06T00:19:29.727Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "271814"
      ],
      "x_nadsec_orgs": [
        "NEXTNET SAC"
      ]
    },
    {
      "created": "2026-03-06T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--a55f5772-b2d8-42ee-8223-b8433565377a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:05:36.000Z",
      "valid_until": "2026-04-07T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T00:13:57.968Z",
      "x_nadsec_last_seen": "2026-03-06T00:13:57.968Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-06T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=134177; asn_org=Rural Broadband Pvt. Ltd",
      "id": "indicator--0a31344d-9d8e-45f0-8c75-4e79bbc9ed19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.113.64.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:05:36.000Z",
      "valid_until": "2026-04-07T01:05:12.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-03-06T01:01:03.452Z",
      "x_nadsec_last_seen": "2026-03-13T04:51:52.757Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134177"
      ],
      "x_nadsec_orgs": [
        "Rural Broadband Pvt. Ltd"
      ]
    },
    {
      "created": "2026-03-06T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--995306ef-09be-4f9b-8f90-15dc84e72145",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.227.119.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:05:36.000Z",
      "valid_until": "2026-04-07T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T00:49:38.657Z",
      "x_nadsec_last_seen": "2026-03-06T00:49:38.657Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-06T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:05:36.000Z",
      "valid_until": "2026-04-07T01:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T00:12:57.281Z",
      "x_nadsec_last_seen": "2026-03-07T14:10:20.480Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-06T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BG; asn=213438; asn_org=ColocaTel Inc.",
      "id": "indicator--6e3740c6-8188-4584-a0f6-1d0ba5040b60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.8.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:05:36.000Z",
      "valid_until": "2026-04-07T01:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-05T11:03:12.337Z",
      "x_nadsec_last_seen": "2026-03-06T00:30:57.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ]
    },
    {
      "created": "2026-03-06T01:05:36.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--7691a72b-f209-4b76-bdd6-a6caec8f6404",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T01:05:36.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.9.138.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:05:36.000Z",
      "valid_until": "2026-04-07T01:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-06T01:03:38.082Z",
      "x_nadsec_last_seen": "2026-03-12T23:14:25.211Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-06T02:05:37.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=141864; asn_org=Sai Sri Technologies OPC Private Limited",
      "id": "indicator--4ac86f08-cf3b-42b3-82f5-0ff4bf7347df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T02:05:37.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.165.95.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:05:37.000Z",
      "valid_until": "2026-04-07T02:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T01:37:06.011Z",
      "x_nadsec_last_seen": "2026-03-10T13:40:24.845Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141864"
      ],
      "x_nadsec_orgs": [
        "Sai Sri Technologies OPC Private Limited"
      ]
    },
    {
      "created": "2026-03-06T02:05:37.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e5548a73-dbde-466c-8f15-33803c522c97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T02:05:37.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:05:37.000Z",
      "valid_until": "2026-04-07T02:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T01:35:40.599Z",
      "x_nadsec_last_seen": "2026-03-06T01:35:40.599Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-06T02:05:37.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--cf384c6a-c2fa-446b-8b84-a84b9c7944d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T02:05:37.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.9.1.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:05:37.000Z",
      "valid_until": "2026-04-07T02:05:11.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-03-06T01:30:49.253Z",
      "x_nadsec_last_seen": "2026-03-06T01:33:18.210Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-03-06T02:05:37.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SD; asn=15706; asn_org=Sudatel; user(top)=**",
      "id": "indicator--7fb263d4-48f6-4981-bb3a-547abba44876",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T02:05:37.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.1.229.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:05:37.000Z",
      "valid_until": "2026-04-07T02:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T01:50:39.143Z",
      "x_nadsec_last_seen": "2026-03-06T01:50:39.143Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SD"
      ],
      "x_nadsec_asns": [
        "15706"
      ],
      "x_nadsec_orgs": [
        "Sudatel"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-06T02:05:37.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--92a09529-a2af-4127-b781-b6346268d542",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T02:05:37.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:05:37.000Z",
      "valid_until": "2026-04-07T02:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T01:51:18.818Z",
      "x_nadsec_last_seen": "2026-03-08T04:55:54.117Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-06T02:05:37.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--227e53b1-b993-4d69-bfe6-801c21c0ff6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T02:05:37.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.240.62.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:05:37.000Z",
      "valid_until": "2026-04-07T02:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-06T01:25:18.847Z",
      "x_nadsec_last_seen": "2026-03-11T02:50:24.165Z",
      "x_nadsec_ports": [
        "3306",
        "445"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-06T02:05:37.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--77a609bf-af07-4faa-9ca6-ca65fffb24dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T02:05:37.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.83.114.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:05:37.000Z",
      "valid_until": "2026-04-07T02:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T01:13:39.249Z",
      "x_nadsec_last_seen": "2026-03-06T06:34:27.402Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-06T02:05:37.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--44baef16-1269-4064-aa8a-af2a3ca5f124",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T02:05:37.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.38.0.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:05:37.000Z",
      "valid_until": "2026-04-07T02:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T01:29:30.004Z",
      "x_nadsec_last_seen": "2026-03-10T01:56:41.241Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-06T02:05:37.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=7018; asn_org=AT&T Enterprises, LLC",
      "id": "indicator--ac397915-da04-49d2-a4b5-3e7a9f2774a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T02:05:37.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '69.229.2.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:05:37.000Z",
      "valid_until": "2026-04-07T02:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T01:13:55.369Z",
      "x_nadsec_last_seen": "2026-03-06T01:13:55.369Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "7018"
      ],
      "x_nadsec_orgs": [
        "AT&T Enterprises, LLC"
      ]
    },
    {
      "created": "2026-03-06T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--e94e9b82-b345-42b3-bc12-9ca06fdadcc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.229.106.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:05:13.000Z",
      "valid_until": "2026-04-07T03:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T02:48:45.508Z",
      "x_nadsec_last_seen": "2026-03-06T02:50:53.242Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-06T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--39fa5be6-1653-460c-bc12-356b1562146c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.96.82.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:05:13.000Z",
      "valid_until": "2026-04-07T03:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T02:50:58.198Z",
      "x_nadsec_last_seen": "2026-03-06T02:53:03.276Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-06T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=52950; asn_org=Fund. de Apoio a Pesq. C&T do Est. de SC - FAPESC",
      "id": "indicator--37ce0f7c-1f92-46cc-8e6e-379d63e8aa86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.8.195.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:05:13.000Z",
      "valid_until": "2026-04-07T03:05:12.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-03-06T02:45:46.125Z",
      "x_nadsec_last_seen": "2026-03-31T12:48:31.934Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52950"
      ],
      "x_nadsec_orgs": [
        "Fund. de Apoio a Pesq. C&T do Est. de SC - FAPESC"
      ]
    },
    {
      "created": "2026-03-06T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CL; asn=14117; asn_org=Telefonica del Sur S.A.",
      "id": "indicator--093b86d1-1be0-41eb-880e-498edff5d82b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.121.42.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:05:13.000Z",
      "valid_until": "2026-04-07T03:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T02:18:51.278Z",
      "x_nadsec_last_seen": "2026-03-06T02:25:57.422Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "14117"
      ],
      "x_nadsec_orgs": [
        "Telefonica del Sur S.A."
      ]
    },
    {
      "created": "2026-03-06T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--279d96a7-2046-45c8-b244-9c0a9e3fdfc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:05:13.000Z",
      "valid_until": "2026-04-07T03:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T02:27:45.405Z",
      "x_nadsec_last_seen": "2026-03-06T02:27:45.405Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-06T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bd0d852f-8de9-4372-9fd4-6d4e0bf346ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '209.38.136.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:05:13.000Z",
      "valid_until": "2026-04-07T03:05:12.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-06T02:11:15.872Z",
      "x_nadsec_last_seen": "2026-03-06T02:13:02.878Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017",
        "39735"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-06T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IL; asn=12400; asn_org=Partner Communications Ltd.",
      "id": "indicator--e9b2a5a2-2c7a-403e-a7dd-dd0fc65e4745",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.8.44.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:05:13.000Z",
      "valid_until": "2026-04-07T03:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-06T02:43:08.025Z",
      "x_nadsec_last_seen": "2026-03-13T06:03:33.791Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "12400"
      ],
      "x_nadsec_orgs": [
        "Partner Communications Ltd."
      ]
    },
    {
      "created": "2026-03-06T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--9c35d4e5-91ba-4f60-ba9c-b999144e4297",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:05:13.000Z",
      "valid_until": "2026-04-07T03:05:12.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-06T02:08:50.288Z",
      "x_nadsec_last_seen": "2026-03-06T02:09:10.150Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-03-06T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--083b3a9d-3513-47d2-b7cc-50fc1066237f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:05:13.000Z",
      "valid_until": "2026-04-07T03:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-06T02:35:03.489Z",
      "x_nadsec_last_seen": "2026-03-26T12:09:27.650Z",
      "x_nadsec_ports": [
        "135",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-06T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--0eab7689-b380-4679-a991-4437870f644c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.40.53.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:05:13.000Z",
      "valid_until": "2026-04-07T03:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-06T03:04:10.148Z",
      "x_nadsec_last_seen": "2026-03-20T19:29:58.091Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-06T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--c4451cce-afa3-4b5b-a5e2-8a8ffc9119a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.1.197.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:05:13.000Z",
      "valid_until": "2026-04-07T04:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T03:43:25.341Z",
      "x_nadsec_last_seen": "2026-03-06T03:49:51.227Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-06T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--973bdab1-abc3-4b8b-8379-04e1bb7ffeb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.134.184.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:05:13.000Z",
      "valid_until": "2026-04-07T04:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T03:31:08.171Z",
      "x_nadsec_last_seen": "2026-03-06T03:33:14.485Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-03-06T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a53f3cda-9238-4ff7-b007-2f829df792cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.60.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:05:13.000Z",
      "valid_until": "2026-04-07T04:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T03:43:08.989Z",
      "x_nadsec_last_seen": "2026-03-06T03:43:09.571Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-06T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--dd49ac26-b46a-4f8e-89de-b6c19045e73e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:05:13.000Z",
      "valid_until": "2026-04-07T04:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T03:54:13.891Z",
      "x_nadsec_last_seen": "2026-03-06T03:54:13.891Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-06T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KR; asn=17853; asn_org=LGTELECOM",
      "id": "indicator--f908c141-36a6-4535-820a-0623bc1743be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.175.92.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:05:13.000Z",
      "valid_until": "2026-04-07T04:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T03:56:59.876Z",
      "x_nadsec_last_seen": "2026-03-06T04:03:22.316Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "17853"
      ],
      "x_nadsec_orgs": [
        "LGTELECOM"
      ]
    },
    {
      "created": "2026-03-06T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--62bdcdb9-27fa-4c2c-a5aa-ccb77dd8d6b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.118.118.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:05:13.000Z",
      "valid_until": "2026-04-07T04:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T04:01:20.070Z",
      "x_nadsec_last_seen": "2026-03-06T04:03:24.645Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-06T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=TJ; asn=43197; asn_org=Closed Joint Stock Company TT mobile; user(top)=r**t; pass(top)=S*****a",
      "id": "indicator--6e8e5748-0328-4bf8-a2d5-3f05dc5de41b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.81.37.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:05:13.000Z",
      "valid_until": "2026-04-07T04:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T03:07:23.476Z",
      "x_nadsec_last_seen": "2026-03-06T03:07:23.476Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "TJ"
      ],
      "x_nadsec_asns": [
        "43197"
      ],
      "x_nadsec_orgs": [
        "Closed Joint Stock Company TT mobile"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "S*****a"
      ]
    },
    {
      "created": "2026-03-06T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--92070c78-bf64-4280-b16d-e45771f0b96e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.120.184.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:05:13.000Z",
      "valid_until": "2026-04-07T04:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T03:08:16.745Z",
      "x_nadsec_last_seen": "2026-03-06T03:15:12.165Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-06T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--89152a52-9d86-4122-b3a9-b97c173bfd0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.109.228.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:05:12.000Z",
      "valid_until": "2026-04-07T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T04:39:20.954Z",
      "x_nadsec_last_seen": "2026-03-06T04:41:25.680Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-06T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--8fb1957f-fa49-4313-9c2d-53796c59a725",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.228.249.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:05:12.000Z",
      "valid_until": "2026-04-07T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T04:59:57.137Z",
      "x_nadsec_last_seen": "2026-03-06T05:02:03.316Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-06T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PH; asn=139831; asn_org=DITO TELECOMMUNITY CORP.",
      "id": "indicator--74260b65-eccc-4d47-8b7c-68b36e3e4257",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '131.226.105.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:05:12.000Z",
      "valid_until": "2026-04-07T05:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T05:03:38.399Z",
      "x_nadsec_last_seen": "2026-03-06T05:10:38.785Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "139831"
      ],
      "x_nadsec_orgs": [
        "DITO TELECOMMUNITY CORP."
      ]
    },
    {
      "created": "2026-03-06T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=264520; asn_org=Radioscan Telecom Com. De Compon. Eletr. Ltda-EPP",
      "id": "indicator--95839f5a-04b4-4f54-8c3f-413c4d7bfb8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '132.255.248.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:05:12.000Z",
      "valid_until": "2026-04-07T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T04:44:38.988Z",
      "x_nadsec_last_seen": "2026-03-06T04:44:45.587Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264520"
      ],
      "x_nadsec_orgs": [
        "Radioscan Telecom Com. De Compon. Eletr. Ltda-EPP"
      ]
    },
    {
      "created": "2026-03-06T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--71fad5e5-a034-43bd-b648-1a22bd97f384",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:05:12.000Z",
      "valid_until": "2026-04-07T05:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T04:13:53.926Z",
      "x_nadsec_last_seen": "2026-03-06T04:13:53.926Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-06T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--5f2c87d1-c695-45f4-9c7a-a0b853148a42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.66.223.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:05:12.000Z",
      "valid_until": "2026-04-07T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T04:25:18.327Z",
      "x_nadsec_last_seen": "2026-03-06T04:27:22.954Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-06T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--53b5a59d-d838-422c-b030-302f3df88a85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.32.181.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:05:12.000Z",
      "valid_until": "2026-04-07T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T04:47:33.008Z",
      "x_nadsec_last_seen": "2026-03-06T04:47:40.384Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-06T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--b3a83eb0-9806-48fe-a105-d3174081ced8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.220.110.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:05:12.000Z",
      "valid_until": "2026-04-07T05:05:11.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-06T04:59:40.561Z",
      "x_nadsec_last_seen": "2026-03-07T08:49:57.227Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-06T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--35a82b12-df28-4dd8-b1e2-cb6edc643ed1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '218.172.33.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:05:12.000Z",
      "valid_until": "2026-04-07T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T04:24:54.968Z",
      "x_nadsec_last_seen": "2026-03-06T04:27:01.419Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-06T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--82a5f667-f191-41ad-a6af-49969b9c2b81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.76.97.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:05:12.000Z",
      "valid_until": "2026-04-07T05:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T04:58:40.168Z",
      "x_nadsec_last_seen": "2026-03-06T04:58:40.168Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-06T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TZ; asn=33765; asn_org=TTCLDATA",
      "id": "indicator--d9336836-2cae-4d28-b949-616ce88ef746",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.59.90.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:05:12.000Z",
      "valid_until": "2026-04-07T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T04:37:30.953Z",
      "x_nadsec_last_seen": "2026-03-06T04:39:38.824Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TZ"
      ],
      "x_nadsec_asns": [
        "33765"
      ],
      "x_nadsec_orgs": [
        "TTCLDATA"
      ]
    },
    {
      "created": "2026-03-06T05:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--9e679cd8-1ffb-4679-be62-2cec682cea5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T05:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.195.133.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:05:12.000Z",
      "valid_until": "2026-04-07T05:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T04:32:57.277Z",
      "x_nadsec_last_seen": "2026-03-06T04:35:04.165Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-03-06T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--82dfa518-512d-40e2-b33b-49c7a58969b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.53.249.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:05:12.000Z",
      "valid_until": "2026-04-07T06:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T05:16:47.335Z",
      "x_nadsec_last_seen": "2026-03-09T20:21:42.186Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-06T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SG; asn=152194; asn_org=CTG Server Limited",
      "id": "indicator--76ba92be-8ca9-48c9-93c4-7e4b05d8224d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.107.42.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:05:12.000Z",
      "valid_until": "2026-04-07T06:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T05:17:38.343Z",
      "x_nadsec_last_seen": "2026-03-06T05:17:43.019Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "152194"
      ],
      "x_nadsec_orgs": [
        "CTG Server Limited"
      ]
    },
    {
      "created": "2026-03-06T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=35104; asn_org=Jusan Mobile JSC",
      "id": "indicator--f8b444d4-b913-4a66-8e22-ffa7edf0e4b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.0.144.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:05:12.000Z",
      "valid_until": "2026-04-07T06:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T05:24:58.751Z",
      "x_nadsec_last_seen": "2026-03-06T05:27:05.981Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "35104"
      ],
      "x_nadsec_orgs": [
        "Jusan Mobile JSC"
      ]
    },
    {
      "created": "2026-03-06T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NO; asn=2116; asn_org=Globalconnect As",
      "id": "indicator--bfc63d37-650f-4604-afd0-846873959cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.0.131.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:05:12.000Z",
      "valid_until": "2026-04-07T06:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T05:57:50.277Z",
      "x_nadsec_last_seen": "2026-03-06T05:59:56.786Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NO"
      ],
      "x_nadsec_asns": [
        "2116"
      ],
      "x_nadsec_orgs": [
        "Globalconnect As"
      ]
    },
    {
      "created": "2026-03-06T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--a57927f3-a4c7-45ae-9a72-2240c3f62f94",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.51.106.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:05:12.000Z",
      "valid_until": "2026-04-07T06:05:11.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-06T05:14:55.826Z",
      "x_nadsec_last_seen": "2026-03-06T07:10:57.949Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-03-06T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45609; asn_org=Bharti Airtel Ltd. AS for GPRS Service",
      "id": "indicator--48ee95e2-023e-4d55-897d-548568e53a0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.184.252.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:05:12.000Z",
      "valid_until": "2026-04-07T06:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T05:44:28.031Z",
      "x_nadsec_last_seen": "2026-03-06T05:46:33.829Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45609"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd. AS for GPRS Service"
      ]
    },
    {
      "created": "2026-03-06T06:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--1dd61c3b-32a5-43c0-b638-0dea12cbaabc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T06:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.48.38.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T06:05:12.000Z",
      "valid_until": "2026-04-07T06:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T05:33:30.990Z",
      "x_nadsec_last_seen": "2026-03-06T05:33:30.990Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-06T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=328418; asn_org=Olena-Trading-AS",
      "id": "indicator--888de2c1-3ca6-4705-814d-e685f785a412",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.69.156.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:05:13.000Z",
      "valid_until": "2026-04-07T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T06:05:40.899Z",
      "x_nadsec_last_seen": "2026-03-06T06:07:48.146Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "328418"
      ],
      "x_nadsec_orgs": [
        "Olena-Trading-AS"
      ]
    },
    {
      "created": "2026-03-06T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=IN; asn=138239; asn_org=Vaishnavi Online Internet Services Pvt. Ltd.",
      "id": "indicator--5cfe7c6a-dc95-403a-b0d0-74f96296c9ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.65.203.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:05:13.000Z",
      "valid_until": "2026-04-07T07:05:12.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-06T06:22:41.596Z",
      "x_nadsec_last_seen": "2026-03-06T07:11:18.883Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138239"
      ],
      "x_nadsec_orgs": [
        "Vaishnavi Online Internet Services Pvt. Ltd."
      ]
    },
    {
      "created": "2026-03-06T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--628888b4-d22f-4f59-ae3f-422b78418b67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.93.249.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:05:13.000Z",
      "valid_until": "2026-04-07T07:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T06:21:17.273Z",
      "x_nadsec_last_seen": "2026-03-17T05:42:51.015Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-03-06T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--9ffd665c-9d1f-4687-a463-94eb0db2fdae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.243.156.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:05:13.000Z",
      "valid_until": "2026-04-07T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T06:39:54.592Z",
      "x_nadsec_last_seen": "2026-03-06T06:41:59.321Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-06T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mysqld; ports=3306; cc=HK; asn=45753; asn_org=Netsec Limited",
      "id": "indicator--83daa9e9-a8f4-4ef2-95c2-d7f2753a9413",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.16.77.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:05:13.000Z",
      "valid_until": "2026-04-07T07:05:12.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-06T06:05:36.981Z",
      "x_nadsec_last_seen": "2026-03-06T06:05:37.146Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "45753"
      ],
      "x_nadsec_orgs": [
        "Netsec Limited"
      ]
    },
    {
      "created": "2026-03-06T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=32475; asn_org=Internap Holding LLC",
      "id": "indicator--2303acee-2166-4ffb-9d86-d3741c8eb264",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:05:13.000Z",
      "valid_until": "2026-04-07T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T06:08:56.901Z",
      "x_nadsec_last_seen": "2026-03-20T18:22:37.991Z",
      "x_nadsec_ports": [
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32475"
      ],
      "x_nadsec_orgs": [
        "Internap Holding LLC"
      ]
    },
    {
      "created": "2026-03-06T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BG; asn=8717; asn_org=A1 Bulgaria EAD; user(top)=**",
      "id": "indicator--63b626c3-8ffb-4a45-9dc8-bc911d895994",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.91.161.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:05:13.000Z",
      "valid_until": "2026-04-07T07:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T06:15:00.329Z",
      "x_nadsec_last_seen": "2026-03-06T06:15:00.329Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "8717"
      ],
      "x_nadsec_orgs": [
        "A1 Bulgaria EAD"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-06T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--710b6687-09a3-42d8-b4b2-bd6fda71189d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.95.193.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:05:13.000Z",
      "valid_until": "2026-04-07T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T06:52:07.101Z",
      "x_nadsec_last_seen": "2026-03-06T06:54:12.548Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-06T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=ftpd; ports=21; cc=UA; asn=21310; asn_org=Satellite Ltd; user(top)=***; pass(top)=r**t",
      "id": "indicator--905da54d-eb0f-4c43-b46a-b4c199368a84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.39.87.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:05:13.000Z",
      "valid_until": "2026-04-07T07:05:12.000Z",
      "x_nadsec_event_count": 166,
      "x_nadsec_first_seen": "2026-03-06T07:02:32.360Z",
      "x_nadsec_last_seen": "2026-03-06T08:34:28.379Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "21310"
      ],
      "x_nadsec_orgs": [
        "Satellite Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "***",
        "a***n"
      ],
      "x_nadsec_passwords_attempted": [
        "a***n",
        "a*******s",
        "0****0",
        "***",
        "1****3"
      ]
    },
    {
      "created": "2026-03-06T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--2f438faf-ccdd-4aa4-8b97-6ed092e4b28b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.240.192.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:05:13.000Z",
      "valid_until": "2026-04-07T07:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-06T06:28:51.966Z",
      "x_nadsec_last_seen": "2026-03-31T21:50:08.777Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-06T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a88e53f6-3589-46b0-955b-364c89b77739",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.29.122.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:05:13.000Z",
      "valid_until": "2026-04-07T07:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-06T06:56:43.137Z",
      "x_nadsec_last_seen": "2026-03-11T08:10:27.168Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-06T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=BG; asn=50360; asn_org=Tamatiya EOOD",
      "id": "indicator--bc058dbb-0bbc-4436-973f-09ba12731b78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.40.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:05:13.000Z",
      "valid_until": "2026-04-07T07:05:12.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-06T06:06:12.849Z",
      "x_nadsec_last_seen": "2026-03-11T13:07:36.139Z",
      "x_nadsec_ports": [
        "81",
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "httpd",
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "50360"
      ],
      "x_nadsec_orgs": [
        "Tamatiya EOOD"
      ]
    },
    {
      "created": "2026-03-06T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--dc540d05-9c27-4888-b4ae-041bdc72e93f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.200.182.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:05:13.000Z",
      "valid_until": "2026-04-07T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T06:54:27.314Z",
      "x_nadsec_last_seen": "2026-03-06T06:56:33.609Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-06T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=197275; asn_org=Link Telecom NN Ltd.",
      "id": "indicator--51dc377e-345a-4f61-b7a3-1f10e0b515e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.219.58.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:05:13.000Z",
      "valid_until": "2026-04-07T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T06:47:52.560Z",
      "x_nadsec_last_seen": "2026-03-06T06:49:59.625Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "197275"
      ],
      "x_nadsec_orgs": [
        "Link Telecom NN Ltd."
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--310b7633-6581-4f43-b77a-2b2d8f8dd100",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.34.18.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T07:37:51.964Z",
      "x_nadsec_last_seen": "2026-03-09T01:15:51.844Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134877; asn_org=Sri Vari Network Private Limited",
      "id": "indicator--1b4b4956-44f4-416e-9026-3f12f87ff1fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.148.33.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T07:28:58.560Z",
      "x_nadsec_last_seen": "2026-03-06T07:31:03.953Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134877"
      ],
      "x_nadsec_orgs": [
        "Sri Vari Network Private Limited"
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--a924cb07-9420-4d14-8ec3-35f81ce78dc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.156.219.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T07:38:57.776Z",
      "x_nadsec_last_seen": "2026-03-06T07:39:42.263Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--50e844ff-831d-4cb6-aa07-397fd70216c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.174.219.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T07:54:47.377Z",
      "x_nadsec_last_seen": "2026-03-06T07:56:52.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--a1042582-5210-42fe-8007-e0020dd94d00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.117.193.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T07:59:16.554Z",
      "x_nadsec_last_seen": "2026-03-06T07:59:16.554Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MY; asn=400619; asn_org=AROSSCLOUD INC.",
      "id": "indicator--7c794409-105c-4918-8baa-cde1593129b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.248.87.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T07:58:50.639Z",
      "x_nadsec_last_seen": "2026-03-06T08:00:57.657Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "400619"
      ],
      "x_nadsec_orgs": [
        "AROSSCLOUD INC."
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=262916; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--e85e40e4-9c99-4598-a445-fc68bb28cad7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.242.132.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T08:03:26.532Z",
      "x_nadsec_last_seen": "2026-03-06T08:05:32.411Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "262916"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3149; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--61d6161d-fcd2-4842-b80a-e388cfbb1c1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.11.129.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 3149,
      "x_nadsec_first_seen": "2026-03-06T07:22:29.756Z",
      "x_nadsec_last_seen": "2026-03-06T07:58:29.535Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--70cc8b55-368c-44c1-ba3d-2edf18e4744a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.32.146.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T07:28:26.621Z",
      "x_nadsec_last_seen": "2026-03-17T18:29:54.390Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=137085; asn_org=ANO Broadband Service Pvt Ltd",
      "id": "indicator--56d84195-1240-4b97-a2eb-bcd2cd52a6e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.4.169.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T07:23:35.316Z",
      "x_nadsec_last_seen": "2026-03-06T07:31:17.046Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "137085"
      ],
      "x_nadsec_orgs": [
        "ANO Broadband Service Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--f9fd586b-98ac-4dbc-9c97-75507e15d5da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.197.78.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T07:59:01.566Z",
      "x_nadsec_last_seen": "2026-03-06T07:59:01.566Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--c53253d4-ace5-4c97-b12a-b783e89417b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.197.78.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T07:59:15.266Z",
      "x_nadsec_last_seen": "2026-03-06T07:59:15.266Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d34393b0-351a-4138-938a-b6de0924d055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.252.30.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T07:19:26.869Z",
      "x_nadsec_last_seen": "2026-03-06T07:19:32.081Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--fd44b2d7-6757-44b0-8533-392f29bf1978",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.199.171.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T07:59:09.569Z",
      "x_nadsec_last_seen": "2026-03-06T07:59:09.569Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--8eee3341-81f3-4450-aa66-fddfe840d4a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.153.252.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T07:45:22.265Z",
      "x_nadsec_last_seen": "2026-03-06T07:45:22.381Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--ee1130a5-34f7-4734-9497-e2775d4370bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.49.214.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T07:27:08.643Z",
      "x_nadsec_last_seen": "2026-03-06T07:27:08.934Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--1d452aa8-63c0-4432-b35c-5be7d418c6a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T07:48:13.595Z",
      "x_nadsec_last_seen": "2026-03-30T12:54:30.398Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--fe33ed51-d2cf-4843-952c-94022aa674e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.186.8.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-06T07:45:37.943Z",
      "x_nadsec_last_seen": "2026-03-06T10:55:01.965Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-06T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--06c32bab-db6e-4019-af11-b874f5fb3aec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.13.7.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:05:13.000Z",
      "valid_until": "2026-04-07T08:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T07:59:10.881Z",
      "x_nadsec_last_seen": "2026-03-06T07:59:10.881Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MN; asn=151637; asn_org=Erdenet Mining Corporation",
      "id": "indicator--c37e88e4-d969-46b6-b2e2-ad2800f59606",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.215.14.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-06T09:04:33.007Z",
      "x_nadsec_last_seen": "2026-03-15T06:35:01.774Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "151637"
      ],
      "x_nadsec_orgs": [
        "Erdenet Mining Corporation"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--850f39db-fe57-49c5-b1c1-448b27a1da20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.105.209.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T08:36:34.068Z",
      "x_nadsec_last_seen": "2026-03-06T08:36:34.068Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=4775; asn_org=Globe Telecoms",
      "id": "indicator--1d20e18b-a057-4774-9017-579804b2ba3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.198.161.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T08:36:12.098Z",
      "x_nadsec_last_seen": "2026-03-06T08:36:17.875Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "4775"
      ],
      "x_nadsec_orgs": [
        "Globe Telecoms"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--02929bf8-5c82-4860-94be-592f11054f16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.31.20.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T08:43:24.006Z",
      "x_nadsec_last_seen": "2026-03-06T08:43:24.006Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CZ; asn=9009; asn_org=M247 Europe SRL; user(top)=!********0; pass(top)=!********0",
      "id": "indicator--b4c4296f-06de-4928-a861-2d0fdcc8533d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.216.35.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T08:26:54.119Z",
      "x_nadsec_last_seen": "2026-03-07T11:27:47.194Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CZ"
      ],
      "x_nadsec_asns": [
        "9009"
      ],
      "x_nadsec_orgs": [
        "M247 Europe SRL"
      ],
      "x_nadsec_usernames_attempted": [
        "!********0",
        "_***R"
      ],
      "x_nadsec_passwords_attempted": [
        "!********0",
        "_*******D"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=13489; asn_org=UNE EPM TELECOMUNICACIONES S.A.",
      "id": "indicator--79773bb3-d0ba-410f-8ecb-569295a7cad4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.7.155.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-06T08:10:43.968Z",
      "x_nadsec_last_seen": "2026-03-06T09:24:27.291Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "13489"
      ],
      "x_nadsec_orgs": [
        "UNE EPM TELECOMUNICACIONES S.A."
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--8961198b-6059-444e-9ea7-2fda91c652a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.9.125.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T08:28:30.753Z",
      "x_nadsec_last_seen": "2026-03-06T08:30:37.927Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NO; asn=2116; asn_org=Globalconnect As",
      "id": "indicator--91de9d7c-9ff5-4d72-a162-15458e183ada",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.90.13.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T08:44:43.167Z",
      "x_nadsec_last_seen": "2026-03-06T08:46:50.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NO"
      ],
      "x_nadsec_asns": [
        "2116"
      ],
      "x_nadsec_orgs": [
        "Globalconnect As"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=199404; asn_org=WHG Hosting Services Ltd",
      "id": "indicator--2f382722-fc1a-4161-9a30-70c097aa433c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.38.85.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T08:29:09.279Z",
      "x_nadsec_last_seen": "2026-03-06T08:29:09.372Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "199404"
      ],
      "x_nadsec_orgs": [
        "WHG Hosting Services Ltd"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--50d8f799-efb9-4969-8cc1-5b3c0b7f3ac9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.21.46.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T08:07:25.934Z",
      "x_nadsec_last_seen": "2026-03-06T08:09:30.682Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24186"
      ],
      "x_nadsec_orgs": [
        "RailTel Corporation of India Ltd"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--219e2ed2-eb53-4f1b-ba5b-d58aa7280b58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T08:39:50.407Z",
      "x_nadsec_last_seen": "2026-03-22T12:31:30.427Z",
      "x_nadsec_ports": [
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d8334be4-feb8-420f-b8b7-bc0b75957808",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.252.27.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T08:19:52.706Z",
      "x_nadsec_last_seen": "2026-03-06T08:21:57.457Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--4f65d5cc-4064-441d-b114-4e91f24e658b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.114.218.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T08:22:50.412Z",
      "x_nadsec_last_seen": "2026-03-14T01:52:34.460Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--920af35b-c36b-4a23-bb6b-47633bbdf5c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.228.112.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T08:32:31.715Z",
      "x_nadsec_last_seen": "2026-03-06T08:34:36.172Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MT; asn=33874; asn_org=Epic Communications Limited",
      "id": "indicator--b1db976a-7883-4e22-b8e3-e2088ab52a5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.85.98.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T08:53:32.971Z",
      "x_nadsec_last_seen": "2026-03-13T06:37:55.610Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MT"
      ],
      "x_nadsec_asns": [
        "33874"
      ],
      "x_nadsec_orgs": [
        "Epic Communications Limited"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=RU; asn=211860; asn_org=Nerushenko Vyacheslav Nikolaevich",
      "id": "indicator--b90e2630-c5d1-42e3-b2db-758804375546",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.147.88.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T08:59:45.689Z",
      "x_nadsec_last_seen": "2026-03-27T19:24:12.926Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "211860"
      ],
      "x_nadsec_orgs": [
        "Nerushenko Vyacheslav Nikolaevich"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--ac1143bd-4bef-4203-b903-6944911f3551",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.109.32.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T08:29:29.492Z",
      "x_nadsec_last_seen": "2026-03-06T08:31:36.192Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--228bdd1c-48d7-4ca2-a8ae-7be93351eeb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T08:06:24.785Z",
      "x_nadsec_last_seen": "2026-03-24T22:02:46.126Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-06T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ee9210a6-5cd2-4638-893b-032f9287859c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:05:07.000Z",
      "valid_until": "2026-04-07T09:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T08:06:24.236Z",
      "x_nadsec_last_seen": "2026-03-06T08:06:24.236Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-06T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=149575; asn_org=SITI VISION DATA SOLUTIONS PRIVATE LIMITED",
      "id": "indicator--50c496ee-33e1-4a07-a39e-7eeb1540bb7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.187.79.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:05:12.000Z",
      "valid_until": "2026-04-07T10:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T09:12:18.269Z",
      "x_nadsec_last_seen": "2026-03-06T09:18:37.402Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "149575"
      ],
      "x_nadsec_orgs": [
        "SITI VISION DATA SOLUTIONS PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-06T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JP; asn=17676; asn_org=SoftBank Corp.",
      "id": "indicator--475ac818-bb49-40a3-acfa-67861b4b9156",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '126.77.194.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:05:12.000Z",
      "valid_until": "2026-04-07T10:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T09:58:11.945Z",
      "x_nadsec_last_seen": "2026-03-06T10:00:17.156Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "17676"
      ],
      "x_nadsec_orgs": [
        "SoftBank Corp."
      ]
    },
    {
      "created": "2026-03-06T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--83657cae-b47a-4dac-a9cf-438f10d30e58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.195.144.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:05:12.000Z",
      "valid_until": "2026-04-07T10:05:11.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-06T09:48:11.610Z",
      "x_nadsec_last_seen": "2026-03-13T15:38:52.963Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-03-06T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=135247; asn_org=K Net Solutions Pvt Ltd",
      "id": "indicator--314f9fd8-ef40-4316-b0f2-57b61fa52cbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.216.142.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:05:12.000Z",
      "valid_until": "2026-04-07T10:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-06T09:42:14.627Z",
      "x_nadsec_last_seen": "2026-03-24T21:38:10.813Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135247"
      ],
      "x_nadsec_orgs": [
        "K Net Solutions Pvt Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-06T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--fe2d9573-4650-4e59-a4ed-f02af9703bce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:05:12.000Z",
      "valid_until": "2026-04-07T10:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T09:37:40.490Z",
      "x_nadsec_last_seen": "2026-03-19T05:34:23.956Z",
      "x_nadsec_ports": [
        "1433",
        "1723",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-06T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37705; asn_org=TOPNET",
      "id": "indicator--ddf4ae5b-f939-48d4-bfb8-d9a216d5adac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.244.0.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:05:12.000Z",
      "valid_until": "2026-04-07T10:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T09:25:59.134Z",
      "x_nadsec_last_seen": "2026-03-06T09:28:06.696Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37705"
      ],
      "x_nadsec_orgs": [
        "TOPNET"
      ]
    },
    {
      "created": "2026-03-06T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--37fe5d9c-8ef8-4068-905d-a7d16b79eafe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:05:12.000Z",
      "valid_until": "2026-04-07T10:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-06T09:53:34.969Z",
      "x_nadsec_last_seen": "2026-03-19T16:57:01.015Z",
      "x_nadsec_ports": [
        "3306",
        "135"
      ],
      "x_nadsec_services": [
        "mysqld",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-06T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d32c3ae0-33f2-4904-baac-b5a630ac877e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.12.240.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:05:12.000Z",
      "valid_until": "2026-04-07T10:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T09:30:51.205Z",
      "x_nadsec_last_seen": "2026-03-06T09:31:01.389Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-06T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--980010ef-8294-4283-9a63-e73f2b5bb7a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.67.137.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:05:12.000Z",
      "valid_until": "2026-04-07T10:05:11.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-06T10:03:11.622Z",
      "x_nadsec_last_seen": "2026-03-06T10:22:21.412Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-06T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KZ; asn=205516; asn_org=Nls Astana Llp",
      "id": "indicator--248ee552-2650-4642-bec2-f5f44c1e56ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.8.117.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:05:12.000Z",
      "valid_until": "2026-04-07T10:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T09:12:19.381Z",
      "x_nadsec_last_seen": "2026-03-06T09:19:27.974Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "205516"
      ],
      "x_nadsec_orgs": [
        "Nls Astana Llp"
      ]
    },
    {
      "created": "2026-03-06T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=17483; asn_org=CityOnline Services Ltd",
      "id": "indicator--e881cbcc-2c07-4a67-a7e3-eff691be39f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.156.146.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:05:12.000Z",
      "valid_until": "2026-04-07T10:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-06T09:48:11.876Z",
      "x_nadsec_last_seen": "2026-03-13T15:38:54.381Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17483"
      ],
      "x_nadsec_orgs": [
        "CityOnline Services Ltd"
      ]
    },
    {
      "created": "2026-03-06T11:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=135817; asn_org=ESTO MEDIA PRIVATE LIMITED",
      "id": "indicator--50ce0c56-8aa6-4397-8c87-7d7632197bac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.110.164.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:05:23.000Z",
      "valid_until": "2026-04-07T11:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T10:35:10.309Z",
      "x_nadsec_last_seen": "2026-03-06T10:41:59.380Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135817"
      ],
      "x_nadsec_orgs": [
        "ESTO MEDIA PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-06T11:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=24525; asn_org=PT Solusi Aksesindo Pratama",
      "id": "indicator--5a34707c-b2ec-481a-8031-5cea648ca9a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.199.107.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:05:23.000Z",
      "valid_until": "2026-04-07T11:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T10:27:20.837Z",
      "x_nadsec_last_seen": "2026-03-06T10:27:20.837Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "24525"
      ],
      "x_nadsec_orgs": [
        "PT Solusi Aksesindo Pratama"
      ]
    },
    {
      "created": "2026-03-06T11:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--b3ff0e1e-2ab7-46b4-a3ec-b710ba3b3916",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.233.37.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:05:23.000Z",
      "valid_until": "2026-04-07T11:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T10:35:49.475Z",
      "x_nadsec_last_seen": "2026-03-06T10:35:49.475Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-06T11:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--f29d49ed-0c1a-4762-8b82-e585fef8e395",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.6.20.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:05:23.000Z",
      "valid_until": "2026-04-07T11:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T10:33:46.975Z",
      "x_nadsec_last_seen": "2026-03-06T10:38:01.348Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-06T11:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--a653049e-e23e-4668-bb4c-861691a6e4b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:05:23.000Z",
      "valid_until": "2026-04-07T11:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T10:36:47.698Z",
      "x_nadsec_last_seen": "2026-03-09T08:18:37.232Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-03-06T11:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:05:23.000Z",
      "valid_until": "2026-04-07T11:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-06T10:14:48.564Z",
      "x_nadsec_last_seen": "2026-03-13T05:35:13.436Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-06T11:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=30848; asn_org=UNIDATA S.p.A.",
      "id": "indicator--72de38f1-167c-4d80-af5f-b0cd4133096f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T11:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.217.182.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:05:23.000Z",
      "valid_until": "2026-04-07T11:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-06T10:09:23.842Z",
      "x_nadsec_last_seen": "2026-03-11T14:22:43.997Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30848"
      ],
      "x_nadsec_orgs": [
        "UNIDATA S.p.A."
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=18; services=mysqld; ports=3306; cc=IN; asn=138298; asn_org=A2j Data Services Pvt. Ltd.; user(top)=r**t",
      "id": "indicator--f8817f27-8008-4ac3-bb0e-b1c012948902",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.215.201.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 658,
      "x_nadsec_first_seen": "2026-03-06T12:54:24.524Z",
      "x_nadsec_last_seen": "2026-03-21T08:25:08.382Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138298"
      ],
      "x_nadsec_orgs": [
        "A2j Data Services Pvt. Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t",
        "m****d"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BD; asn=45925; asn_org=ASN For Teletalk Bangladesh Ltd.",
      "id": "indicator--ba9abb90-ed2f-4571-8b05-2d8330ff80d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.230.107.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T12:10:27.276Z",
      "x_nadsec_last_seen": "2026-03-25T05:26:36.600Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "45925"
      ],
      "x_nadsec_orgs": [
        "ASN For Teletalk Bangladesh Ltd."
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--271233f8-9410-4da0-bae6-882ef51fc0d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.240.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T12:35:30.673Z",
      "x_nadsec_last_seen": "2026-03-06T12:37:35.367Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BD; asn=38712; asn_org=Telnet Communication Limited Network and Transit Service Provider. Having Nationwide MPLS Ne",
      "id": "indicator--18875d3c-b94c-49cb-be00-eec809ab0236",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.50.13.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T13:00:49.586Z",
      "x_nadsec_last_seen": "2026-03-06T13:02:54.176Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "38712"
      ],
      "x_nadsec_orgs": [
        "Telnet Communication Limited Network and Transit Service Provider. Having Nationwide MPLS Ne"
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--5ea4a60e-6eb9-476d-9e0e-3d298db9d3c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.19.225.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T12:07:23.211Z",
      "x_nadsec_last_seen": "2026-03-06T12:13:52.914Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mqttd; ports=1883; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--3d732f2e-2800-41e0-a137-1590a77e4091",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.198.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T12:32:54.451Z",
      "x_nadsec_last_seen": "2026-03-06T12:33:23.750Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b8690fcd-f7c1-48c8-a266-2ea0bea70d6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.35.230.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-06T12:22:31.187Z",
      "x_nadsec_last_seen": "2026-03-08T09:33:36.991Z",
      "x_nadsec_ports": [
        "1723",
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "pptpd",
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--9b9b86ef-c95b-4bc9-98b3-0dbbb5c478b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.236.45.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-06T12:26:30.034Z",
      "x_nadsec_last_seen": "2026-03-13T06:10:59.417Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--c101a8c8-249d-43c7-ba33-59ed5b0eeb11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.63.154.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T12:36:58.078Z",
      "x_nadsec_last_seen": "2026-03-06T12:44:02.935Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--61b4e761-4e6e-4be4-b170-4f5133e7eb81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.82.126.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T12:42:13.410Z",
      "x_nadsec_last_seen": "2026-03-06T13:45:05.850Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PA; asn=11556; asn_org=Cable & Wireless Panama",
      "id": "indicator--904eec76-f36e-42ae-a231-3cee3337cd28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.75.163.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T12:56:06.408Z",
      "x_nadsec_last_seen": "2026-03-06T12:58:12.819Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PA"
      ],
      "x_nadsec_asns": [
        "11556"
      ],
      "x_nadsec_orgs": [
        "Cable & Wireless Panama"
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--73655340-a814-41fa-9ebd-385551592038",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.155.228.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T12:48:26.484Z",
      "x_nadsec_last_seen": "2026-03-06T12:50:33.262Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--8da1356f-4406-4248-ab06-a16261212a72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.120.234.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T13:01:11.458Z",
      "x_nadsec_last_seen": "2026-03-06T13:03:18.761Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4538"
      ],
      "x_nadsec_orgs": [
        "China Education and Research Network Center"
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=GB; asn=396982; asn_org=Google LLC",
      "id": "indicator--2cd688c0-244e-44a7-997c-b082da5364e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.203.210.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T12:20:03.151Z",
      "x_nadsec_last_seen": "2026-03-06T12:20:03.151Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-06T12:58:35.526Z",
      "x_nadsec_last_seen": "2026-03-28T08:42:05.393Z",
      "x_nadsec_ports": [
        "135",
        "1723",
        "81",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "pptpd",
        "httpd",
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--dfbb3d99-21da-47fa-b739-ed1bf0933ab7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.172.199.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T12:26:30.883Z",
      "x_nadsec_last_seen": "2026-03-08T22:12:07.021Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-06T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--2bed108c-a09b-437b-ac6d-2982c0d4fb16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.79.7.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T13:05:13.000Z",
      "valid_until": "2026-04-07T13:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T13:03:14.391Z",
      "x_nadsec_last_seen": "2026-03-06T13:07:33.540Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-03-06T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--3df6c0d4-4e3f-4a2b-976d-fa7ae927eb6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.7.60.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:05:07.000Z",
      "valid_until": "2026-04-07T14:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T13:11:32.078Z",
      "x_nadsec_last_seen": "2026-03-06T13:13:38.978Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-06T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45609; asn_org=Bharti Airtel Ltd. AS for GPRS Service",
      "id": "indicator--7d4b6b24-d9d2-40fe-b5a6-38eac2425342",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.96.131.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:05:07.000Z",
      "valid_until": "2026-04-07T14:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T13:39:11.023Z",
      "x_nadsec_last_seen": "2026-03-06T13:41:16.613Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45609"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd. AS for GPRS Service"
      ]
    },
    {
      "created": "2026-03-06T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--be1c1a2c-97da-46e3-a2dd-a46fdacabdd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.204.111.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:05:07.000Z",
      "valid_until": "2026-04-07T14:05:06.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-06T13:29:34.352Z",
      "x_nadsec_last_seen": "2026-03-08T18:07:54.119Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-06T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=28343; asn_org=UNIFIQUE TELECOMUNICACOES SA",
      "id": "indicator--626257dc-e951-4bae-b6d0-79debd3b0062",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.249.192.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:05:07.000Z",
      "valid_until": "2026-04-07T14:05:06.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-06T13:50:36.187Z",
      "x_nadsec_last_seen": "2026-03-14T18:00:43.712Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28343"
      ],
      "x_nadsec_orgs": [
        "UNIFIQUE TELECOMUNICACOES SA"
      ]
    },
    {
      "created": "2026-03-06T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mysqld; ports=3306; cc=US; asn=18632; asn_org=Volcano Vision, Inc.; user(top)=r**t",
      "id": "indicator--2ea0a2fb-2ec0-421c-a757-1bf2d83a82b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '208.3.195.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:05:07.000Z",
      "valid_until": "2026-04-07T14:05:06.000Z",
      "x_nadsec_event_count": 361,
      "x_nadsec_first_seen": "2026-03-06T13:14:34.381Z",
      "x_nadsec_last_seen": "2026-03-23T06:47:55.643Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "18632"
      ],
      "x_nadsec_orgs": [
        "Volcano Vision, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t",
        "a******k",
        "s***e",
        "a***********r",
        "c**n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-06T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31224; asn_org=PJSC MegaFon",
      "id": "indicator--e8c1cfd7-e974-4bec-9340-33b87cd9b285",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.173.100.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:05:07.000Z",
      "valid_until": "2026-04-07T14:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T13:29:34.297Z",
      "x_nadsec_last_seen": "2026-03-06T13:31:43.777Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31224"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-06T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:05:07.000Z",
      "valid_until": "2026-04-07T14:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T13:23:16.374Z",
      "x_nadsec_last_seen": "2026-03-07T03:28:20.425Z",
      "x_nadsec_ports": [
        "81",
        "1883"
      ],
      "x_nadsec_services": [
        "httpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-06T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12683; asn_org=Rostelecom",
      "id": "indicator--9bb9b8c8-c472-401c-9fee-87723ecc2900",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.39.109.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:05:07.000Z",
      "valid_until": "2026-04-07T14:05:06.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T13:53:19.721Z",
      "x_nadsec_last_seen": "2026-03-07T21:02:17.002Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12683"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-06T14:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--76856bd3-4aae-4401-807d-4c5481619f3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T14:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.101.29.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:05:07.000Z",
      "valid_until": "2026-04-07T14:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T13:33:57.948Z",
      "x_nadsec_last_seen": "2026-03-06T13:36:04.388Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-06T15:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BO; asn=26210; asn_org=AXS Bolivia S. A.",
      "id": "indicator--d3880c36-f8d3-4590-a2a3-fd2f182caaa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T15:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.121.234.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T15:05:06.000Z",
      "valid_until": "2026-04-07T15:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T14:12:08.770Z",
      "x_nadsec_last_seen": "2026-03-06T14:19:57.689Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "26210"
      ],
      "x_nadsec_orgs": [
        "AXS Bolivia S. A."
      ]
    },
    {
      "created": "2026-03-06T15:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--9fd78e74-bdbc-4691-804f-112eb2090706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T15:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.210.55.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T15:05:06.000Z",
      "valid_until": "2026-04-07T15:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T14:46:19.953Z",
      "x_nadsec_last_seen": "2026-03-06T14:48:27.352Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-06T15:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0950256a-4ab1-4830-96fa-d743fe4e9df3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T15:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T15:05:06.000Z",
      "valid_until": "2026-04-07T15:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T14:17:20.132Z",
      "x_nadsec_last_seen": "2026-03-06T14:17:20.132Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-06T15:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=198953; asn_org=Proton66 OOO; user(top)=D*****c; pass(top)=D***************8",
      "id": "indicator--6dfae003-e14b-4913-a5e8-3b2405b62d2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T15:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.77.150.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T15:05:06.000Z",
      "valid_until": "2026-04-07T15:05:05.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-06T14:09:48.286Z",
      "x_nadsec_last_seen": "2026-03-26T15:33:52.311Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "198953"
      ],
      "x_nadsec_orgs": [
        "Proton66 OOO"
      ],
      "x_nadsec_usernames_attempted": [
        "D*****c",
        "L*****x",
        "a***n",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "6****6",
        "D***************8",
        "L*****x",
        "h*****7"
      ]
    },
    {
      "created": "2026-03-06T15:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132770; asn_org=Gazon Communications India Limited",
      "id": "indicator--73757381-eb5b-44e6-b3f2-a140e86a3cc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T15:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.227.22.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T15:05:06.000Z",
      "valid_until": "2026-04-07T15:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T14:40:30.188Z",
      "x_nadsec_last_seen": "2026-03-06T14:42:35.823Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132770"
      ],
      "x_nadsec_orgs": [
        "Gazon Communications India Limited"
      ]
    },
    {
      "created": "2026-03-06T15:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--2bfdc6e0-f2f1-48ee-851b-30d915b4232c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T15:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T15:05:06.000Z",
      "valid_until": "2026-04-07T15:05:05.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-06T14:40:09.904Z",
      "x_nadsec_last_seen": "2026-03-06T14:40:50.165Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-03-06T15:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T15:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T15:05:06.000Z",
      "valid_until": "2026-04-07T15:05:05.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-06T14:31:59.990Z",
      "x_nadsec_last_seen": "2026-03-16T09:47:42.917Z",
      "x_nadsec_ports": [
        "135",
        "445",
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd",
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-06T15:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--aae1fbeb-ded2-458e-a0cb-bfc0057643db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T15:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T15:05:06.000Z",
      "valid_until": "2026-04-07T15:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T14:09:22.168Z",
      "x_nadsec_last_seen": "2026-03-25T14:10:14.448Z",
      "x_nadsec_ports": [
        "1723",
        "3306",
        "135"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-06T15:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T15:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T15:05:06.000Z",
      "valid_until": "2026-04-07T15:05:05.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-06T14:49:24.022Z",
      "x_nadsec_last_seen": "2026-03-29T13:51:07.162Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-06T15:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--010274b6-72f1-44ea-a0b1-97d7bad7c3d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T15:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T15:05:06.000Z",
      "valid_until": "2026-04-07T15:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T14:57:05.179Z",
      "x_nadsec_last_seen": "2026-03-10T19:33:08.805Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-06T15:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--4298407e-3d1b-4e5e-824a-998af4f496e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T15:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.10.44.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T15:05:06.000Z",
      "valid_until": "2026-04-07T15:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T14:32:59.760Z",
      "x_nadsec_last_seen": "2026-03-06T14:35:06.472Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-06T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--ab97ae69-b859-4872-a673-e61a006794d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.89.68.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T16:05:13.000Z",
      "valid_until": "2026-04-07T16:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T15:29:52.372Z",
      "x_nadsec_last_seen": "2026-03-06T15:31:59.866Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-06T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=134863; asn_org=SP INTERNET TECHNOLOGIES PRIVATE LTD",
      "id": "indicator--abe28c0f-2399-4c25-bba1-a9427e6dcbb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.237.59.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T16:05:13.000Z",
      "valid_until": "2026-04-07T16:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T15:41:24.220Z",
      "x_nadsec_last_seen": "2026-03-06T15:49:46.810Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134863"
      ],
      "x_nadsec_orgs": [
        "SP INTERNET TECHNOLOGIES PRIVATE LTD"
      ]
    },
    {
      "created": "2026-03-06T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--1e0d6627-79c2-4fa4-a586-306f1dcc6557",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.117.115.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T16:05:13.000Z",
      "valid_until": "2026-04-07T16:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T15:57:49.173Z",
      "x_nadsec_last_seen": "2026-03-06T15:57:49.173Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-06T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mongod; ports=27017; cc=CN; asn=4808; asn_org=China Unicom Beijing Province Network",
      "id": "indicator--9c4cafa0-922e-441b-91bb-f658a9470f97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.75.2.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T16:05:13.000Z",
      "valid_until": "2026-04-07T16:05:12.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-06T15:56:58.129Z",
      "x_nadsec_last_seen": "2026-03-06T15:57:17.830Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4808"
      ],
      "x_nadsec_orgs": [
        "China Unicom Beijing Province Network"
      ]
    },
    {
      "created": "2026-03-06T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3e1ce031-92f4-4d5f-ab2c-db49cc93e379",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.202.117.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T16:05:13.000Z",
      "valid_until": "2026-04-07T16:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T15:55:11.549Z",
      "x_nadsec_last_seen": "2026-03-06T15:55:11.549Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-06T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--cc32bb7f-a02f-47ff-8a99-805e3d657f5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T16:05:13.000Z",
      "valid_until": "2026-04-07T16:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T15:35:31.683Z",
      "x_nadsec_last_seen": "2026-03-26T06:19:53.669Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-06T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5942961f-4397-41f7-b99b-8b025d25ea1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T16:05:13.000Z",
      "valid_until": "2026-04-07T16:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-06T15:14:18.797Z",
      "x_nadsec_last_seen": "2026-03-13T02:38:27.806Z",
      "x_nadsec_ports": [
        "135",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-06T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--c7abcf7d-5732-4442-8032-4b6472cf3ca3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T16:05:13.000Z",
      "valid_until": "2026-04-07T16:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T15:15:47.425Z",
      "x_nadsec_last_seen": "2026-03-06T15:15:47.425Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-03-06T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BD; asn=63526; asn_org=Systems Solutions & development Technologies Limited",
      "id": "indicator--62de0560-4de8-43fd-8d30-d3762de6bebe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.239.252.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:05:13.000Z",
      "valid_until": "2026-04-07T17:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T16:14:03.047Z",
      "x_nadsec_last_seen": "2026-03-06T16:14:03.195Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "63526"
      ],
      "x_nadsec_orgs": [
        "Systems Solutions & development Technologies Limited"
      ]
    },
    {
      "created": "2026-03-06T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=19889; asn_org=Cooperativa Telefonica Del Viso",
      "id": "indicator--4272c4dc-467a-4ee8-9419-f7aaf2055373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.118.246.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:05:13.000Z",
      "valid_until": "2026-04-07T17:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T16:34:22.939Z",
      "x_nadsec_last_seen": "2026-03-06T16:34:30.934Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "19889"
      ],
      "x_nadsec_orgs": [
        "Cooperativa Telefonica Del Viso"
      ]
    },
    {
      "created": "2026-03-06T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c7757932-ec40-4ad5-8026-033d1789909c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:05:13.000Z",
      "valid_until": "2026-04-07T17:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T16:13:52.276Z",
      "x_nadsec_last_seen": "2026-03-06T16:13:52.276Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-06T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CR; asn=11830; asn_org=Instituto Costarricense de Electricidad y Telecom.",
      "id": "indicator--2f348395-0ee0-4ecd-882d-4e3192308ad9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.203.100.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:05:13.000Z",
      "valid_until": "2026-04-07T17:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T16:15:57.299Z",
      "x_nadsec_last_seen": "2026-03-06T16:18:03.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CR"
      ],
      "x_nadsec_asns": [
        "11830"
      ],
      "x_nadsec_orgs": [
        "Instituto Costarricense de Electricidad y Telecom."
      ]
    },
    {
      "created": "2026-03-06T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28590; asn_org=Directnet Prestacao de Servicos Ltda.",
      "id": "indicator--b34ea883-ea13-4815-8004-6a63e756f8d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.23.102.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:05:13.000Z",
      "valid_until": "2026-04-07T17:05:11.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-06T16:33:19.320Z",
      "x_nadsec_last_seen": "2026-03-11T03:06:44.080Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28590"
      ],
      "x_nadsec_orgs": [
        "Directnet Prestacao de Servicos Ltda."
      ]
    },
    {
      "created": "2026-03-06T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0ec50c06-f303-43b1-b311-19122e4435c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:05:13.000Z",
      "valid_until": "2026-04-07T17:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T16:19:27.018Z",
      "x_nadsec_last_seen": "2026-03-10T04:46:02.304Z",
      "x_nadsec_ports": [
        "135",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-06T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=213570; asn_org=Alperen Karabiyik; user(top)=**",
      "id": "indicator--2b804ddb-f7b0-4f38-bad0-6746bbe33948",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.58.236.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:05:13.000Z",
      "valid_until": "2026-04-07T17:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T16:19:24.280Z",
      "x_nadsec_last_seen": "2026-03-24T04:34:17.489Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "213570"
      ],
      "x_nadsec_orgs": [
        "Alperen Karabiyik"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-06T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--9a739eb7-f862-4cad-9abd-ca06832485d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.105.132.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:05:13.000Z",
      "valid_until": "2026-04-07T17:05:11.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-06T16:08:11.877Z",
      "x_nadsec_last_seen": "2026-03-15T23:03:52.414Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-03-06T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=49800; asn_org=GNC-Alfa CJSC",
      "id": "indicator--bafe7857-74a1-4a8e-848f-29e7d4f1bc50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.89.27.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:05:13.000Z",
      "valid_until": "2026-04-07T17:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T16:32:31.205Z",
      "x_nadsec_last_seen": "2026-03-06T16:34:38.193Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "49800"
      ],
      "x_nadsec_orgs": [
        "GNC-Alfa CJSC"
      ]
    },
    {
      "created": "2026-03-06T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--c0775695-4517-4859-85d4-16b11ab37288",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:05:13.000Z",
      "valid_until": "2026-04-07T17:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T16:21:26.284Z",
      "x_nadsec_last_seen": "2026-03-06T16:21:26.284Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-06T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--aa71558f-5289-4d90-912b-dd662d667064",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:05:13.000Z",
      "valid_until": "2026-04-07T17:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T16:27:17.421Z",
      "x_nadsec_last_seen": "2026-03-06T16:27:17.421Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-06T18:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--2cede636-1025-4d2f-b59a-84f349837b21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.53.251.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:05:07.000Z",
      "valid_until": "2026-04-07T18:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T18:01:53.663Z",
      "x_nadsec_last_seen": "2026-03-06T18:01:53.718Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-06T18:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MA; asn=6713; asn_org=Itissalat Al-MAGHRIB; user(top)=**",
      "id": "indicator--83f93e34-a0ad-42eb-83f1-0bef8e174d83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.159.248.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:05:07.000Z",
      "valid_until": "2026-04-07T18:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T17:26:11.133Z",
      "x_nadsec_last_seen": "2026-03-06T17:26:11.133Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "6713"
      ],
      "x_nadsec_orgs": [
        "Itissalat Al-MAGHRIB"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-06T18:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UA; asn=20590; asn_org=Donbass Electronic Communications Ltd.",
      "id": "indicator--d380e05c-da46-4879-8666-175558035b61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.254.170.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:05:07.000Z",
      "valid_until": "2026-04-07T18:05:06.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-06T17:36:16.861Z",
      "x_nadsec_last_seen": "2026-03-06T17:37:45.942Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "20590"
      ],
      "x_nadsec_orgs": [
        "Donbass Electronic Communications Ltd."
      ]
    },
    {
      "created": "2026-03-06T18:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--78664b79-2e67-4e74-ae67-8e7c6440b1a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.46.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:05:07.000Z",
      "valid_until": "2026-04-07T18:05:06.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T17:55:58.700Z",
      "x_nadsec_last_seen": "2026-03-06T17:58:08.606Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-06T18:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--04d6bda3-8eee-40af-9e4d-d68f2b938658",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.96.191.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:05:07.000Z",
      "valid_until": "2026-04-07T18:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T17:50:10.927Z",
      "x_nadsec_last_seen": "2026-03-06T17:52:15.694Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-03-06T18:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--c8536578-e293-4b37-bc55-ae064d478d59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.52.129.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:05:07.000Z",
      "valid_until": "2026-04-07T18:05:06.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-06T17:11:41.280Z",
      "x_nadsec_last_seen": "2026-03-06T18:55:46.937Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-06T18:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--99bb65df-856f-4070-93d2-15dc22f78ff7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.82.122.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:05:07.000Z",
      "valid_until": "2026-04-07T18:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T17:05:55.055Z",
      "x_nadsec_last_seen": "2026-03-06T17:08:00.385Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-06T18:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=28; services=smbd; ports=445; cc=ES; asn=41608; asn_org=NextGenWebs, S.L.",
      "id": "indicator--57f84b75-0823-4991-ad64-7fc539057f06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.213.175.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:05:07.000Z",
      "valid_until": "2026-04-07T18:05:06.000Z",
      "x_nadsec_event_count": 262,
      "x_nadsec_first_seen": "2026-03-06T17:58:13.525Z",
      "x_nadsec_last_seen": "2026-03-14T04:38:37.587Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "41608"
      ],
      "x_nadsec_orgs": [
        "NextGenWebs, S.L."
      ]
    },
    {
      "created": "2026-03-06T18:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=28; services=smbd; ports=445; cc=ES; asn=41608; asn_org=NextGenWebs, S.L.",
      "id": "indicator--5acdc39d-2ca0-49c8-acee-3254da1f6b87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.170.172.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:05:07.000Z",
      "valid_until": "2026-04-07T18:05:06.000Z",
      "x_nadsec_event_count": 154,
      "x_nadsec_first_seen": "2026-03-06T17:57:38.255Z",
      "x_nadsec_last_seen": "2026-03-14T03:56:07.222Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "41608"
      ],
      "x_nadsec_orgs": [
        "NextGenWebs, S.L."
      ]
    },
    {
      "created": "2026-03-06T18:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--41c4b1a6-4dd4-4460-8f54-f42ae13d4fa2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.104.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:05:07.000Z",
      "valid_until": "2026-04-07T18:05:06.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-06T17:25:02.995Z",
      "x_nadsec_last_seen": "2026-03-29T17:01:20.280Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-06T18:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--26f7595b-8ff6-4cba-b734-8b9c38be0be7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.105.159.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:05:07.000Z",
      "valid_until": "2026-04-07T18:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T17:44:32.664Z",
      "x_nadsec_last_seen": "2026-03-06T17:44:39.293Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-06T18:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CA; asn=812; asn_org=Rogers Communications Canada Inc.",
      "id": "indicator--e1533d37-2602-4675-9b69-352498260dc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T18:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '99.209.49.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:05:07.000Z",
      "valid_until": "2026-04-07T18:05:06.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-06T17:57:35.801Z",
      "x_nadsec_last_seen": "2026-03-06T17:59:40.399Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "812"
      ],
      "x_nadsec_orgs": [
        "Rogers Communications Canada Inc."
      ]
    },
    {
      "created": "2026-03-06T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--d45957e3-404c-44a3-99f6-6038ffa06dd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.172.40.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T19:05:13.000Z",
      "valid_until": "2026-04-07T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T18:13:50.795Z",
      "x_nadsec_last_seen": "2026-03-06T18:15:56.975Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-06T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--3df3a4ca-55f0-4f84-9655-998aa2ec051c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.133.47.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T19:05:13.000Z",
      "valid_until": "2026-04-07T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T18:33:49.008Z",
      "x_nadsec_last_seen": "2026-03-06T18:35:54.700Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-06T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--65cc6523-af48-4a92-ada9-a2ac43ab7a6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.163.191.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T19:05:13.000Z",
      "valid_until": "2026-04-07T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T18:29:01.058Z",
      "x_nadsec_last_seen": "2026-03-06T18:31:06.606Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-06T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mongod; ports=27017; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--5ea5a271-9e38-4f11-993f-d7263f528e0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.134.216.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T19:05:13.000Z",
      "valid_until": "2026-04-07T19:05:12.000Z",
      "x_nadsec_event_count": 79,
      "x_nadsec_first_seen": "2026-03-06T18:56:41.234Z",
      "x_nadsec_last_seen": "2026-03-27T23:00:10.100Z",
      "x_nadsec_ports": [
        "445",
        "1723",
        "27017",
        "81",
        "1433",
        "21"
      ],
      "x_nadsec_services": [
        "pptpd",
        "smbd",
        "mongod",
        "httpd",
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-06T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--8990be7f-bb70-46ee-9508-10406e290908",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.52.197.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T19:05:13.000Z",
      "valid_until": "2026-04-07T19:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T18:53:53.377Z",
      "x_nadsec_last_seen": "2026-03-06T18:53:53.893Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-06T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--96a1cc5a-7934-4551-82e3-a4095699cdae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.76.107.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T19:05:13.000Z",
      "valid_until": "2026-04-07T19:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T18:59:03.347Z",
      "x_nadsec_last_seen": "2026-03-31T09:11:30.750Z",
      "x_nadsec_ports": [
        "3306",
        "27017",
        "445"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-06T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8ee18745-8068-4bfc-a805-d31c7d566d3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.165.81.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T19:05:13.000Z",
      "valid_until": "2026-04-07T19:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T18:58:32.293Z",
      "x_nadsec_last_seen": "2026-03-06T18:58:32.293Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-06T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--04274522-5976-4e2f-b515-50abad22e929",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.82.77.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T19:05:13.000Z",
      "valid_until": "2026-04-07T19:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-06T18:58:31.926Z",
      "x_nadsec_last_seen": "2026-03-16T10:06:57.604Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-06T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--8a7ea8c3-97aa-49e6-b89e-e0e25ad26db3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.236.72.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T19:05:13.000Z",
      "valid_until": "2026-04-07T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T18:05:24.918Z",
      "x_nadsec_last_seen": "2026-03-06T18:07:31.859Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-06T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ZA; asn=329143; asn_org=LCSL2-AS",
      "id": "indicator--5af8bd27-8437-42e1-874b-bdf56e506251",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.214.172.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:05:13.000Z",
      "valid_until": "2026-04-07T20:05:12.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-03-06T19:27:25.439Z",
      "x_nadsec_last_seen": "2026-03-13T21:25:57.420Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "329143"
      ],
      "x_nadsec_orgs": [
        "LCSL2-AS"
      ]
    },
    {
      "created": "2026-03-06T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=JO; asn=9038; asn_org=Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co",
      "id": "indicator--3d9e6921-96e1-43a2-ae96-ee7a83d069bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.107.231.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:05:13.000Z",
      "valid_until": "2026-04-07T20:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T19:33:01.532Z",
      "x_nadsec_last_seen": "2026-03-06T19:33:01.532Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "9038"
      ],
      "x_nadsec_orgs": [
        "Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co"
      ]
    },
    {
      "created": "2026-03-06T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4671ae32-0b5a-4d2f-87d1-57cf70302f7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.164.79.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:05:13.000Z",
      "valid_until": "2026-04-07T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T19:08:41.179Z",
      "x_nadsec_last_seen": "2026-03-06T19:10:45.947Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-06T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--030b4cb8-23ac-453a-8484-80c9375f1198",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:05:13.000Z",
      "valid_until": "2026-04-07T20:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T19:32:15.192Z",
      "x_nadsec_last_seen": "2026-03-15T02:30:57.715Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-06T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--e86fd562-ac88-4a94-bf43-733c9e42b675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.236.79.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:05:13.000Z",
      "valid_until": "2026-04-07T20:05:12.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-03-06T19:41:54.054Z",
      "x_nadsec_last_seen": "2026-03-27T22:19:13.305Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-06T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--682148a0-9e7f-4e45-a007-16c10cb0e8c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.216.166.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:05:13.000Z",
      "valid_until": "2026-04-07T20:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T19:12:07.415Z",
      "x_nadsec_last_seen": "2026-03-06T19:18:42.641Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-06T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=263346; asn_org=Fonte Informatica ltda",
      "id": "indicator--9f48e1bc-d120-48a7-9f0d-ee220ea899b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.37.5.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:05:13.000Z",
      "valid_until": "2026-04-07T20:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-06T19:51:18.680Z",
      "x_nadsec_last_seen": "2026-03-27T19:01:56.730Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263346"
      ],
      "x_nadsec_orgs": [
        "Fonte Informatica ltda"
      ]
    },
    {
      "created": "2026-03-06T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6e62b77e-6014-4e5f-af7f-e3ff29a73d5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:05:13.000Z",
      "valid_until": "2026-04-07T20:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T19:38:02.288Z",
      "x_nadsec_last_seen": "2026-03-06T19:38:02.288Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-06T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--f79d4b4e-2ba9-4c04-922f-e6b32353fe69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.38.25.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:05:13.000Z",
      "valid_until": "2026-04-07T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T19:38:15.497Z",
      "x_nadsec_last_seen": "2026-03-06T19:40:21.831Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-06T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=135607; asn_org=Infinivan Incorporated",
      "id": "indicator--96e6c050-9bdf-4a7a-b73b-9c8e80afd896",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.245.22.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:05:13.000Z",
      "valid_until": "2026-04-07T20:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T19:45:07.444Z",
      "x_nadsec_last_seen": "2026-03-06T19:50:12.841Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135607"
      ],
      "x_nadsec_orgs": [
        "Infinivan Incorporated"
      ]
    },
    {
      "created": "2026-03-06T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=515; services=smbd; ports=445; cc=IN; asn=135208; asn_org=Megahertz Internet Network Pvt. Ltd.",
      "id": "indicator--7feafaf4-97a6-45cf-9348-03beb84508cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.119.199.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:05:06.000Z",
      "valid_until": "2026-04-07T21:05:05.000Z",
      "x_nadsec_event_count": 3146,
      "x_nadsec_first_seen": "2026-03-06T20:28:24.977Z",
      "x_nadsec_last_seen": "2026-03-06T21:41:40.467Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135208"
      ],
      "x_nadsec_orgs": [
        "Megahertz Internet Network Pvt. Ltd."
      ]
    },
    {
      "created": "2026-03-06T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--674cb083-4a45-4bd8-bc99-c5802483a932",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.219.90.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:05:06.000Z",
      "valid_until": "2026-04-07T21:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T20:32:02.536Z",
      "x_nadsec_last_seen": "2026-03-06T20:34:10.520Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-06T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--27b67c62-d4d6-42ae-bcb9-a1cc082523cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.160.226.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:05:06.000Z",
      "valid_until": "2026-04-07T21:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T20:21:45.888Z",
      "x_nadsec_last_seen": "2026-03-06T20:23:50.596Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-06T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a9895d21-89ee-4fd1-b930-c7a10240bdea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:05:06.000Z",
      "valid_until": "2026-04-07T21:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T20:30:43.973Z",
      "x_nadsec_last_seen": "2026-03-06T20:30:43.973Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-06T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GT; asn=272061; asn_org=CROSS CONNECT LAC, S.A.",
      "id": "indicator--6572769e-0d23-49f6-895f-2a122f886253",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.233.63.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:05:06.000Z",
      "valid_until": "2026-04-07T21:05:05.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T20:43:34.846Z",
      "x_nadsec_last_seen": "2026-03-18T00:15:20.376Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GT"
      ],
      "x_nadsec_asns": [
        "272061"
      ],
      "x_nadsec_orgs": [
        "CROSS CONNECT LAC, S.A."
      ]
    },
    {
      "created": "2026-03-06T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--e26fbf07-2083-4a21-8416-cace393d4e13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.248.147.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:05:06.000Z",
      "valid_until": "2026-04-07T21:05:05.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-06T20:09:04.478Z",
      "x_nadsec_last_seen": "2026-03-18T19:43:24.798Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-03-06T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=38017; asn_org=Route object of Square InformatiX Ltd",
      "id": "indicator--2fe02ed1-3a06-48ce-86ac-cefc74e2ac63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.59.133.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:05:06.000Z",
      "valid_until": "2026-04-07T21:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T20:41:32.343Z",
      "x_nadsec_last_seen": "2026-03-06T20:48:23.988Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "38017"
      ],
      "x_nadsec_orgs": [
        "Route object of Square InformatiX Ltd"
      ]
    },
    {
      "created": "2026-03-06T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--b09f16a4-3057-4a94-8ac3-305d80620ead",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.205.251.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:05:06.000Z",
      "valid_until": "2026-04-07T21:05:05.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T20:28:29.265Z",
      "x_nadsec_last_seen": "2026-03-06T20:50:04.733Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-06T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RO; asn=56684; asn_org=Oscar Downstream SRL",
      "id": "indicator--b7be3b0a-62af-43d2-8b96-040282faf236",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.114.106.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:05:06.000Z",
      "valid_until": "2026-04-07T21:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T20:44:40.124Z",
      "x_nadsec_last_seen": "2026-03-06T20:46:46.916Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "56684"
      ],
      "x_nadsec_orgs": [
        "Oscar Downstream SRL"
      ]
    },
    {
      "created": "2026-03-06T21:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CA; asn=36352; asn_org=HostPapa; user(top)=a***********r",
      "id": "indicator--0af4ca37-0937-4756-907c-4f99ef8895c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T21:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '96.44.159.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:05:06.000Z",
      "valid_until": "2026-04-07T21:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T20:34:44.131Z",
      "x_nadsec_last_seen": "2026-03-06T20:34:44.131Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "36352"
      ],
      "x_nadsec_orgs": [
        "HostPapa"
      ],
      "x_nadsec_usernames_attempted": [
        "a***********r"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-06T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--d78ef725-162a-45cd-98da-6272066d7cc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.51.16.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:05:13.000Z",
      "valid_until": "2026-04-07T22:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-06T21:39:16.728Z",
      "x_nadsec_last_seen": "2026-03-06T22:47:13.169Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-03-06T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NP; asn=23752; asn_org=Nepal Telecommunications Corporation, Internet Services",
      "id": "indicator--61dff194-bf2e-4b2a-a198-9bc2a7735c58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.199.228.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:05:13.000Z",
      "valid_until": "2026-04-07T22:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T21:32:12.753Z",
      "x_nadsec_last_seen": "2026-03-06T21:34:17.728Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "23752"
      ],
      "x_nadsec_orgs": [
        "Nepal Telecommunications Corporation, Internet Services"
      ]
    },
    {
      "created": "2026-03-06T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a38be5bb-d9aa-4571-a060-cb5940372cc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:05:13.000Z",
      "valid_until": "2026-04-07T22:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T21:36:06.740Z",
      "x_nadsec_last_seen": "2026-03-06T21:36:06.740Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-06T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1382196a-7067-45e5-b310-0c213a9fc79f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:05:13.000Z",
      "valid_until": "2026-04-07T22:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T21:54:35.272Z",
      "x_nadsec_last_seen": "2026-03-13T22:14:55.584Z",
      "x_nadsec_ports": [
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-06T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--94791f19-b078-49ee-90a2-32e0c00e7f0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:05:13.000Z",
      "valid_until": "2026-04-07T22:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T22:02:29.595Z",
      "x_nadsec_last_seen": "2026-03-09T12:32:39.643Z",
      "x_nadsec_ports": [
        "81",
        "1433"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-06T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--e6dcf137-11c0-410a-9a43-28cfe6c057a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.169.26.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:05:13.000Z",
      "valid_until": "2026-04-07T22:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-06T21:32:24.689Z",
      "x_nadsec_last_seen": "2026-03-06T22:30:31.137Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-06T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--e2c18689-19d2-4ea4-828d-6851bb86b4e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.20.237.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:05:13.000Z",
      "valid_until": "2026-04-07T22:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T21:34:50.490Z",
      "x_nadsec_last_seen": "2026-03-06T21:36:57.747Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10429"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-06T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--401678fe-4cd5-4337-a95b-b8fb24511817",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:05:13.000Z",
      "valid_until": "2026-04-07T22:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T21:52:28.901Z",
      "x_nadsec_last_seen": "2026-03-06T21:52:28.901Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-06T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d955236b-a124-4e37-ab75-b9ea314670e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.154.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:05:13.000Z",
      "valid_until": "2026-04-07T22:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-06T21:06:29.578Z",
      "x_nadsec_last_seen": "2026-03-06T21:06:30.231Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-06T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.143.162.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:05:13.000Z",
      "valid_until": "2026-04-07T22:05:12.000Z",
      "x_nadsec_event_count": 76,
      "x_nadsec_first_seen": "2026-03-06T21:28:27.961Z",
      "x_nadsec_last_seen": "2026-03-30T19:28:23.673Z",
      "x_nadsec_ports": [
        "3306",
        "1723",
        "1433",
        "445",
        "27017",
        "81"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd",
        "mssqld",
        "smbd",
        "mongod",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-06T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8492; asn_org=OBIT Ltd.",
      "id": "indicator--831ad505-4ae1-4105-8085-b8880b2cc33a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.134.202.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:05:13.000Z",
      "valid_until": "2026-04-07T22:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T21:56:14.493Z",
      "x_nadsec_last_seen": "2026-03-06T21:56:20.992Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8492"
      ],
      "x_nadsec_orgs": [
        "OBIT Ltd."
      ]
    },
    {
      "created": "2026-03-06T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IL; asn=6810; asn_org=Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD.",
      "id": "indicator--72313945-6997-4148-9943-a8e3e0cc2821",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.177.154.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:05:13.000Z",
      "valid_until": "2026-04-07T22:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T21:05:13.817Z",
      "x_nadsec_last_seen": "2026-03-06T21:07:21.342Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "6810"
      ],
      "x_nadsec_orgs": [
        "Bezeq- THE ISRAEL TELECOMMUNICATION CORP. LTD."
      ]
    },
    {
      "created": "2026-03-06T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--3291185a-7006-4ca0-a8c0-0233facc0114",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.26.235.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:05:13.000Z",
      "valid_until": "2026-04-07T22:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T21:17:29.774Z",
      "x_nadsec_last_seen": "2026-03-06T21:19:36.939Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-06T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--0d23540a-9cff-4c18-9759-0268ab91ead8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:05:13.000Z",
      "valid_until": "2026-04-07T22:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T21:13:17.964Z",
      "x_nadsec_last_seen": "2026-03-06T21:13:17.964Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-06T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--72579578-7ad4-4239-9d6d-3ce6125b604c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:05:13.000Z",
      "valid_until": "2026-04-07T22:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T21:13:17.240Z",
      "x_nadsec_last_seen": "2026-03-06T21:13:17.240Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-06T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f17f4bf1-939f-498f-ab6a-d12276d09819",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.25.116.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T23:05:13.000Z",
      "valid_until": "2026-04-07T23:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T22:36:23.316Z",
      "x_nadsec_last_seen": "2026-03-06T22:42:41.623Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-06T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--d30cb2df-b656-405b-9002-e6f796a8bb02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.96.58.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T23:05:13.000Z",
      "valid_until": "2026-04-07T23:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-06T22:07:20.206Z",
      "x_nadsec_last_seen": "2026-03-11T18:11:43.589Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-06T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--b284baec-f251-4c7f-b60e-92884647c84d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.158.222.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T23:05:13.000Z",
      "valid_until": "2026-04-07T23:05:12.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-06T22:36:19.663Z",
      "x_nadsec_last_seen": "2026-03-06T22:47:20.709Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-03-06T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--e500fddb-a6e6-47a7-836d-f57854303eb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.248.238.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T23:05:13.000Z",
      "valid_until": "2026-04-07T23:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T22:46:45.217Z",
      "x_nadsec_last_seen": "2026-03-25T11:00:40.205Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-03-06T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--c5552408-47eb-4086-9dc8-c2f0e1d2c740",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.39.120.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T23:05:13.000Z",
      "valid_until": "2026-04-07T23:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T22:06:18.352Z",
      "x_nadsec_last_seen": "2026-03-06T22:06:24.563Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-06T23:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=4788; asn_org=TM TECHNOLOGY SERVICES SDN. BHD.",
      "id": "indicator--e9175936-af5b-45e6-9402-335b9b4bd428",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-06T23:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.188.166.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T23:05:13.000Z",
      "valid_until": "2026-04-07T23:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T22:36:21.730Z",
      "x_nadsec_last_seen": "2026-03-09T22:52:06.482Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "4788"
      ],
      "x_nadsec_orgs": [
        "TM TECHNOLOGY SERVICES SDN. BHD."
      ]
    },
    {
      "created": "2026-03-07T00:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=133278; asn_org=Dehradun Enet Solutions Private Ltd; user(top)=**",
      "id": "indicator--cbcdf3f0-4d9d-4762-b17b-1e9d4cfc64de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.113.39.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:05:08.000Z",
      "valid_until": "2026-04-08T00:05:05.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T23:34:07.612Z",
      "x_nadsec_last_seen": "2026-03-29T14:22:05.947Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133278"
      ],
      "x_nadsec_orgs": [
        "Dehradun Enet Solutions Private Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T00:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=58369; asn_org=PT. Fiber Networks Indonesia",
      "id": "indicator--a9220317-1370-48cd-a803-73ef93e89f20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.173.77.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:05:08.000Z",
      "valid_until": "2026-04-08T00:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T23:20:34.391Z",
      "x_nadsec_last_seen": "2026-03-06T23:22:38.702Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "58369"
      ],
      "x_nadsec_orgs": [
        "PT. Fiber Networks Indonesia"
      ]
    },
    {
      "created": "2026-03-07T00:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=150008; asn_org=Pioneer Elabs Ltd.",
      "id": "indicator--8b504a87-2029-4875-a0e2-dedefb66eddf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.213.202.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:05:08.000Z",
      "valid_until": "2026-04-08T00:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T23:31:02.598Z",
      "x_nadsec_last_seen": "2026-03-06T23:33:07.687Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "150008"
      ],
      "x_nadsec_orgs": [
        "Pioneer Elabs Ltd."
      ]
    },
    {
      "created": "2026-03-07T00:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SG; asn=152194; asn_org=CTG Server Limited",
      "id": "indicator--3f955f3c-158b-461c-beb8-4c3b3ca61406",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.107.1.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:05:08.000Z",
      "valid_until": "2026-04-08T00:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T23:37:11.394Z",
      "x_nadsec_last_seen": "2026-03-06T23:37:11.557Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "152194"
      ],
      "x_nadsec_orgs": [
        "CTG Server Limited"
      ]
    },
    {
      "created": "2026-03-07T00:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=203542; asn_org=It-prof LLC",
      "id": "indicator--4a026e31-1c9f-4060-8c0d-9cffb432c1a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.213.79.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:05:08.000Z",
      "valid_until": "2026-04-08T00:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-06T23:14:40.267Z",
      "x_nadsec_last_seen": "2026-03-06T23:15:23.060Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "203542"
      ],
      "x_nadsec_orgs": [
        "It-prof LLC"
      ]
    },
    {
      "created": "2026-03-07T00:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--588f4605-e23a-4a25-978f-3a991c845d41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.175.56.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:05:08.000Z",
      "valid_until": "2026-04-08T00:05:05.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-06T23:27:51.524Z",
      "x_nadsec_last_seen": "2026-03-17T10:14:21.432Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-07T00:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=38841; asn_org=kbro CO. Ltd.",
      "id": "indicator--c0cfa43a-991a-4057-88e7-1813669ba37a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.177.108.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:05:08.000Z",
      "valid_until": "2026-04-08T00:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-06T23:24:09.828Z",
      "x_nadsec_last_seen": "2026-03-06T23:30:41.182Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "38841"
      ],
      "x_nadsec_orgs": [
        "kbro CO. Ltd."
      ]
    },
    {
      "created": "2026-03-07T00:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PY; asn=23201; asn_org=Telecel S.A.",
      "id": "indicator--5245059b-d5d4-4168-96fb-53c225f79785",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.40.108.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:05:08.000Z",
      "valid_until": "2026-04-08T00:05:05.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-06T23:30:15.330Z",
      "x_nadsec_last_seen": "2026-03-22T08:05:12.998Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "23201"
      ],
      "x_nadsec_orgs": [
        "Telecel S.A."
      ]
    },
    {
      "created": "2026-03-07T00:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--587cb772-2d88-404d-8539-73d2d9b42c66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.210.174.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:05:08.000Z",
      "valid_until": "2026-04-08T00:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-06T23:22:08.987Z",
      "x_nadsec_last_seen": "2026-03-17T10:14:23.375Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-03-07T00:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6744f0de-bfdd-4dee-835b-d1f0c86f210a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.189.192.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:05:08.000Z",
      "valid_until": "2026-04-08T00:05:05.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-03-06T23:28:02.125Z",
      "x_nadsec_last_seen": "2026-03-06T23:30:50.938Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-07T00:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=11426; asn_org=Charter Communications Inc",
      "id": "indicator--2627b319-1fb3-4d17-bd4f-75a1cf039545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.56.215.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:05:08.000Z",
      "valid_until": "2026-04-08T00:05:05.000Z",
      "x_nadsec_event_count": 28,
      "x_nadsec_first_seen": "2026-03-06T23:18:04.699Z",
      "x_nadsec_last_seen": "2026-03-30T22:49:32.168Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11426"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-03-07T00:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2d28311b-0590-4d9d-8fb9-e718f24091b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '67.205.168.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:05:08.000Z",
      "valid_until": "2026-04-08T00:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-06T23:30:54.755Z",
      "x_nadsec_last_seen": "2026-03-07T12:05:30.978Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-07T00:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398101; asn_org=GoDaddy.com, LLC",
      "id": "indicator--83bb8abc-7ea0-4dd5-a959-8374ed791592",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T00:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '72.167.51.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:05:08.000Z",
      "valid_until": "2026-04-08T00:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-06T23:15:31.408Z",
      "x_nadsec_last_seen": "2026-03-06T23:15:31.408Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398101"
      ],
      "x_nadsec_orgs": [
        "GoDaddy.com, LLC"
      ]
    },
    {
      "created": "2026-03-07T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=138746; asn_org=Live Fibernet; user(top)=**",
      "id": "indicator--75c410b8-ffce-44b0-8bbb-56992b4474d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.125.155.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:05:13.000Z",
      "valid_until": "2026-04-08T01:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T00:52:20.362Z",
      "x_nadsec_last_seen": "2026-03-31T07:46:14.986Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138746"
      ],
      "x_nadsec_orgs": [
        "Live Fibernet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--6e37b85a-a4d8-4e78-80d3-2f4d8a1e2cb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.105.209.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:05:13.000Z",
      "valid_until": "2026-04-08T01:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T00:38:26.721Z",
      "x_nadsec_last_seen": "2026-03-27T08:45:41.494Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-07T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--f691c1d5-a685-4ae1-9045-9bb231ced591",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.188.166.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:05:13.000Z",
      "valid_until": "2026-04-08T01:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T00:16:37.291Z",
      "x_nadsec_last_seen": "2026-03-07T00:18:42.536Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-07T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--faa80b05-c800-4c36-9ba7-737062b21736",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '4.236.161.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:05:13.000Z",
      "valid_until": "2026-04-08T01:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T00:53:17.262Z",
      "x_nadsec_last_seen": "2026-03-07T00:53:17.262Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-07T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MA; asn=36903; asn_org=MT-MPLS; user(top)=**",
      "id": "indicator--7ba543b0-c92f-47c7-8d12-3dc69c43fc32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.140.89.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:05:13.000Z",
      "valid_until": "2026-04-08T01:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T00:08:33.719Z",
      "x_nadsec_last_seen": "2026-03-07T00:08:33.719Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--32c95617-f1f0-4942-ade0-fa8ed82ed6ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.223.21.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:05:13.000Z",
      "valid_until": "2026-04-08T01:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T00:54:48.890Z",
      "x_nadsec_last_seen": "2026-03-07T00:54:48.890Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-07T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--63f189ef-baa8-4602-8db1-93bf187a0193",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.79.181.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:05:13.000Z",
      "valid_until": "2026-04-08T01:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T00:18:34.005Z",
      "x_nadsec_last_seen": "2026-03-07T00:19:04.001Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-07T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=56971; asn_org=Cgi Global Limited",
      "id": "indicator--6fe32d12-018b-4e6f-a169-e196fcd13add",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.8.227.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:05:13.000Z",
      "valid_until": "2026-04-08T01:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T00:12:07.249Z",
      "x_nadsec_last_seen": "2026-03-07T00:12:07.547Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "56971"
      ],
      "x_nadsec_orgs": [
        "Cgi Global Limited"
      ]
    },
    {
      "created": "2026-03-07T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--76e66f53-3e3b-422b-9a46-bbeb501bd478",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:05:13.000Z",
      "valid_until": "2026-04-08T01:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T00:33:55.274Z",
      "x_nadsec_last_seen": "2026-03-07T00:33:55.274Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-07T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--41b364ae-f2cc-4cbc-925d-74a77c1e6f06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.167.99.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:05:02.000Z",
      "valid_until": "2026-04-08T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T01:30:34.739Z",
      "x_nadsec_last_seen": "2026-03-07T01:30:34.739Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-07T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--250fa092-1759-4898-aafc-9e5923cb7501",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.224.169.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:05:02.000Z",
      "valid_until": "2026-04-08T02:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T01:30:34.880Z",
      "x_nadsec_last_seen": "2026-03-07T01:30:39.307Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-07T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--3bb2379d-cbd3-4d5d-9936-a7b7cce52e86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.115.157.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:05:02.000Z",
      "valid_until": "2026-04-08T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T01:21:33.601Z",
      "x_nadsec_last_seen": "2026-03-07T01:21:33.601Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-07T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--1007a1b5-e479-40ca-9823-f8565f9573f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.82.89.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:05:02.000Z",
      "valid_until": "2026-04-08T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T01:29:21.783Z",
      "x_nadsec_last_seen": "2026-03-07T01:31:26.277Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-03-07T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--d69bbc76-2867-4416-a957-95ca9c70485b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:05:02.000Z",
      "valid_until": "2026-04-08T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T01:50:40.826Z",
      "x_nadsec_last_seen": "2026-03-07T01:50:40.826Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-07T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--b8638d09-9c6a-4bd5-ac58-8cd5d0775b2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.220.27.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:05:02.000Z",
      "valid_until": "2026-04-08T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T01:08:41.868Z",
      "x_nadsec_last_seen": "2026-03-07T01:10:47.879Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-07T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=264628; asn_org=CORPORACION FIBEX TELECOM, C.A.",
      "id": "indicator--b4ebf40a-7e3b-44a1-b0ab-4b0778c6b301",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.120.252.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:05:02.000Z",
      "valid_until": "2026-04-08T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T01:29:53.400Z",
      "x_nadsec_last_seen": "2026-03-07T01:31:59.137Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "264628"
      ],
      "x_nadsec_orgs": [
        "CORPORACION FIBEX TELECOM, C.A."
      ]
    },
    {
      "created": "2026-03-07T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=174; asn_org=Cogent Communications, LLC",
      "id": "indicator--1a5b0257-1b9e-4037-a664-9e1194cea90b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.246.91.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:05:02.000Z",
      "valid_until": "2026-04-08T02:05:00.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-07T01:51:25.290Z",
      "x_nadsec_last_seen": "2026-03-11T10:03:14.735Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "174"
      ],
      "x_nadsec_orgs": [
        "Cogent Communications, LLC"
      ]
    },
    {
      "created": "2026-03-07T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ZA; asn=36937; asn_org=Neotel",
      "id": "indicator--a7ae4174-9a35-4225-afe4-342e74751a0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.162.56.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:05:02.000Z",
      "valid_until": "2026-04-08T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T02:03:55.118Z",
      "x_nadsec_last_seen": "2026-03-19T19:00:27.455Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "36937"
      ],
      "x_nadsec_orgs": [
        "Neotel"
      ]
    },
    {
      "created": "2026-03-07T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--73305ce0-7e03-4403-838b-420eb85ae959",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.96.92.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:05:12.000Z",
      "valid_until": "2026-04-08T03:05:11.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-07T02:31:28.259Z",
      "x_nadsec_last_seen": "2026-03-09T02:03:28.638Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-07T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1276b1c3-9310-418c-9624-1e3996115dd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.191.196.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:05:12.000Z",
      "valid_until": "2026-04-08T03:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-07T02:05:46.411Z",
      "x_nadsec_last_seen": "2026-03-07T02:24:20.379Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-07T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5370fadd-ffcc-428e-9f7a-b21a218a2e7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.224.219.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:05:12.000Z",
      "valid_until": "2026-04-08T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T02:42:16.615Z",
      "x_nadsec_last_seen": "2026-03-07T02:44:21.315Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-07T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c0f6fadd-94aa-4976-9a28-092669d5db4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:05:12.000Z",
      "valid_until": "2026-04-08T03:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T02:24:43.473Z",
      "x_nadsec_last_seen": "2026-03-27T17:06:10.564Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-07T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--cf309d89-3e80-4bd5-b9a4-63d71678fe6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:05:12.000Z",
      "valid_until": "2026-04-08T03:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T02:32:31.445Z",
      "x_nadsec_last_seen": "2026-03-07T02:32:31.445Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-07T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=21928; asn_org=T-Mobile USA, Inc.",
      "id": "indicator--72f61b76-078b-4203-adb0-d558cbf96e26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.59.223.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:05:12.000Z",
      "valid_until": "2026-04-08T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T02:28:02.363Z",
      "x_nadsec_last_seen": "2026-03-07T02:28:08.890Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "21928"
      ],
      "x_nadsec_orgs": [
        "T-Mobile USA, Inc."
      ]
    },
    {
      "created": "2026-03-07T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=53112; asn_org=SULNET TELECOM",
      "id": "indicator--df773f0b-ad60-4cab-b3fc-dab5b99c0ccb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.109.22.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:05:12.000Z",
      "valid_until": "2026-04-08T03:05:11.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-07T02:32:24.939Z",
      "x_nadsec_last_seen": "2026-03-22T09:39:11.928Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53112"
      ],
      "x_nadsec_orgs": [
        "SULNET TELECOM"
      ]
    },
    {
      "created": "2026-03-07T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--e2308b2d-8e47-4e61-aa2a-dc8ed3794ba8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.58.18.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:05:12.000Z",
      "valid_until": "2026-04-08T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T02:19:42.190Z",
      "x_nadsec_last_seen": "2026-03-07T02:21:49.394Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-07T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a895c44a-771a-433a-9e4a-ded377a5971f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:05:12.000Z",
      "valid_until": "2026-04-08T03:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T03:02:42.007Z",
      "x_nadsec_last_seen": "2026-03-07T03:02:42.007Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-07T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--11d5f4d9-d356-42a6-b9b7-357b7117a1b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:05:12.000Z",
      "valid_until": "2026-04-08T03:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T02:49:17.585Z",
      "x_nadsec_last_seen": "2026-03-07T02:49:27.913Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-07T03:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--c8b42d93-d8bd-44c9-86bf-2507da1b4690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T03:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.208.70.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:05:12.000Z",
      "valid_until": "2026-04-08T03:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T02:12:10.849Z",
      "x_nadsec_last_seen": "2026-03-07T02:14:17.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-07T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--c37df85d-19fb-442a-9b77-c7971cfc4d59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:05:12.000Z",
      "valid_until": "2026-04-08T04:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T03:51:34.727Z",
      "x_nadsec_last_seen": "2026-03-27T06:38:57.378Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-07T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--9b526510-6f9d-4768-8dbf-8b21d50c87ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:05:12.000Z",
      "valid_until": "2026-04-08T04:05:11.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-07T03:51:58.502Z",
      "x_nadsec_last_seen": "2026-03-27T06:38:50.492Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-07T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--5fed55a9-36e0-437c-ad7a-30c1b64460b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:05:12.000Z",
      "valid_until": "2026-04-08T04:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T03:51:29.575Z",
      "x_nadsec_last_seen": "2026-03-27T06:38:24.461Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-07T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--d941e9e7-defa-42df-bb22-3a88ca3de12d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:05:12.000Z",
      "valid_until": "2026-04-08T04:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T03:51:11.504Z",
      "x_nadsec_last_seen": "2026-03-10T06:43:26.537Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-07T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--ca1aec5d-e3ee-4b47-89a2-021d35d2e6fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:05:12.000Z",
      "valid_until": "2026-04-08T04:05:11.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-07T03:51:44.321Z",
      "x_nadsec_last_seen": "2026-03-27T06:39:05.279Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-07T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--7d151ac9-ad6e-4c4e-a9ba-4be3c61148e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.163.222.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:05:12.000Z",
      "valid_until": "2026-04-08T04:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-07T03:51:01.178Z",
      "x_nadsec_last_seen": "2026-03-07T04:29:05.521Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-07T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SG; asn=9506; asn_org=Singtel Fibre Broadband",
      "id": "indicator--e6975656-10c8-48bf-b7c4-2b09f1c1199f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.106.149.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:05:12.000Z",
      "valid_until": "2026-04-08T04:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T03:55:05.333Z",
      "x_nadsec_last_seen": "2026-03-07T03:57:09.449Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "9506"
      ],
      "x_nadsec_orgs": [
        "Singtel Fibre Broadband"
      ]
    },
    {
      "created": "2026-03-07T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--a44a4d3d-243a-4d3f-8fdd-23be3e0931dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.30.197.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:05:12.000Z",
      "valid_until": "2026-04-08T04:05:11.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-07T03:13:51.689Z",
      "x_nadsec_last_seen": "2026-03-27T18:55:17.142Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-07T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--86185a1d-5fcd-4c49-886f-166b808bb805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.236.167.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:05:12.000Z",
      "valid_until": "2026-04-08T04:05:11.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-07T03:12:42.468Z",
      "x_nadsec_last_seen": "2026-03-30T20:12:52.294Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-07T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=53078; asn_org=Acesse Comunicacao Ltda",
      "id": "indicator--cd4326d4-0ba0-4db2-8d8b-467d6d756a57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.94.214.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:05:12.000Z",
      "valid_until": "2026-04-08T04:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T03:38:30.157Z",
      "x_nadsec_last_seen": "2026-03-07T03:40:36.870Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53078"
      ],
      "x_nadsec_orgs": [
        "Acesse Comunicacao Ltda"
      ]
    },
    {
      "created": "2026-03-07T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c08da94d-319f-42e0-a317-9986f6752b53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:05:12.000Z",
      "valid_until": "2026-04-08T04:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T03:11:23.297Z",
      "x_nadsec_last_seen": "2026-03-07T03:11:23.297Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-07T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=4788; asn_org=TM TECHNOLOGY SERVICES SDN. BHD.",
      "id": "indicator--17cff500-b319-4a54-aa05-81d92cf680e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.187.50.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:05:12.000Z",
      "valid_until": "2026-04-08T04:05:11.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-07T03:56:56.357Z",
      "x_nadsec_last_seen": "2026-03-15T08:17:51.039Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "4788"
      ],
      "x_nadsec_orgs": [
        "TM TECHNOLOGY SERVICES SDN. BHD."
      ]
    },
    {
      "created": "2026-03-07T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--69f52bab-b26b-42ff-80ea-21ea196af017",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.45.216.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:05:12.000Z",
      "valid_until": "2026-04-08T04:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T03:56:28.741Z",
      "x_nadsec_last_seen": "2026-03-07T04:03:25.921Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-07T04:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--0f5f78e0-8ecf-45ac-bd01-bdc5df42852e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T04:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.0.69.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:05:12.000Z",
      "valid_until": "2026-04-08T04:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T03:50:00.870Z",
      "x_nadsec_last_seen": "2026-03-07T03:52:05.286Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-03-07T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--460ec486-105b-4b9b-a229-0ae68d85457d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.138.69.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:05:13.000Z",
      "valid_until": "2026-04-08T05:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T04:21:43.319Z",
      "x_nadsec_last_seen": "2026-03-07T04:23:48.679Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-07T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=263297; asn_org=VERO S.A",
      "id": "indicator--9324ccf1-c9cb-40b3-a9ae-d2bed723e7d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '131.255.124.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:05:13.000Z",
      "valid_until": "2026-04-08T05:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T05:01:37.899Z",
      "x_nadsec_last_seen": "2026-03-07T05:09:24.724Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263297"
      ],
      "x_nadsec_orgs": [
        "VERO S.A"
      ]
    },
    {
      "created": "2026-03-07T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--781fbfb1-d687-4e8e-a2fe-bc25b4ec8a47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.224.154.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:05:13.000Z",
      "valid_until": "2026-04-08T05:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T04:55:51.733Z",
      "x_nadsec_last_seen": "2026-03-07T05:02:15.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-07T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--f7bbfdbe-4ae0-4803-9ab1-88536bd1f02c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.201.219.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:05:13.000Z",
      "valid_until": "2026-04-08T05:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T04:46:55.618Z",
      "x_nadsec_last_seen": "2026-03-07T04:49:02.170Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-07T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mongod; ports=27017; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--efe6d02e-955d-440b-9a61-089b29503500",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.164.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:05:13.000Z",
      "valid_until": "2026-04-08T05:05:12.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-07T04:43:50.827Z",
      "x_nadsec_last_seen": "2026-03-19T18:31:07.416Z",
      "x_nadsec_ports": [
        "27017",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones",
      "id": "indicator--b2fabd22-45f7-4a02-8901-13f3cb3135c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.133.180.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:05:13.000Z",
      "valid_until": "2026-04-08T05:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T04:50:37.419Z",
      "x_nadsec_last_seen": "2026-03-07T04:52:44.684Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UY"
      ],
      "x_nadsec_asns": [
        "6057"
      ],
      "x_nadsec_orgs": [
        "Administracion Nacional de Telecomunicaciones"
      ]
    },
    {
      "created": "2026-03-07T05:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--855c4fc6-2462-4f6c-acf5-ef594fe46060",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T05:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.212.227.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T05:05:13.000Z",
      "valid_until": "2026-04-08T05:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T04:28:22.050Z",
      "x_nadsec_last_seen": "2026-03-07T04:28:22.050Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-07T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--a7cb5b95-c266-4e20-b953-87af58591b0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.55.239.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T06:05:14.000Z",
      "valid_until": "2026-04-08T06:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T05:16:34.783Z",
      "x_nadsec_last_seen": "2026-03-07T05:21:38.125Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-07T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--10683e5f-e751-42e9-8435-fd4c97525445",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.98.253.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T06:05:14.000Z",
      "valid_until": "2026-04-08T06:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T05:07:21.997Z",
      "x_nadsec_last_seen": "2026-03-07T05:09:27.241Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-07T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=30; services=smbd; ports=445; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--65c36a13-84d1-4198-846d-c043e4c7fc01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T06:05:14.000Z",
      "valid_until": "2026-04-08T06:05:12.000Z",
      "x_nadsec_event_count": 30,
      "x_nadsec_first_seen": "2026-03-07T05:34:54.281Z",
      "x_nadsec_last_seen": "2026-03-07T05:36:20.926Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-03-07T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ca33d84a-cc58-40d5-9bb2-5d7e15905a52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.38.37.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T06:05:14.000Z",
      "valid_until": "2026-04-08T06:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T05:18:41.816Z",
      "x_nadsec_last_seen": "2026-03-07T05:18:42.156Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-07T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133982; asn_org=Excitel Broadband Private Limited",
      "id": "indicator--e72599ec-f1f4-4c45-96ee-8e462ea99938",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.254.174.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T06:05:14.000Z",
      "valid_until": "2026-04-08T06:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T05:47:02.284Z",
      "x_nadsec_last_seen": "2026-03-07T05:49:14.178Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133982"
      ],
      "x_nadsec_orgs": [
        "Excitel Broadband Private Limited"
      ]
    },
    {
      "created": "2026-03-07T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--c2760d42-3810-4bdd-b5b6-dbbe8697c7dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.193.119.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T06:05:14.000Z",
      "valid_until": "2026-04-08T06:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T05:50:24.654Z",
      "x_nadsec_last_seen": "2026-03-25T10:11:37.991Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-07T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=44558; asn_org=Netonline Bilisim Sirketi LTD",
      "id": "indicator--410cfc2a-07c5-4fb6-acc7-714210c31fda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.30.177.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T06:05:14.000Z",
      "valid_until": "2026-04-08T06:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T05:42:12.526Z",
      "x_nadsec_last_seen": "2026-03-07T05:49:30.084Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "44558"
      ],
      "x_nadsec_orgs": [
        "Netonline Bilisim Sirketi LTD"
      ]
    },
    {
      "created": "2026-03-07T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SN; asn=37649; asn_org=Tigo",
      "id": "indicator--e9ed4cfe-d6c3-41e8-8d31-097469683af2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.164.131.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:05:13.000Z",
      "valid_until": "2026-04-08T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T06:10:35.417Z",
      "x_nadsec_last_seen": "2026-03-07T06:12:41.885Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SN"
      ],
      "x_nadsec_asns": [
        "37649"
      ],
      "x_nadsec_orgs": [
        "Tigo"
      ]
    },
    {
      "created": "2026-03-07T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=141473; asn_org=Jessore IT",
      "id": "indicator--c01661b7-7a80-487e-b7ad-14f05ebd1697",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.159.188.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:05:13.000Z",
      "valid_until": "2026-04-08T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T06:19:01.657Z",
      "x_nadsec_last_seen": "2026-03-07T06:21:08.211Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "141473"
      ],
      "x_nadsec_orgs": [
        "Jessore IT"
      ]
    },
    {
      "created": "2026-03-07T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=28812; asn_org=PJSC Bashinformsvyaz",
      "id": "indicator--14cfe304-ca8a-4b2a-a175-cb1a905cd5ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.187.160.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:05:13.000Z",
      "valid_until": "2026-04-08T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T06:35:14.755Z",
      "x_nadsec_last_seen": "2026-03-07T06:37:21.600Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28812"
      ],
      "x_nadsec_orgs": [
        "PJSC Bashinformsvyaz"
      ]
    },
    {
      "created": "2026-03-07T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--9719bb5a-4bc8-4719-a760-c28c8b10df33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.103.230.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:05:13.000Z",
      "valid_until": "2026-04-08T07:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-07T06:10:26.602Z",
      "x_nadsec_last_seen": "2026-03-10T17:06:30.870Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-07T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3518e6c1-2956-479d-8d95-02164379e470",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:05:13.000Z",
      "valid_until": "2026-04-08T07:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T06:23:16.820Z",
      "x_nadsec_last_seen": "2026-03-07T06:23:27.010Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-07T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--80f4445b-cfba-498c-82ff-300c87d4ca4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '145.82.220.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:05:13.000Z",
      "valid_until": "2026-04-08T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T06:40:05.294Z",
      "x_nadsec_last_seen": "2026-03-07T06:42:12.334Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-07T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--56b7b4ba-f5c2-45cc-8f1c-957ea03a6816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.116.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:05:13.000Z",
      "valid_until": "2026-04-08T07:05:12.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-07T06:23:15.291Z",
      "x_nadsec_last_seen": "2026-03-09T19:46:12.207Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "42",
        "81",
        "1433",
        "1723",
        "3306",
        "27017",
        "33061"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-07T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b4c08a6f-081e-4a52-87de-683d5099fcb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:05:13.000Z",
      "valid_until": "2026-04-08T07:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T06:20:55.359Z",
      "x_nadsec_last_seen": "2026-03-07T06:21:05.526Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-07T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132971; asn_org=Sikka Star powered by Sikka Broadband",
      "id": "indicator--05f2a8cd-fde9-489f-9e57-b8869d5ceeb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.0.168.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:05:13.000Z",
      "valid_until": "2026-04-08T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T06:20:24.156Z",
      "x_nadsec_last_seen": "2026-03-07T06:20:29.097Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132971"
      ],
      "x_nadsec_orgs": [
        "Sikka Star powered by Sikka Broadband"
      ]
    },
    {
      "created": "2026-03-07T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--979fc355-bb49-4d84-83f4-1652bd4a1b89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.73.37.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:05:13.000Z",
      "valid_until": "2026-04-08T07:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T06:12:31.465Z",
      "x_nadsec_last_seen": "2026-03-10T17:04:25.044Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-07T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1abd864f-1b84-4e83-a637-926db6bda190",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:05:13.000Z",
      "valid_until": "2026-04-08T07:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T06:36:48.342Z",
      "x_nadsec_last_seen": "2026-03-12T19:41:05.147Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-07T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--cc860518-60f1-4c4e-b322-b832f050eaca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.162.52.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:05:12.000Z",
      "valid_until": "2026-04-08T08:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T07:07:12.477Z",
      "x_nadsec_last_seen": "2026-03-07T07:07:19.361Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-07T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a0debfef-f354-4fbc-8105-9b4b2867cb1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.115.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:05:12.000Z",
      "valid_until": "2026-04-08T08:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T07:32:48.825Z",
      "x_nadsec_last_seen": "2026-03-07T13:25:07.804Z",
      "x_nadsec_ports": [
        "1883",
        "1433"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-07T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--9fbc50eb-7251-4d53-9f4f-10ae2f324d6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:05:12.000Z",
      "valid_until": "2026-04-08T08:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T07:51:25.803Z",
      "x_nadsec_last_seen": "2026-03-07T07:51:25.803Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-07T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1b8f51da-21ec-4a7f-b3dc-d22c2190de3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.223.118.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:05:12.000Z",
      "valid_until": "2026-04-08T08:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T07:32:36.965Z",
      "x_nadsec_last_seen": "2026-03-07T07:32:48.214Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-07T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5f016561-460d-4c11-8221-67fd1015b781",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:05:12.000Z",
      "valid_until": "2026-04-08T08:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T07:32:11.498Z",
      "x_nadsec_last_seen": "2026-03-15T15:33:08.398Z",
      "x_nadsec_ports": [
        "135",
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-07T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=GR; asn=3329; asn_org=Vodafone-panafon Hellenic Telecommunications Company SA",
      "id": "indicator--1e6187dd-a108-4325-b072-843c44968567",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.59.17.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:05:12.000Z",
      "valid_until": "2026-04-08T08:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T07:46:57.409Z",
      "x_nadsec_last_seen": "2026-03-07T07:46:57.553Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GR"
      ],
      "x_nadsec_asns": [
        "3329"
      ],
      "x_nadsec_orgs": [
        "Vodafone-panafon Hellenic Telecommunications Company SA"
      ]
    },
    {
      "created": "2026-03-07T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=18889; asn_org=City of Ruston",
      "id": "indicator--ff366699-0013-4bb7-ac26-75284ec388b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.152.192.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:05:12.000Z",
      "valid_until": "2026-04-08T08:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T11:27:22.102Z",
      "x_nadsec_last_seen": "2026-03-07T07:56:19.959Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "18889"
      ],
      "x_nadsec_orgs": [
        "City of Ruston"
      ]
    },
    {
      "created": "2026-03-07T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--018030b8-0f60-41e4-b205-0db42bf7f8e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.188.73.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:05:12.000Z",
      "valid_until": "2026-04-08T08:05:11.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-03-07T08:04:07.530Z",
      "x_nadsec_last_seen": "2026-03-07T08:07:53.624Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-07T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--d7caf332-b3ad-4c32-813b-1742d6ed18a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.53.130.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:05:12.000Z",
      "valid_until": "2026-04-08T08:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T07:39:17.213Z",
      "x_nadsec_last_seen": "2026-03-07T08:55:43.897Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-07T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b244d925-f849-4a51-bca0-5d4535183f26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.202.9.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:05:12.000Z",
      "valid_until": "2026-04-08T08:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T07:45:15.733Z",
      "x_nadsec_last_seen": "2026-03-28T05:00:49.183Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-07T08:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--a6905991-c8fa-43c3-9711-aa24afa6b36c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T08:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.38.58.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T08:05:12.000Z",
      "valid_until": "2026-04-08T08:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T07:19:30.574Z",
      "x_nadsec_last_seen": "2026-03-07T07:21:37.353Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-07T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--cd05c543-01c5-44c9-8e6c-98e351ca7365",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.169.217.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T09:05:13.000Z",
      "valid_until": "2026-04-08T09:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T08:36:00.071Z",
      "x_nadsec_last_seen": "2026-03-07T08:38:06.630Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-07T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--d156b2ab-b96d-456d-a032-c6b2fbee374e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.185.132.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T09:05:13.000Z",
      "valid_until": "2026-04-08T09:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-07T08:54:03.334Z",
      "x_nadsec_last_seen": "2026-03-07T10:16:09.218Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-07T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=28006; asn_org=CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP",
      "id": "indicator--174953d9-54cf-416d-add8-a48eabcb0e35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.107.62.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T09:05:13.000Z",
      "valid_until": "2026-04-08T09:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T08:25:41.955Z",
      "x_nadsec_last_seen": "2026-03-07T08:27:48.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "28006"
      ],
      "x_nadsec_orgs": [
        "CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP"
      ]
    },
    {
      "created": "2026-03-07T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--12969164-0ca9-4d7f-897d-ef113abc2e09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.140.1.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T09:05:13.000Z",
      "valid_until": "2026-04-08T09:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T08:55:50.286Z",
      "x_nadsec_last_seen": "2026-03-25T02:15:27.629Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c54c77e2-1890-4422-bcfc-5135be5b17f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T09:05:13.000Z",
      "valid_until": "2026-04-08T09:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T08:18:38.341Z",
      "x_nadsec_last_seen": "2026-03-21T13:58:32.508Z",
      "x_nadsec_ports": [
        "1723",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-07T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=21487; asn_org=Rostelecom",
      "id": "indicator--e52af31d-4740-4cb5-a8a1-0cf4ee009f8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.73.90.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T09:05:13.000Z",
      "valid_until": "2026-04-08T09:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T08:27:33.170Z",
      "x_nadsec_last_seen": "2026-03-07T08:27:33.622Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "21487"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-07T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--be7e5c25-461b-4fae-85c5-2e2c5ff9e1a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.20.173.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:05:02.000Z",
      "valid_until": "2026-04-08T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T09:46:49.052Z",
      "x_nadsec_last_seen": "2026-03-07T09:46:54.470Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-07T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--1a19f8a6-5e09-49f7-9e48-bf78ae92ee69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.51.151.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:05:02.000Z",
      "valid_until": "2026-04-08T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T10:00:52.023Z",
      "x_nadsec_last_seen": "2026-03-07T10:02:57.302Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-03-07T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BD; asn=152328; asn_org=AVA BD NETWORK",
      "id": "indicator--21b5f890-9ee2-40b4-94a4-80e0e04a96c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.10.172.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:05:02.000Z",
      "valid_until": "2026-04-08T10:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-07T09:14:09.310Z",
      "x_nadsec_last_seen": "2026-03-07T10:13:33.381Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "152328"
      ],
      "x_nadsec_orgs": [
        "AVA BD NETWORK"
      ]
    },
    {
      "created": "2026-03-07T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BD; asn=152328; asn_org=AVA BD NETWORK",
      "id": "indicator--5a49b7ae-76af-4d3c-a544-2d4fd73aeda0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.10.172.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:05:02.000Z",
      "valid_until": "2026-04-08T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T09:14:09.038Z",
      "x_nadsec_last_seen": "2026-03-07T09:14:09.038Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "152328"
      ],
      "x_nadsec_orgs": [
        "AVA BD NETWORK"
      ]
    },
    {
      "created": "2026-03-07T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc; user(top)=**",
      "id": "indicator--ffc4d498-4260-4ff5-a2fd-ca8714813967",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.170.189.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:05:02.000Z",
      "valid_until": "2026-04-08T10:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-07T09:21:53.078Z",
      "x_nadsec_last_seen": "2026-03-29T14:48:32.408Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9e0cde9f-f610-4755-8541-c62dc2ac4eac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:05:02.000Z",
      "valid_until": "2026-04-08T10:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T09:47:35.273Z",
      "x_nadsec_last_seen": "2026-03-07T19:39:14.488Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-07T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56044; asn_org=China Mobile communications corporation",
      "id": "indicator--183a2efe-2b47-45e7-8883-ac240d6b1742",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.140.196.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:05:02.000Z",
      "valid_until": "2026-04-08T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T09:39:12.166Z",
      "x_nadsec_last_seen": "2026-03-07T09:42:21.335Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56044"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-03-07T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--54756f7f-6adf-49bc-b930-462f6f09440d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.14.247.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:05:02.000Z",
      "valid_until": "2026-04-08T10:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-07T09:21:31.148Z",
      "x_nadsec_last_seen": "2026-03-23T04:56:23.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-03-07T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=204102; asn_org=LLC SmartGrupp",
      "id": "indicator--42dc412b-a9e4-448a-a015-1e4b91c4b9b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.22.67.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:05:02.000Z",
      "valid_until": "2026-04-08T10:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T09:35:05.695Z",
      "x_nadsec_last_seen": "2026-03-07T09:36:39.030Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "204102"
      ],
      "x_nadsec_orgs": [
        "LLC SmartGrupp"
      ]
    },
    {
      "created": "2026-03-07T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--affc6b76-8253-4aee-b225-3c4751f0c9d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.205.201.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:05:02.000Z",
      "valid_until": "2026-04-08T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T09:48:31.226Z",
      "x_nadsec_last_seen": "2026-03-07T09:50:35.780Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-07T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=7029; asn_org=Windstream Communications LLC",
      "id": "indicator--a4c7f291-d3c7-491a-acf6-cbd8b47bdaa9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.134.34.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:05:02.000Z",
      "valid_until": "2026-04-08T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T09:43:08.965Z",
      "x_nadsec_last_seen": "2026-03-07T09:45:14.021Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "7029"
      ],
      "x_nadsec_orgs": [
        "Windstream Communications LLC"
      ]
    },
    {
      "created": "2026-03-07T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--b6a3b1ae-9e77-4cc0-8443-c771c6220b46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.77.197.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T10:05:02.000Z",
      "valid_until": "2026-04-08T10:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-07T09:13:17.655Z",
      "x_nadsec_last_seen": "2026-03-07T10:47:54.076Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-03-07T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--1923533e-f5de-4b84-a075-3773f39b1d70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.207.87.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:05:13.000Z",
      "valid_until": "2026-04-08T11:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T10:18:00.073Z",
      "x_nadsec_last_seen": "2026-03-07T10:18:00.436Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-07T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--cd0921b3-75f3-45d5-a711-7fa301dfc6ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.185.47.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:05:13.000Z",
      "valid_until": "2026-04-08T11:05:11.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-07T10:51:11.805Z",
      "x_nadsec_last_seen": "2026-03-07T11:54:05.720Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-07T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3db8bcd2-2444-4949-9325-864d5c31947b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:05:13.000Z",
      "valid_until": "2026-04-08T11:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T10:25:16.622Z",
      "x_nadsec_last_seen": "2026-03-07T10:25:26.624Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-07T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132453; asn_org=TRIPLE PLAY BROADBAND PRIVATE LIMITED",
      "id": "indicator--8f1d227d-50a2-4bb9-b658-c81d45b02d37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '150.129.182.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:05:13.000Z",
      "valid_until": "2026-04-08T11:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T10:55:40.654Z",
      "x_nadsec_last_seen": "2026-03-07T11:02:59.045Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132453"
      ],
      "x_nadsec_orgs": [
        "TRIPLE PLAY BROADBAND PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-07T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BD; asn=152328; asn_org=AVA BD NETWORK",
      "id": "indicator--59c3eecc-12a9-4e4a-8d19-c7788082428c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.10.172.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:05:13.000Z",
      "valid_until": "2026-04-08T11:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T10:11:27.370Z",
      "x_nadsec_last_seen": "2026-03-07T10:11:27.370Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "152328"
      ],
      "x_nadsec_orgs": [
        "AVA BD NETWORK"
      ]
    },
    {
      "created": "2026-03-07T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d1b2a830-ad3e-429b-bf86-c1c4f16e3481",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:05:13.000Z",
      "valid_until": "2026-04-08T11:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T10:31:14.459Z",
      "x_nadsec_last_seen": "2026-03-13T20:35:15.141Z",
      "x_nadsec_ports": [
        "1433",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-07T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--49617a02-b7ce-4f8a-90f5-8f13b29fa08b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.89.61.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:05:13.000Z",
      "valid_until": "2026-04-08T11:05:11.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-07T10:26:11.937Z",
      "x_nadsec_last_seen": "2026-03-14T22:03:25.544Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-03-07T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=4750; asn_org=CS LOXINFO PUBLIC COMPANY LIMITED",
      "id": "indicator--0d186520-ae2b-4087-982d-fbad39195c1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.137.106.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:05:13.000Z",
      "valid_until": "2026-04-08T11:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T10:57:50.958Z",
      "x_nadsec_last_seen": "2026-03-07T10:58:21.960Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "4750"
      ],
      "x_nadsec_orgs": [
        "CS LOXINFO PUBLIC COMPANY LIMITED"
      ]
    },
    {
      "created": "2026-03-07T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--64f24033-d704-4c92-88a5-f570752b69ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.95.183.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T11:05:13.000Z",
      "valid_until": "2026-04-08T11:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T10:08:52.403Z",
      "x_nadsec_last_seen": "2026-03-07T10:13:02.508Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-07T12:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=30036; asn_org=Mediacom Communications Corp",
      "id": "indicator--93ac84e9-395f-4cfe-8b3a-8b2e1e98947d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.26.15.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:05:17.000Z",
      "valid_until": "2026-04-08T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T11:48:26.101Z",
      "x_nadsec_last_seen": "2026-03-07T11:50:31.611Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "30036"
      ],
      "x_nadsec_orgs": [
        "Mediacom Communications Corp"
      ]
    },
    {
      "created": "2026-03-07T12:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=56377; asn_org=JSC ER-Telecom Holding; user(top)=**",
      "id": "indicator--fca80239-b316-4068-bc0d-a34f11f5d93b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.215.199.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:05:17.000Z",
      "valid_until": "2026-04-08T12:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T11:47:22.816Z",
      "x_nadsec_last_seen": "2026-03-25T00:20:40.492Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "56377"
      ],
      "x_nadsec_orgs": [
        "JSC ER-Telecom Holding"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T12:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--78557298-05bc-4e08-85c8-3012104a06ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.127.202.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:05:17.000Z",
      "valid_until": "2026-04-08T12:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T11:17:48.172Z",
      "x_nadsec_last_seen": "2026-03-07T11:17:48.172Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-07T12:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mysqld; ports=3306; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--565e559c-5135-46e3-9adb-2d5e626383ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.137.136.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:05:17.000Z",
      "valid_until": "2026-04-08T12:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-07T11:46:56.191Z",
      "x_nadsec_last_seen": "2026-03-07T11:46:56.671Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-07T12:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--7ba55913-dd27-40aa-9ec8-00601e7e602c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.113.155.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:05:17.000Z",
      "valid_until": "2026-04-08T12:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T11:11:17.123Z",
      "x_nadsec_last_seen": "2026-03-07T11:11:53.269Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-07T12:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9f2af446-8d2c-4c25-bd9e-6f3e45e73a91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '48.217.84.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:05:17.000Z",
      "valid_until": "2026-04-08T12:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T11:15:05.983Z",
      "x_nadsec_last_seen": "2026-03-07T11:15:16.169Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-07T12:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:05:17.000Z",
      "valid_until": "2026-04-08T12:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T11:46:08.254Z",
      "x_nadsec_last_seen": "2026-03-20T00:56:41.214Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-07T12:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b5d030bd-3708-4d78-bc9c-96b483a63176",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '68.183.222.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:05:17.000Z",
      "valid_until": "2026-04-08T12:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T11:29:13.061Z",
      "x_nadsec_last_seen": "2026-03-07T11:29:24.365Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-07T12:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--286f2c30-6724-4691-90ff-3fc1f674fc67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.25.124.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:05:17.000Z",
      "valid_until": "2026-04-08T12:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T12:00:19.771Z",
      "x_nadsec_last_seen": "2026-03-07T12:12:46.137Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-07T12:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IL; asn=8551; asn_org=Bezeq International Ltd.",
      "id": "indicator--39b57656-b73b-4b51-81b7-5e1b6ef20327",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T12:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.218.82.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:05:17.000Z",
      "valid_until": "2026-04-08T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T11:27:23.053Z",
      "x_nadsec_last_seen": "2026-03-07T11:29:29.873Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "8551"
      ],
      "x_nadsec_orgs": [
        "Bezeq International Ltd."
      ]
    },
    {
      "created": "2026-03-07T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0f5db2e1-5fee-4821-969c-cf5a22484d57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.248.117.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:05:13.000Z",
      "valid_until": "2026-04-08T13:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T12:05:29.485Z",
      "x_nadsec_last_seen": "2026-03-07T12:05:29.485Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-07T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--279db4ae-7380-4ab4-b346-3823ef5e354e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.160.115.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:05:13.000Z",
      "valid_until": "2026-04-08T13:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T12:41:00.071Z",
      "x_nadsec_last_seen": "2026-03-07T12:41:00.071Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-07T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fdf2e1d8-f2bb-4158-ac00-56099ee964e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.160.121.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:05:13.000Z",
      "valid_until": "2026-04-08T13:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T12:41:00.300Z",
      "x_nadsec_last_seen": "2026-03-07T12:43:04.821Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-07T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LA; asn=9873; asn_org=Lao Telecom Communication, LTC",
      "id": "indicator--3571ec63-024e-4c44-ba6f-ed8c8489f99a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.84.87.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:05:13.000Z",
      "valid_until": "2026-04-08T13:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T12:57:46.572Z",
      "x_nadsec_last_seen": "2026-03-07T12:57:51.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "9873"
      ],
      "x_nadsec_orgs": [
        "Lao Telecom Communication, LTC"
      ]
    },
    {
      "created": "2026-03-07T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--07ab7a41-a7e5-4d54-ae39-71fbe9525f2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.60.246.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:05:13.000Z",
      "valid_until": "2026-04-08T13:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T12:24:27.224Z",
      "x_nadsec_last_seen": "2026-03-07T12:32:20.114Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-07T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--0229d06c-41b1-4dd2-a871-16d5704216b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.69.6.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:05:13.000Z",
      "valid_until": "2026-04-08T13:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T13:02:11.922Z",
      "x_nadsec_last_seen": "2026-03-07T13:02:11.922Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-07T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--b599d0c1-c1ea-4488-917c-ac16a1020cb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.72.112.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:05:13.000Z",
      "valid_until": "2026-04-08T13:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T12:43:04.051Z",
      "x_nadsec_last_seen": "2026-03-07T12:43:04.051Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-07T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CA; asn=6327; asn_org=Shaw Communications",
      "id": "indicator--c43ec100-4829-4d8b-9fab-1b2cdbb00a2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '50.71.230.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:05:13.000Z",
      "valid_until": "2026-04-08T13:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T12:58:20.301Z",
      "x_nadsec_last_seen": "2026-03-07T13:00:25.631Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "6327"
      ],
      "x_nadsec_orgs": [
        "Shaw Communications"
      ]
    },
    {
      "created": "2026-03-07T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--290620fd-4dbe-47e5-8341-2682d79e58d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.227.30.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:05:13.000Z",
      "valid_until": "2026-04-08T13:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T12:05:31.015Z",
      "x_nadsec_last_seen": "2026-03-07T12:05:31.015Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-07T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=31725; asn_org=ISP Shtorm LTD",
      "id": "indicator--234ebc10-aeb4-4cc6-b79e-9b3369d35292",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.201.246.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T13:05:13.000Z",
      "valid_until": "2026-04-08T13:05:12.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-07T12:27:11.279Z",
      "x_nadsec_last_seen": "2026-03-07T14:37:35.772Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "31725"
      ],
      "x_nadsec_orgs": [
        "ISP Shtorm LTD"
      ]
    },
    {
      "created": "2026-03-07T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=202412; asn_org=Omegatech LTD",
      "id": "indicator--a77c1360-0aef-4a92-a9a9-b1d494c9aa29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:05:13.000Z",
      "valid_until": "2026-04-08T14:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T13:22:04.163Z",
      "x_nadsec_last_seen": "2026-03-07T13:22:04.175Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ]
    },
    {
      "created": "2026-03-07T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5ccf5355-f713-4038-99d0-19e3997d9e64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.241.136.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:05:13.000Z",
      "valid_until": "2026-04-08T14:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T13:24:59.682Z",
      "x_nadsec_last_seen": "2026-03-07T13:24:59.682Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-07T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=55685; asn_org=PT Jala Lintas Media",
      "id": "indicator--871ac0ea-d262-4fd5-b9b5-4fbbd496dac1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.51.211.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:05:13.000Z",
      "valid_until": "2026-04-08T14:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T13:33:24.663Z",
      "x_nadsec_last_seen": "2026-03-07T13:35:29.049Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "55685"
      ],
      "x_nadsec_orgs": [
        "PT Jala Lintas Media"
      ]
    },
    {
      "created": "2026-03-07T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MY; asn=45785; asn_org=TechAvenue Malaysia",
      "id": "indicator--0b8051d7-3e44-423a-bf09-2e341ec7f365",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.1.224.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:05:13.000Z",
      "valid_until": "2026-04-08T14:05:11.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T13:50:15.302Z",
      "x_nadsec_last_seen": "2026-03-07T13:57:20.039Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45785"
      ],
      "x_nadsec_orgs": [
        "TechAvenue Malaysia"
      ]
    },
    {
      "created": "2026-03-07T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--ab678140-5d53-4e50-a174-2f2b83ca8943",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.14.150.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:05:13.000Z",
      "valid_until": "2026-04-08T14:05:11.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T13:29:57.328Z",
      "x_nadsec_last_seen": "2026-03-07T13:32:04.526Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-07T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--db863a7e-897f-4242-833f-ca880eefc74b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.78.138.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:05:13.000Z",
      "valid_until": "2026-04-08T14:05:11.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T14:04:24.345Z",
      "x_nadsec_last_seen": "2026-03-10T05:43:35.103Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=YE; asn=30873; asn_org=Public Telecommunication Corporation",
      "id": "indicator--04dc63e8-9000-47ee-8bb7-2f99fd57d0ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.114.171.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:05:13.000Z",
      "valid_until": "2026-04-08T14:05:11.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T13:24:18.351Z",
      "x_nadsec_last_seen": "2026-03-07T13:25:02.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "YE"
      ],
      "x_nadsec_asns": [
        "30873"
      ],
      "x_nadsec_orgs": [
        "Public Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-07T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=RU; asn=211860; asn_org=Nerushenko Vyacheslav Nikolaevich",
      "id": "indicator--db3d9dee-d13d-4f9d-80fc-533d4ea480fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.147.84.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:05:13.000Z",
      "valid_until": "2026-04-08T14:05:11.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T13:32:51.957Z",
      "x_nadsec_last_seen": "2026-03-07T13:32:51.957Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "211860"
      ],
      "x_nadsec_orgs": [
        "Nerushenko Vyacheslav Nikolaevich"
      ]
    },
    {
      "created": "2026-03-07T15:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--5ba3bda3-037a-4bff-95b9-b3504704fa39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.82.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:05:08.000Z",
      "valid_until": "2026-04-08T15:05:07.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T14:18:50.522Z",
      "x_nadsec_last_seen": "2026-03-07T14:27:49.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-07T15:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--34c3d71c-8fcf-468b-93e2-88d0e3378eb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.19.33.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:05:08.000Z",
      "valid_until": "2026-04-08T15:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T14:49:19.480Z",
      "x_nadsec_last_seen": "2026-03-07T14:51:24.589Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-07T15:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=133982; asn_org=Excitel Broadband Private Limited",
      "id": "indicator--82b58437-d07d-420b-9a01-8101459b7636",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.5.248.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:05:08.000Z",
      "valid_until": "2026-04-08T15:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T15:01:11.207Z",
      "x_nadsec_last_seen": "2026-03-07T15:03:16.849Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133982"
      ],
      "x_nadsec_orgs": [
        "Excitel Broadband Private Limited"
      ]
    },
    {
      "created": "2026-03-07T15:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f949460b-3cc0-48cf-a8dc-7d95931e0c42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.133.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:05:08.000Z",
      "valid_until": "2026-04-08T15:05:07.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-03-07T14:15:56.005Z",
      "x_nadsec_last_seen": "2026-03-17T08:17:22.257Z",
      "x_nadsec_ports": [
        "27017",
        "135"
      ],
      "x_nadsec_services": [
        "mongod",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-07T15:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=37340; asn_org=Spectranet",
      "id": "indicator--aa29f52f-6b50-42fa-a7a0-b09792e776a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.118.43.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:05:08.000Z",
      "valid_until": "2026-04-08T15:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T14:30:20.196Z",
      "x_nadsec_last_seen": "2026-03-07T14:32:28.106Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37340"
      ],
      "x_nadsec_orgs": [
        "Spectranet"
      ]
    },
    {
      "created": "2026-03-07T15:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--d54db283-3cb9-4c7e-bbe6-eb891c99c5db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.242.247.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:05:08.000Z",
      "valid_until": "2026-04-08T15:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T14:57:47.903Z",
      "x_nadsec_last_seen": "2026-03-07T14:59:54.099Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-07T15:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=SV; asn=26617; asn_org=Navega.com S.A.",
      "id": "indicator--56d7a865-681d-4c0b-b03b-5cc81cd76755",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.120.9.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:05:08.000Z",
      "valid_until": "2026-04-08T15:05:07.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T15:03:10.698Z",
      "x_nadsec_last_seen": "2026-03-07T15:10:05.372Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SV"
      ],
      "x_nadsec_asns": [
        "26617"
      ],
      "x_nadsec_orgs": [
        "Navega.com S.A."
      ]
    },
    {
      "created": "2026-03-07T15:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:05:08.000Z",
      "valid_until": "2026-04-08T15:05:07.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-07T14:11:49.371Z",
      "x_nadsec_last_seen": "2026-03-30T12:02:22.221Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "21",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd",
        "ftpd",
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-07T15:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5d10041d-25ec-4c75-8b6f-0dca84da39a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:05:08.000Z",
      "valid_until": "2026-04-08T15:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T14:17:48.706Z",
      "x_nadsec_last_seen": "2026-03-16T18:05:29.998Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-07T15:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b1ac55be-131f-4fe7-860b-57bb247a4e9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T15:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:05:08.000Z",
      "valid_until": "2026-04-08T15:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T14:17:48.408Z",
      "x_nadsec_last_seen": "2026-03-16T18:05:54.266Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-07T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BD; asn=147181; asn_org=Flarezen Ltd.; user(top)=**",
      "id": "indicator--d436c95d-37c3-44b8-b662-22ac0b232c36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.174.50.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:05:13.000Z",
      "valid_until": "2026-04-08T16:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T15:23:58.144Z",
      "x_nadsec_last_seen": "2026-03-22T11:15:48.899Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "147181"
      ],
      "x_nadsec_orgs": [
        "Flarezen Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--912590df-822f-4546-a140-af87c53cff20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.212.201.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:05:13.000Z",
      "valid_until": "2026-04-08T16:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T15:51:44.229Z",
      "x_nadsec_last_seen": "2026-03-07T15:51:44.932Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-07T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--e22d63a2-ae3d-44b9-8a9a-63791d76e4eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.115.157.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:05:13.000Z",
      "valid_until": "2026-04-08T16:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T16:02:45.741Z",
      "x_nadsec_last_seen": "2026-03-07T16:04:51.944Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-07T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--37ac87c9-4c99-439b-b878-42bbaec0d7b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.115.208.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:05:13.000Z",
      "valid_until": "2026-04-08T16:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T15:55:26.271Z",
      "x_nadsec_last_seen": "2026-03-07T15:57:33.365Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-07T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IQ; asn=206206; asn_org=Kurdistan Net Company for Computer and Internet Ltd.",
      "id": "indicator--42bfca8d-7dcc-43ee-a715-e7da09df5c53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.156.104.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:05:13.000Z",
      "valid_until": "2026-04-08T16:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T15:54:50.918Z",
      "x_nadsec_last_seen": "2026-03-07T15:56:57.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IQ"
      ],
      "x_nadsec_asns": [
        "206206"
      ],
      "x_nadsec_orgs": [
        "Kurdistan Net Company for Computer and Internet Ltd."
      ]
    },
    {
      "created": "2026-03-07T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=150008; asn_org=Pioneer Elabs Ltd.",
      "id": "indicator--4d8d9404-8d42-46be-9a98-00781cfb5643",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.24.125.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:05:13.000Z",
      "valid_until": "2026-04-08T17:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T16:36:11.268Z",
      "x_nadsec_last_seen": "2026-03-07T16:38:16.013Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "150008"
      ],
      "x_nadsec_orgs": [
        "Pioneer Elabs Ltd."
      ]
    },
    {
      "created": "2026-03-07T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--07196b8c-12c4-4120-acbf-883810b4de63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.161.46.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:05:13.000Z",
      "valid_until": "2026-04-08T17:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T16:59:16.977Z",
      "x_nadsec_last_seen": "2026-03-07T17:01:21.644Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-07T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--07d01aee-8e9f-4cf3-a732-2d8abc21466f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.149.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:05:13.000Z",
      "valid_until": "2026-04-08T17:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-07T16:45:50.831Z",
      "x_nadsec_last_seen": "2026-03-07T16:46:48.739Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=FR; asn=39351; asn_org=31173 Services AB",
      "id": "indicator--118b2e7b-4a36-41a6-b1d4-8a836371c5e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.32.126.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:05:13.000Z",
      "valid_until": "2026-04-08T17:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T16:33:55.592Z",
      "x_nadsec_last_seen": "2026-03-07T16:33:55.592Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "39351"
      ],
      "x_nadsec_orgs": [
        "31173 Services AB"
      ]
    },
    {
      "created": "2026-03-07T17:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=KR; asn=4670; asn_org=Shinbiro",
      "id": "indicator--10832eae-bf60-48cb-a361-9ee57937b0f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T17:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.111.154.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:05:13.000Z",
      "valid_until": "2026-04-08T17:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T16:54:05.108Z",
      "x_nadsec_last_seen": "2026-03-12T12:25:26.968Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "4670"
      ],
      "x_nadsec_orgs": [
        "Shinbiro"
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=151690; asn_org=FAB FIVE NETWORK PRIVATE LIMITED",
      "id": "indicator--c777789c-2137-400d-b3d4-07eed4506f66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.162.74.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T19:01:24.252Z",
      "x_nadsec_last_seen": "2026-03-07T19:03:29.213Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151690"
      ],
      "x_nadsec_orgs": [
        "FAB FIVE NETWORK PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=262378; asn_org=Compuservice Empreendimentos Ltda",
      "id": "indicator--c462fd35-f1c0-432c-9c99-de5f4419eb47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.79.192.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T18:56:12.904Z",
      "x_nadsec_last_seen": "2026-03-07T18:56:13.212Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262378"
      ],
      "x_nadsec_orgs": [
        "Compuservice Empreendimentos Ltda"
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--4595812c-84ad-40a2-849e-958665d05b00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.210.191.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-07T18:45:47.191Z",
      "x_nadsec_last_seen": "2026-03-09T08:59:31.251Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--abbb9b33-1484-4925-9dff-b971832eb102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.236.77.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-03-07T18:09:42.801Z",
      "x_nadsec_last_seen": "2026-03-28T20:46:44.625Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=122; services=mysqld; ports=3306; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--18179414-9bbd-49f9-9256-a11585f8bfb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.31.162.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 122,
      "x_nadsec_first_seen": "2026-03-07T18:06:00.651Z",
      "x_nadsec_last_seen": "2026-03-07T18:20:02.131Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t",
        "r******v"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=21497; asn_org=PrJSC VF UKRAINE",
      "id": "indicator--d1b02a5b-d27c-4d3a-9743-ac8cdc41b106",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.136.105.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T18:15:25.930Z",
      "x_nadsec_last_seen": "2026-03-07T18:17:32.280Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "21497"
      ],
      "x_nadsec_orgs": [
        "PrJSC VF UKRAINE"
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=262916; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--baea6f51-f88f-419f-a305-fbe1bfde1330",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.196.23.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-07T18:09:46.599Z",
      "x_nadsec_last_seen": "2026-03-22T14:43:08.647Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "262916"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AR; asn=27983; asn_org=Red Intercable Digital S.A.; user(top)=**",
      "id": "indicator--a2db2f4b-7d00-45b5-84af-bd7c8aecb200",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.182.160.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T18:05:44.827Z",
      "x_nadsec_last_seen": "2026-03-18T05:56:21.914Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27983"
      ],
      "x_nadsec_orgs": [
        "Red Intercable Digital S.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=UA; asn=6876; asn_org=TENET Scientific Production Enterprise LLC",
      "id": "indicator--f0c84942-9a41-416f-95e3-6f7e71a1bdc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.138.73.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T18:41:56.698Z",
      "x_nadsec_last_seen": "2026-03-21T22:20:38.906Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "6876"
      ],
      "x_nadsec_orgs": [
        "TENET Scientific Production Enterprise LLC"
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=39232; asn_org=Uninet LLC",
      "id": "indicator--eb6657bc-bbc3-4dfd-9dd0-45e873ad37df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.25.16.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T18:06:56.812Z",
      "x_nadsec_last_seen": "2026-03-07T18:09:04.118Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "39232"
      ],
      "x_nadsec_orgs": [
        "Uninet LLC"
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--f8956b90-5815-4dab-92c1-838d4ba79c00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.151.241.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 83,
      "x_nadsec_first_seen": "2026-03-07T19:00:14.486Z",
      "x_nadsec_last_seen": "2026-03-30T18:38:19.476Z",
      "x_nadsec_ports": [
        "1723",
        "1433",
        "81",
        "27017",
        "445"
      ],
      "x_nadsec_services": [
        "pptpd",
        "mssqld",
        "httpd",
        "mongod",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=37282; asn_org=MAINONE",
      "id": "indicator--4f9c2acf-dbe2-4dde-a93b-316ab57efb40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.75.89.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T18:20:52.309Z",
      "x_nadsec_last_seen": "2026-03-07T18:22:59.399Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37282"
      ],
      "x_nadsec_orgs": [
        "MAINONE"
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--017abcc4-702b-4b9a-b322-3b015681c62c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.200.150.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T18:32:27.246Z",
      "x_nadsec_last_seen": "2026-03-09T10:18:57.247Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=401626; asn_org=Netiface America, Inc.",
      "id": "indicator--f272a864-2c0c-444b-99f0-5aa65fb85e30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-03-07T19:01:10.022Z",
      "x_nadsec_last_seen": "2026-03-31T17:12:28.165Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom; user(top)=**",
      "id": "indicator--9c4b21c3-00eb-42f7-8465-301b9c43197a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.187.202.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-07T18:33:43.311Z",
      "x_nadsec_last_seen": "2026-03-17T23:03:18.547Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T19:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.; user(top)=**",
      "id": "indicator--5beaf10c-9290-4557-a825-44b6556c8eed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T19:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.35.227.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T19:05:06.000Z",
      "valid_until": "2026-04-08T19:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T18:50:42.163Z",
      "x_nadsec_last_seen": "2026-03-07T18:50:42.163Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--9e990493-c657-46e6-a04b-af4511ffa2c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.189.16.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T20:05:13.000Z",
      "valid_until": "2026-04-08T20:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-07T19:50:08.306Z",
      "x_nadsec_last_seen": "2026-03-08T20:39:19.239Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-07T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--e5e73804-ce61-4949-9e6b-e21c1e1f0755",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.76.129.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T20:05:13.000Z",
      "valid_until": "2026-04-08T20:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T19:08:20.155Z",
      "x_nadsec_last_seen": "2026-03-07T19:15:36.088Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-07T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=7738; asn_org=V tal",
      "id": "indicator--f0eadbd9-86bb-4d46-b109-26eaa2bc4bbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.80.44.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T20:05:13.000Z",
      "valid_until": "2026-04-08T20:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-07T19:16:16.018Z",
      "x_nadsec_last_seen": "2026-03-09T00:11:31.496Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "7738"
      ],
      "x_nadsec_orgs": [
        "V tal"
      ]
    },
    {
      "created": "2026-03-07T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5f3579ea-321e-4d00-9219-f91ba950d9f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T20:05:13.000Z",
      "valid_until": "2026-04-08T20:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T19:44:00.027Z",
      "x_nadsec_last_seen": "2026-03-17T07:15:52.394Z",
      "x_nadsec_ports": [
        "21",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-07T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--4f6b2862-7382-4cc4-8ec9-86e65491d8e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.79.198.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T20:05:13.000Z",
      "valid_until": "2026-04-08T20:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-07T19:18:56.113Z",
      "x_nadsec_last_seen": "2026-03-23T04:21:29.375Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-07T21:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--dc553fe1-0cbb-442e-8b30-84671263a66c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.58.129.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:05:07.000Z",
      "valid_until": "2026-04-08T21:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T20:44:25.177Z",
      "x_nadsec_last_seen": "2026-03-07T20:44:25.177Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-07T21:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--8328a6b3-017c-42de-b818-3fe4e81e5a19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.16.199.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:05:07.000Z",
      "valid_until": "2026-04-08T21:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T21:01:40.397Z",
      "x_nadsec_last_seen": "2026-03-22T01:29:45.611Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T21:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=36352; asn_org=HostPapa",
      "id": "indicator--54859a43-5855-464f-856c-cdc7021c42e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.245.21.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:05:07.000Z",
      "valid_until": "2026-04-08T21:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T20:39:54.750Z",
      "x_nadsec_last_seen": "2026-03-08T16:53:52.471Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "36352"
      ],
      "x_nadsec_orgs": [
        "HostPapa"
      ]
    },
    {
      "created": "2026-03-07T21:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=52724; asn_org=Adriano Telecomunicacoes Ltda Me",
      "id": "indicator--599ba6ba-ab86-42c5-993c-5e8e74025585",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.84.143.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:05:07.000Z",
      "valid_until": "2026-04-08T21:05:05.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-07T21:01:13.587Z",
      "x_nadsec_last_seen": "2026-03-20T22:22:14.943Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52724"
      ],
      "x_nadsec_orgs": [
        "Adriano Telecomunicacoes Ltda Me"
      ]
    },
    {
      "created": "2026-03-07T21:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--e868f8a4-9f48-4188-a7eb-768dedbf3d62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.245.215.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:05:07.000Z",
      "valid_until": "2026-04-08T21:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T20:47:37.757Z",
      "x_nadsec_last_seen": "2026-03-07T20:49:43.993Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-03-07T21:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28573; asn_org=Claro NXT Telecomunicacoes Ltda",
      "id": "indicator--1f50e6a3-3986-425f-ab6f-4567cc3b71f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.177.177.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:05:07.000Z",
      "valid_until": "2026-04-08T21:05:05.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-07T20:05:31.627Z",
      "x_nadsec_last_seen": "2026-03-14T19:39:47.442Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28573"
      ],
      "x_nadsec_orgs": [
        "Claro NXT Telecomunicacoes Ltda"
      ]
    },
    {
      "created": "2026-03-07T21:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=4382; asn_org=PT. Indonusa System Integrator Prima",
      "id": "indicator--1d60a809-d74b-4179-b85d-8976d07e10d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.93.133.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:05:07.000Z",
      "valid_until": "2026-04-08T21:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T20:11:28.127Z",
      "x_nadsec_last_seen": "2026-03-07T20:11:28.290Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4382"
      ],
      "x_nadsec_orgs": [
        "PT. Indonusa System Integrator Prima"
      ]
    },
    {
      "created": "2026-03-07T21:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--c76533df-98e3-4c20-af00-68934e5a5c7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.140.175.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:05:07.000Z",
      "valid_until": "2026-04-08T21:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T21:01:05.828Z",
      "x_nadsec_last_seen": "2026-03-07T21:01:05.828Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-07T21:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--cc60b0a6-a201-40bb-828d-11dbc58ef445",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:05:07.000Z",
      "valid_until": "2026-04-08T21:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T20:29:21.771Z",
      "x_nadsec_last_seen": "2026-03-16T18:05:30.291Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-07T21:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--88bfb627-5e75-4c92-bc04-fa1e2cdc3f2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:05:07.000Z",
      "valid_until": "2026-04-08T21:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T20:28:45.354Z",
      "x_nadsec_last_seen": "2026-03-07T20:29:11.444Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-07T21:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--83dc463c-450f-4ba2-bba6-11f8cb25004f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T21:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:05:07.000Z",
      "valid_until": "2026-04-08T21:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T20:28:45.612Z",
      "x_nadsec_last_seen": "2026-03-07T20:28:45.612Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-07T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services; user(top)=**",
      "id": "indicator--00b1630f-bd70-4279-9897-4b58c9b503c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.163.178.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T22:05:09.000Z",
      "valid_until": "2026-04-08T22:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T21:28:23.259Z",
      "x_nadsec_last_seen": "2026-03-07T21:28:23.259Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-07T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=17222; asn_org=MUNDIVOX DO BRASIL LTDA",
      "id": "indicator--f78e1f11-8e4d-4465-8793-4224dd02cdfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.191.65.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T22:05:09.000Z",
      "valid_until": "2026-04-08T22:05:07.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T21:06:56.300Z",
      "x_nadsec_last_seen": "2026-03-07T21:14:46.088Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "17222"
      ],
      "x_nadsec_orgs": [
        "MUNDIVOX DO BRASIL LTDA"
      ]
    },
    {
      "created": "2026-03-07T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--0e6b0bfc-4953-4d2b-9278-0762e8ac540e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.53.109.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T22:05:09.000Z",
      "valid_until": "2026-04-08T22:05:07.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-07T22:04:29.572Z",
      "x_nadsec_last_seen": "2026-03-10T04:58:03.717Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-07T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=203971; asn_org=AzFiberNet LLC",
      "id": "indicator--53410b0d-639b-42ef-955f-c56a357498d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.222.94.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T22:05:09.000Z",
      "valid_until": "2026-04-08T22:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T21:10:13.875Z",
      "x_nadsec_last_seen": "2026-03-07T21:12:20.592Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "203971"
      ],
      "x_nadsec_orgs": [
        "AzFiberNet LLC"
      ]
    },
    {
      "created": "2026-03-07T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--575375d3-64d6-42fa-97fe-9c9ca7a7a676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T22:05:09.000Z",
      "valid_until": "2026-04-08T22:05:07.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T21:35:07.218Z",
      "x_nadsec_last_seen": "2026-03-07T21:35:07.758Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-07T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--316588b7-d7a7-446a-a735-3daaa086741d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '90.154.61.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T22:05:09.000Z",
      "valid_until": "2026-04-08T22:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T22:02:07.868Z",
      "x_nadsec_last_seen": "2026-03-07T22:04:27.424Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-07T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--4e54e106-c8e9-4480-9e71-d4704daf43c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T22:05:09.000Z",
      "valid_until": "2026-04-08T22:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T21:10:12.726Z",
      "x_nadsec_last_seen": "2026-03-07T21:10:12.726Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-07T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d93c64b9-36ca-4122-b7c8-5e60c9810917",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T22:05:09.000Z",
      "valid_until": "2026-04-08T22:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T21:10:34.796Z",
      "x_nadsec_last_seen": "2026-03-07T21:10:34.796Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-07T22:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--12eaf260-9f9e-44bb-81b2-7c0c4c0a9cbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T22:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T22:05:09.000Z",
      "valid_until": "2026-04-08T22:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T21:10:12.048Z",
      "x_nadsec_last_seen": "2026-03-07T21:10:34.278Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-07T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--3cac3469-5c32-4c9b-9bc3-a40719e6af86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.93.7.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T23:05:09.000Z",
      "valid_until": "2026-04-08T23:05:07.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T22:57:42.090Z",
      "x_nadsec_last_seen": "2026-03-07T22:58:12.306Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-03-07T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--4b406c43-16ea-4665-aafc-cb73672daa3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T23:05:09.000Z",
      "valid_until": "2026-04-08T23:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-07T22:31:19.949Z",
      "x_nadsec_last_seen": "2026-03-07T22:31:19.949Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-07T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--8425456b-dd07-4abb-94d3-1fc57d90ce45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T23:05:09.000Z",
      "valid_until": "2026-04-08T23:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T22:17:04.056Z",
      "x_nadsec_last_seen": "2026-03-07T22:17:34.058Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-07T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=15924; asn_org=Vodafone Net Iletisim Hizmetler AS",
      "id": "indicator--5030285c-f5ac-4277-b773-02f91c7ec03c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.87.99.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T23:05:09.000Z",
      "valid_until": "2026-04-08T23:05:07.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-07T22:38:56.753Z",
      "x_nadsec_last_seen": "2026-03-13T15:58:02.651Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "15924"
      ],
      "x_nadsec_orgs": [
        "Vodafone Net Iletisim Hizmetler AS"
      ]
    },
    {
      "created": "2026-03-07T23:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17426; asn_org=Primesoftex Ltd",
      "id": "indicator--278198aa-e582-4ead-aa9d-1ef96d0169c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-07T23:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.115.96.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T23:05:09.000Z",
      "valid_until": "2026-04-08T23:05:07.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-07T22:16:33.530Z",
      "x_nadsec_last_seen": "2026-03-18T06:24:50.425Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17426"
      ],
      "x_nadsec_orgs": [
        "Primesoftex Ltd"
      ]
    },
    {
      "created": "2026-03-08T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--6b5f6ac4-3d9e-4aef-ab3c-9d5f56835d57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:05:13.000Z",
      "valid_until": "2026-04-09T00:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-07T23:59:34.631Z",
      "x_nadsec_last_seen": "2026-03-08T00:00:41.428Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-08T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--758c942f-c905-4030-87af-9ccf1b41d00f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:05:13.000Z",
      "valid_until": "2026-04-09T00:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T00:00:30.883Z",
      "x_nadsec_last_seen": "2026-03-08T00:00:30.883Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-08T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--06c25a7b-6934-4219-acab-d1d0a62479e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:05:13.000Z",
      "valid_until": "2026-04-09T00:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-07T23:59:44.485Z",
      "x_nadsec_last_seen": "2026-03-08T00:00:25.883Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-08T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--90918056-9489-4cbb-9a87-8c40cb2e19a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:05:13.000Z",
      "valid_until": "2026-04-09T00:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-07T23:59:36.508Z",
      "x_nadsec_last_seen": "2026-03-08T00:00:09.700Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-08T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--75af714f-d3bf-4b75-bb41-ac6a93fae112",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.159.94.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:05:13.000Z",
      "valid_until": "2026-04-09T00:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T23:54:24.085Z",
      "x_nadsec_last_seen": "2026-03-07T23:54:30.800Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-08T00:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--cae2226c-935e-4d09-bb12-89dc76987fee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T00:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.12.190.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:05:13.000Z",
      "valid_until": "2026-04-09T00:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-07T23:40:07.613Z",
      "x_nadsec_last_seen": "2026-03-07T23:42:14.874Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-03-08T01:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--34d348a9-f71e-4ec7-80f9-9290795f668d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T01:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.75.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:05:15.000Z",
      "valid_until": "2026-04-09T01:05:12.000Z",
      "x_nadsec_event_count": 23,
      "x_nadsec_first_seen": "2026-03-08T01:00:03.334Z",
      "x_nadsec_last_seen": "2026-03-13T03:36:31.259Z",
      "x_nadsec_ports": [
        "1723",
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "pptpd",
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-08T01:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T01:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:05:15.000Z",
      "valid_until": "2026-04-09T01:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T00:16:19.907Z",
      "x_nadsec_last_seen": "2026-03-18T00:51:26.193Z",
      "x_nadsec_ports": [
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-08T01:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ff82af86-7a6b-4844-adea-23170d00c845",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T01:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:05:15.000Z",
      "valid_until": "2026-04-09T01:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T00:24:55.367Z",
      "x_nadsec_last_seen": "2026-03-22T03:37:06.985Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-08T01:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CL; asn=14259; asn_org=Gtd Internet S.A.",
      "id": "indicator--f4b63db1-4062-444d-a8f0-025c41965707",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T01:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.75.16.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:05:15.000Z",
      "valid_until": "2026-04-09T01:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T00:15:27.701Z",
      "x_nadsec_last_seen": "2026-03-08T00:22:34.243Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "14259"
      ],
      "x_nadsec_orgs": [
        "Gtd Internet S.A."
      ]
    },
    {
      "created": "2026-03-08T01:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--e3cc5b59-41e1-43d4-a9a0-1858a15bf3c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T01:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.35.195.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:05:15.000Z",
      "valid_until": "2026-04-09T01:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-08T01:01:27.852Z",
      "x_nadsec_last_seen": "2026-03-11T21:58:43.508Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-08T01:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--a366b5c8-28b0-4467-aabf-98f57f99f01e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T01:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.240.205.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:05:15.000Z",
      "valid_until": "2026-04-09T01:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T00:59:20.992Z",
      "x_nadsec_last_seen": "2026-03-25T00:25:57.320Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-08T01:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BH; asn=5416; asn_org=Beyon B.s.c.",
      "id": "indicator--b993ae62-1a91-4593-b287-8c3ef38475c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T01:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.69.141.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:05:15.000Z",
      "valid_until": "2026-04-09T01:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-08T00:19:32.155Z",
      "x_nadsec_last_seen": "2026-03-23T01:41:40.297Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BH"
      ],
      "x_nadsec_asns": [
        "5416"
      ],
      "x_nadsec_orgs": [
        "Beyon B.s.c."
      ]
    },
    {
      "created": "2026-03-08T01:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom; user(top)=**",
      "id": "indicator--8e683a40-8247-4d05-872e-9917c2770bc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T01:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.96.242.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:05:15.000Z",
      "valid_until": "2026-04-09T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T00:34:27.465Z",
      "x_nadsec_last_seen": "2026-03-08T00:34:27.465Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-08T02:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=133255; asn_org=Elxer Communications Private Limited",
      "id": "indicator--7001ccbe-238f-46af-9969-3bc11ff7ea1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T02:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.39.236.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T02:05:14.000Z",
      "valid_until": "2026-04-09T02:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T01:05:09.589Z",
      "x_nadsec_last_seen": "2026-03-08T01:05:37.404Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133255"
      ],
      "x_nadsec_orgs": [
        "Elxer Communications Private Limited"
      ]
    },
    {
      "created": "2026-03-08T02:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--b4326f00-ce6d-45af-ab5a-f219f1a00714",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T02:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T02:05:14.000Z",
      "valid_until": "2026-04-09T02:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T01:25:07.222Z",
      "x_nadsec_last_seen": "2026-03-19T07:43:21.229Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-08T02:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--c8881fc3-8f76-4c6b-bafd-09b175637513",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T02:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.115.161.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T02:05:14.000Z",
      "valid_until": "2026-04-09T02:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T01:11:04.256Z",
      "x_nadsec_last_seen": "2026-03-08T01:13:10.474Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-08T02:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=24435; asn_org=Supernet Limited Transit Autonomous System Number",
      "id": "indicator--7f0e6170-7096-472c-a352-4b1355709338",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T02:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.130.24.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T02:05:14.000Z",
      "valid_until": "2026-04-09T02:05:12.000Z",
      "x_nadsec_event_count": 27,
      "x_nadsec_first_seen": "2026-03-08T01:59:48.227Z",
      "x_nadsec_last_seen": "2026-03-31T03:39:05.489Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "24435"
      ],
      "x_nadsec_orgs": [
        "Supernet Limited Transit Autonomous System Number"
      ]
    },
    {
      "created": "2026-03-08T02:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3308ce26-ce6c-4d80-a253-5a75261bdda7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T02:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T02:05:14.000Z",
      "valid_until": "2026-04-09T02:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T01:49:36.197Z",
      "x_nadsec_last_seen": "2026-03-08T01:49:36.197Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-08T02:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8568e97e-19c3-45d2-a61f-bdbc573194f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T02:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T02:05:14.000Z",
      "valid_until": "2026-04-09T02:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T01:37:50.658Z",
      "x_nadsec_last_seen": "2026-03-14T18:51:11.855Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-08T02:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b16c1976-9dcd-4bdb-9e7d-e415bb1dca58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T02:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.249.178.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T02:05:14.000Z",
      "valid_until": "2026-04-09T02:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T01:25:26.359Z",
      "x_nadsec_last_seen": "2026-03-08T01:25:26.359Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-08T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--e1c6e794-e46e-4ac7-b93b-69851e16c8bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.23.54.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:05:14.000Z",
      "valid_until": "2026-04-09T03:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T02:30:06.864Z",
      "x_nadsec_last_seen": "2026-03-08T02:32:11.776Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-08T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=BR; asn=264521; asn_org=SLIM NET TELECOM LTDA; user(top)=**",
      "id": "indicator--27f66e9b-6134-4f9c-8bd5-8bf53799399b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '132.255.212.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:05:14.000Z",
      "valid_until": "2026-04-09T03:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T02:16:18.808Z",
      "x_nadsec_last_seen": "2026-03-27T01:10:02.206Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264521"
      ],
      "x_nadsec_orgs": [
        "SLIM NET TELECOM LTDA"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-08T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=smbd; ports=445; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4c4cc434-9199-44b5-9e9d-c90cca899de3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.216.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:05:14.000Z",
      "valid_until": "2026-04-09T03:05:12.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-08T02:48:21.465Z",
      "x_nadsec_last_seen": "2026-03-08T02:49:14.989Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-08T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--11c15d64-b857-4685-8545-843d3c5029c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.208.24.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:05:14.000Z",
      "valid_until": "2026-04-09T03:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T02:49:49.911Z",
      "x_nadsec_last_seen": "2026-03-08T02:49:49.911Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-08T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--7db10e79-fe3a-41cc-867c-477183264684",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.242.205.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:05:14.000Z",
      "valid_until": "2026-04-09T03:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T02:56:35.736Z",
      "x_nadsec_last_seen": "2026-03-08T02:56:35.987Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-08T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45903; asn_org=CMC Telecom Infrastructure Company",
      "id": "indicator--5fe247b9-4419-41b1-ab83-0ee93a539fc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.91.4.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:05:14.000Z",
      "valid_until": "2026-04-09T03:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T02:20:24.633Z",
      "x_nadsec_last_seen": "2026-03-08T02:22:29.390Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45903"
      ],
      "x_nadsec_orgs": [
        "CMC Telecom Infrastructure Company"
      ]
    },
    {
      "created": "2026-03-08T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b9a236e6-f5b6-4e03-b53e-3324f6e72883",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:05:14.000Z",
      "valid_until": "2026-04-09T03:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T02:27:58.286Z",
      "x_nadsec_last_seen": "2026-03-16T00:06:14.617Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-08T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--3756ac87-1540-4842-88b7-c8865ccc6bd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:05:14.000Z",
      "valid_until": "2026-04-09T03:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T02:55:39.054Z",
      "x_nadsec_last_seen": "2026-03-15T16:06:00.497Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-08T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--1c794c87-8af9-4bb4-a521-47202ca883b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.43.187.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:05:14.000Z",
      "valid_until": "2026-04-09T03:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T02:43:09.445Z",
      "x_nadsec_last_seen": "2026-03-08T02:45:16.443Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-03-08T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--9a3ea0da-11b9-4b54-810c-802d20bca81a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.53.44.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:05:13.000Z",
      "valid_until": "2026-04-09T04:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T03:12:45.871Z",
      "x_nadsec_last_seen": "2026-03-08T03:19:49.712Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-08T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--134db202-a58c-430f-832c-dc0095cc1b0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:05:13.000Z",
      "valid_until": "2026-04-09T04:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T03:07:13.732Z",
      "x_nadsec_last_seen": "2026-03-26T02:12:50.304Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-08T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--59eafc1a-01fe-4e54-8782-596abf9f916f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:05:13.000Z",
      "valid_until": "2026-04-09T04:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T03:32:08.062Z",
      "x_nadsec_last_seen": "2026-03-19T14:24:29.512Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-08T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--dd43c473-3103-4b6b-a0e1-0aa9d24224e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.176.81.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:05:13.000Z",
      "valid_until": "2026-04-09T04:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T03:16:44.491Z",
      "x_nadsec_last_seen": "2026-03-08T03:25:24.810Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-08T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--0e9d725d-2816-4118-b4c8-0e5c3fc83a9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.10.129.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:05:13.000Z",
      "valid_until": "2026-04-09T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T03:23:36.199Z",
      "x_nadsec_last_seen": "2026-03-08T03:25:41.622Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-03-08T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UZ; asn=202660; asn_org=Uzbektelekom Joint Stock Company",
      "id": "indicator--bb7839b3-5822-4259-9524-8b493a64b721",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.74.4.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:05:13.000Z",
      "valid_until": "2026-04-09T04:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-08T03:44:44.257Z",
      "x_nadsec_last_seen": "2026-03-09T21:35:35.601Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "202660"
      ],
      "x_nadsec_orgs": [
        "Uzbektelekom Joint Stock Company"
      ]
    },
    {
      "created": "2026-03-08T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d582ca9c-0afd-4f9a-a041-078135f0c5c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:05:13.000Z",
      "valid_until": "2026-04-09T04:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T03:58:59.039Z",
      "x_nadsec_last_seen": "2026-03-24T04:02:37.356Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-08T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--7701a8da-5e06-4467-a7d2-f9abd00ec8ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.78.75.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:05:13.000Z",
      "valid_until": "2026-04-09T04:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T03:10:41.319Z",
      "x_nadsec_last_seen": "2026-03-08T03:10:41.319Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-08T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56044; asn_org=China Mobile communications corporation",
      "id": "indicator--f47845de-6bf0-4d1b-9917-b118b0b1eacb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.152.72.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:05:13.000Z",
      "valid_until": "2026-04-09T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T03:17:24.697Z",
      "x_nadsec_last_seen": "2026-03-08T03:19:29.981Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56044"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-03-08T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=150008; asn_org=Pioneer Elabs Ltd.",
      "id": "indicator--cbce77d6-051e-412d-adcf-84abacff13e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.225.24.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:05:13.000Z",
      "valid_until": "2026-04-09T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T03:29:24.431Z",
      "x_nadsec_last_seen": "2026-03-08T03:31:29.368Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "150008"
      ],
      "x_nadsec_orgs": [
        "Pioneer Elabs Ltd."
      ]
    },
    {
      "created": "2026-03-08T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--0012ea3c-b5ef-489d-982d-2d230b9fd1d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '51.223.34.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:05:13.000Z",
      "valid_until": "2026-04-09T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T03:18:59.138Z",
      "x_nadsec_last_seen": "2026-03-08T03:21:05.620Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-08T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=18747; asn_org=IFX Corporation",
      "id": "indicator--41005da6-3147-4cee-b191-7abdc8a11203",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.60.92.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:05:14.000Z",
      "valid_until": "2026-04-09T05:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T04:25:57.254Z",
      "x_nadsec_last_seen": "2026-03-08T04:28:03.200Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "18747"
      ],
      "x_nadsec_orgs": [
        "IFX Corporation"
      ]
    },
    {
      "created": "2026-03-08T05:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--919496eb-6a93-4e01-803f-f38da11799c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T05:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:05:14.000Z",
      "valid_until": "2026-04-09T05:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T04:56:12.537Z",
      "x_nadsec_last_seen": "2026-03-19T15:08:28.443Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--4dee0562-baa7-48c7-a5d0-7564a871f8c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.109.206.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:05:10.000Z",
      "valid_until": "2026-04-09T06:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T05:19:19.264Z",
      "x_nadsec_last_seen": "2026-03-08T05:19:19.330Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KR; asn=17853; asn_org=LGTELECOM",
      "id": "indicator--7ea61996-d888-4826-a9c0-ab5fe9089c78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.96.171.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:05:10.000Z",
      "valid_until": "2026-04-09T06:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T05:30:40.404Z",
      "x_nadsec_last_seen": "2026-03-08T05:37:15.953Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "17853"
      ],
      "x_nadsec_orgs": [
        "LGTELECOM"
      ]
    },
    {
      "created": "2026-03-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fd52bafa-63d0-497d-97dc-e556dba77e95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.176.107.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:05:10.000Z",
      "valid_until": "2026-04-09T06:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-08T05:06:10.273Z",
      "x_nadsec_last_seen": "2026-03-18T10:42:12.653Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=58495; asn_org=PT Parsaoran Global Datatrans",
      "id": "indicator--15d75750-f1aa-4732-85f9-93ead2be7ee4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.192.12.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:05:10.000Z",
      "valid_until": "2026-04-09T06:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T05:31:32.867Z",
      "x_nadsec_last_seen": "2026-03-08T05:31:38.888Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "58495"
      ],
      "x_nadsec_orgs": [
        "PT Parsaoran Global Datatrans"
      ]
    },
    {
      "created": "2026-03-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=47; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--8ec1456b-8684-4ffe-80ab-00e74630cc21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.43.14.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:05:10.000Z",
      "valid_until": "2026-04-09T06:05:08.000Z",
      "x_nadsec_event_count": 47,
      "x_nadsec_first_seen": "2026-03-08T05:18:14.598Z",
      "x_nadsec_last_seen": "2026-03-08T05:21:59.286Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dd19fa6c-bc44-48ec-9ac2-b162ab16d8a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.86.105.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:05:10.000Z",
      "valid_until": "2026-04-09T06:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T05:24:21.045Z",
      "x_nadsec_last_seen": "2026-03-08T05:24:21.396Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--571f4b2a-562e-42a4-8581-dc962c0882c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.121.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:05:10.000Z",
      "valid_until": "2026-04-09T06:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T05:12:16.985Z",
      "x_nadsec_last_seen": "2026-03-08T05:12:16.985Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:05:10.000Z",
      "valid_until": "2026-04-09T06:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T05:30:27.857Z",
      "x_nadsec_last_seen": "2026-03-17T13:30:17.020Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--b936412f-42d6-442e-8f1d-870ff0ecf149",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.153.219.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:05:10.000Z",
      "valid_until": "2026-04-09T06:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T05:51:26.967Z",
      "x_nadsec_last_seen": "2026-03-08T05:52:17.640Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--def9891e-98c7-40be-9a6b-97b4651e252a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.171.8.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:05:10.000Z",
      "valid_until": "2026-04-09T06:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T05:53:31.305Z",
      "x_nadsec_last_seen": "2026-03-08T05:53:31.305Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--405e51ef-fb24-48c1-9aba-3e1c0b7f1144",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.78.223.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:05:10.000Z",
      "valid_until": "2026-04-09T06:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T05:34:36.264Z",
      "x_nadsec_last_seen": "2026-03-08T05:34:36.473Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--6e35a387-a77c-468f-b3c8-142d27ecb15b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.34.118.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:05:10.000Z",
      "valid_until": "2026-04-09T06:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T05:53:38.555Z",
      "x_nadsec_last_seen": "2026-03-08T05:53:38.588Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-08T06:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--28896087-847b-4634-b7a5-7dad256f66cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T06:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.41.81.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:05:10.000Z",
      "valid_until": "2026-04-09T06:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T05:24:27.701Z",
      "x_nadsec_last_seen": "2026-03-08T05:26:34.046Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-03-08T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=23923; asn_org=Agni Systems Limited",
      "id": "indicator--590d22be-4af0-4695-864d-9391e449f0b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.68.192.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T07:05:13.000Z",
      "valid_until": "2026-04-09T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T06:46:57.896Z",
      "x_nadsec_last_seen": "2026-03-08T06:49:02.467Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23923"
      ],
      "x_nadsec_orgs": [
        "Agni Systems Limited"
      ]
    },
    {
      "created": "2026-03-08T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--9e6f6602-5d1b-4b34-af34-33a4022d506a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.97.26.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T07:05:13.000Z",
      "valid_until": "2026-04-09T07:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T06:12:15.520Z",
      "x_nadsec_last_seen": "2026-03-08T06:12:15.520Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-08T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c8233f36-f5b3-495a-9ab3-ea3e4ca218b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.189.134.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T07:05:13.000Z",
      "valid_until": "2026-04-09T07:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T06:10:18.205Z",
      "x_nadsec_last_seen": "2026-03-08T06:10:18.205Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-08T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=UA; asn=51121; asn_org=Foboss-Telecom LLC",
      "id": "indicator--2a47c092-e4bd-48c2-b465-ad69198a591e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.226.43.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T07:05:13.000Z",
      "valid_until": "2026-04-09T07:05:12.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-08T06:57:26.519Z",
      "x_nadsec_last_seen": "2026-03-16T06:39:32.318Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "51121"
      ],
      "x_nadsec_orgs": [
        "Foboss-Telecom LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-08T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=45588; asn_org=Bangladesh Telecommunications Company Limited BTCL, Nationwide PSTN Operator and Data and In",
      "id": "indicator--b51466fd-4792-47ff-87d5-147663f98867",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.130.156.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:05:09.000Z",
      "valid_until": "2026-04-09T08:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T07:12:45.803Z",
      "x_nadsec_last_seen": "2026-03-08T07:17:48.877Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "45588"
      ],
      "x_nadsec_orgs": [
        "Bangladesh Telecommunications Company Limited BTCL, Nationwide PSTN Operator and Data and In"
      ]
    },
    {
      "created": "2026-03-08T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--e1975762-486d-4cef-9be6-1103ba7e6a54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.4.33.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:05:09.000Z",
      "valid_until": "2026-04-09T08:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T07:41:51.387Z",
      "x_nadsec_last_seen": "2026-03-08T07:48:22.558Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-08T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1b29d59f-75f8-4594-be56-1e01da8e2f75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:05:09.000Z",
      "valid_until": "2026-04-09T08:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-08T07:44:23.387Z",
      "x_nadsec_last_seen": "2026-03-08T07:44:51.486Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-08T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--56b4508f-1476-429c-bcd9-03f5bfb97f9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.236.45.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:05:09.000Z",
      "valid_until": "2026-04-09T08:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T08:00:56.956Z",
      "x_nadsec_last_seen": "2026-03-08T08:03:03.702Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-08T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--8f7613e1-19b6-4f86-b516-d4825084968a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:05:09.000Z",
      "valid_until": "2026-04-09T08:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T07:07:41.038Z",
      "x_nadsec_last_seen": "2026-03-08T07:07:41.038Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-08T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones",
      "id": "indicator--72ac84cf-773f-4ea6-a636-8f1791cfa58a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.27.39.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:05:09.000Z",
      "valid_until": "2026-04-09T08:05:08.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-03-08T07:28:59.790Z",
      "x_nadsec_last_seen": "2026-03-26T16:46:00.207Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UY"
      ],
      "x_nadsec_asns": [
        "6057"
      ],
      "x_nadsec_orgs": [
        "Administracion Nacional de Telecomunicaciones"
      ]
    },
    {
      "created": "2026-03-08T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--dea4e946-5c00-43ef-b501-6efd7b1bfcb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.251.153.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:05:09.000Z",
      "valid_until": "2026-04-09T08:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T07:41:08.864Z",
      "x_nadsec_last_seen": "2026-03-08T07:47:42.890Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-08T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=9832; asn_org=ISN, Internet Service Provider",
      "id": "indicator--bbdc86a7-ee6f-4410-8988-656932223ab1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.188.241.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:05:09.000Z",
      "valid_until": "2026-04-09T08:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T07:14:48.769Z",
      "x_nadsec_last_seen": "2026-03-08T07:16:53.503Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "9832"
      ],
      "x_nadsec_orgs": [
        "ISN, Internet Service Provider"
      ]
    },
    {
      "created": "2026-03-08T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NO; asn=2116; asn_org=Globalconnect As",
      "id": "indicator--1db275d7-7b81-4b5e-93e1-481e289f01ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.118.44.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:05:09.000Z",
      "valid_until": "2026-04-09T08:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T07:42:03.978Z",
      "x_nadsec_last_seen": "2026-03-08T07:44:12.180Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NO"
      ],
      "x_nadsec_asns": [
        "2116"
      ],
      "x_nadsec_orgs": [
        "Globalconnect As"
      ]
    },
    {
      "created": "2026-03-08T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--09b0f9c6-5232-49c7-9b11-fe9ed8b95380",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.76.99.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:05:09.000Z",
      "valid_until": "2026-04-09T08:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T07:28:56.531Z",
      "x_nadsec_last_seen": "2026-03-12T11:53:04.906Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-08T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--13f04f0d-4e10-4b39-a8f2-e40e59fbe5c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:05:09.000Z",
      "valid_until": "2026-04-09T08:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T07:23:36.796Z",
      "x_nadsec_last_seen": "2026-03-08T07:23:36.796Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-08T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2d583b21-9d0a-46d4-bdee-565a6f985a27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:05:09.000Z",
      "valid_until": "2026-04-09T08:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T07:23:37.133Z",
      "x_nadsec_last_seen": "2026-03-21T23:31:50.971Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-08T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d28f2f59-54a4-457f-880e-bb8fdfaf6a7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:05:09.000Z",
      "valid_until": "2026-04-09T08:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T07:23:09.281Z",
      "x_nadsec_last_seen": "2026-03-08T07:23:09.281Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-08T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--c4d7709a-84dd-4e96-9f38-31d21ea88e89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:05:09.000Z",
      "valid_until": "2026-04-09T08:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T07:23:08.875Z",
      "x_nadsec_last_seen": "2026-03-08T07:23:08.875Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-08T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=22773; asn_org=Cox Communications Inc.",
      "id": "indicator--b63bc71e-3277-4055-97c1-9d598405e72a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.191.195.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:05:09.000Z",
      "valid_until": "2026-04-09T08:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-08T07:44:03.949Z",
      "x_nadsec_last_seen": "2026-03-12T09:07:59.748Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "22773"
      ],
      "x_nadsec_orgs": [
        "Cox Communications Inc."
      ]
    },
    {
      "created": "2026-03-08T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--42001512-84f9-4497-a4f4-2ec324b83445",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T09:05:13.000Z",
      "valid_until": "2026-04-09T09:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T08:33:49.674Z",
      "x_nadsec_last_seen": "2026-03-21T04:57:37.487Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-08T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--598965ef-ddcf-4d9f-ac3e-62aba3a33787",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.183.246.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T09:05:13.000Z",
      "valid_until": "2026-04-09T09:05:12.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-03-08T08:12:28.603Z",
      "x_nadsec_last_seen": "2026-03-31T10:28:59.281Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-08T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TN; asn=37492; asn_org=ORANGE",
      "id": "indicator--eb308426-22db-4997-a6f2-191bd0551347",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.31.52.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T09:05:13.000Z",
      "valid_until": "2026-04-09T09:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T08:52:27.299Z",
      "x_nadsec_last_seen": "2026-03-08T08:52:27.324Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37492"
      ],
      "x_nadsec_orgs": [
        "ORANGE"
      ]
    },
    {
      "created": "2026-03-08T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e32c7d74-60a9-4e8d-b370-8dd7ad752bf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.225.19.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T09:05:13.000Z",
      "valid_until": "2026-04-09T09:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T08:50:33.604Z",
      "x_nadsec_last_seen": "2026-03-08T08:50:33.604Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-08T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MD; asn=25454; asn_org=Orange Moldova S.A.",
      "id": "indicator--00fd4ece-a7b4-4b1a-95ce-983b1181cb81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.89.220.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T09:05:13.000Z",
      "valid_until": "2026-04-09T09:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T08:45:49.571Z",
      "x_nadsec_last_seen": "2026-03-13T04:50:09.938Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MD"
      ],
      "x_nadsec_asns": [
        "25454"
      ],
      "x_nadsec_orgs": [
        "Orange Moldova S.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-08T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--9814eb0a-0d66-458e-83c4-ba68fdd10a53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.226.169.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T09:05:13.000Z",
      "valid_until": "2026-04-09T09:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T08:24:27.271Z",
      "x_nadsec_last_seen": "2026-03-08T08:26:00.110Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-08T09:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=SY; asn=29256; asn_org=Syrian Telecommunication Private Closed Joint Stock Company",
      "id": "indicator--c910d545-ec0e-45af-ba73-d4bb8a4a16af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T09:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.144.21.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T09:05:13.000Z",
      "valid_until": "2026-04-09T09:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T08:56:50.924Z",
      "x_nadsec_last_seen": "2026-03-08T08:59:00.962Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SY"
      ],
      "x_nadsec_asns": [
        "29256"
      ],
      "x_nadsec_orgs": [
        "Syrian Telecommunication Private Closed Joint Stock Company"
      ]
    },
    {
      "created": "2026-03-08T10:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0d0a27ab-bc2b-464b-ab4b-328e25793be9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T10:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.145.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:05:14.000Z",
      "valid_until": "2026-04-09T10:05:12.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-08T09:30:57.015Z",
      "x_nadsec_last_seen": "2026-03-26T12:18:26.383Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-08T10:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=52771; asn_org=GIGA BYTE TELECOMUNICACOES LTDA; user(top)=**",
      "id": "indicator--c7e4ad94-4ca6-4752-a05c-529579cc8a21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T10:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.186.44.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:05:14.000Z",
      "valid_until": "2026-04-09T10:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T09:16:18.858Z",
      "x_nadsec_last_seen": "2026-03-17T22:35:31.124Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52771"
      ],
      "x_nadsec_orgs": [
        "GIGA BYTE TELECOMUNICACOES LTDA"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-08T10:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2864a17f-3efe-4cee-ae40-1423bd0d11b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T10:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.168.230.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:05:14.000Z",
      "valid_until": "2026-04-09T10:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T09:10:36.869Z",
      "x_nadsec_last_seen": "2026-03-08T09:12:41.629Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-08T10:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ZA; asn=37358; asn_org=BITCO",
      "id": "indicator--a2b77577-83f1-4973-a539-2dc57e3cf33f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T10:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.117.167.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:05:14.000Z",
      "valid_until": "2026-04-09T10:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T09:47:35.899Z",
      "x_nadsec_last_seen": "2026-03-08T09:47:36.669Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37358"
      ],
      "x_nadsec_orgs": [
        "BITCO"
      ]
    },
    {
      "created": "2026-03-08T10:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=28343; asn_org=UNIFIQUE TELECOMUNICACOES SA",
      "id": "indicator--6ec9b8a6-8aa0-40bd-898c-413bbb2ba40b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T10:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.10.108.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:05:14.000Z",
      "valid_until": "2026-04-09T10:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T09:23:29.368Z",
      "x_nadsec_last_seen": "2026-03-08T09:23:29.559Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28343"
      ],
      "x_nadsec_orgs": [
        "UNIFIQUE TELECOMUNICACOES SA"
      ]
    },
    {
      "created": "2026-03-08T10:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PR; asn=14638; asn_org=Liberty Communications of Puerto Rico LLC",
      "id": "indicator--c2bc6b84-8fd6-4ad0-a3e5-8d87be35aed5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T10:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '24.50.255.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:05:14.000Z",
      "valid_until": "2026-04-09T10:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T09:37:01.193Z",
      "x_nadsec_last_seen": "2026-03-08T09:39:07.423Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PR"
      ],
      "x_nadsec_asns": [
        "14638"
      ],
      "x_nadsec_orgs": [
        "Liberty Communications of Puerto Rico LLC"
      ]
    },
    {
      "created": "2026-03-08T10:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a68ba487-2542-45f7-a000-33e5b76e4fbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T10:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:05:14.000Z",
      "valid_until": "2026-04-09T10:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T09:38:45.386Z",
      "x_nadsec_last_seen": "2026-03-08T09:38:45.386Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-08T10:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f068c390-4124-4bd3-9d26-4d45859e4f5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T10:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:05:14.000Z",
      "valid_until": "2026-04-09T10:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T09:38:55.638Z",
      "x_nadsec_last_seen": "2026-03-15T15:12:08.664Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-08T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=138221; asn_org=Ynet Telecom Solutions",
      "id": "indicator--a7d23018-70e4-4ee6-923b-f6cd165fb454",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.170.112.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:05:13.000Z",
      "valid_until": "2026-04-09T11:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-08T10:33:23.454Z",
      "x_nadsec_last_seen": "2026-03-20T13:02:05.126Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138221"
      ],
      "x_nadsec_orgs": [
        "Ynet Telecom Solutions"
      ]
    },
    {
      "created": "2026-03-08T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=131349; asn_org=Digital telecomminication service joint stock",
      "id": "indicator--d63a6aec-49f1-4482-9f9f-1622ae59e11d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.23.146.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:05:13.000Z",
      "valid_until": "2026-04-09T11:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T10:32:30.406Z",
      "x_nadsec_last_seen": "2026-03-08T10:34:42.495Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "131349"
      ],
      "x_nadsec_orgs": [
        "Digital telecomminication service joint stock"
      ]
    },
    {
      "created": "2026-03-08T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--70261900-1e07-4ea8-9161-9c0403f32c0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.37.161.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:05:13.000Z",
      "valid_until": "2026-04-09T11:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T11:01:51.085Z",
      "x_nadsec_last_seen": "2026-03-08T11:03:55.772Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-08T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--dbda9e6c-31b9-4806-821f-cc92934690cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.249.0.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:05:13.000Z",
      "valid_until": "2026-04-09T11:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T10:20:17.319Z",
      "x_nadsec_last_seen": "2026-03-08T10:22:22.092Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-08T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--17e901cb-b768-402a-bf3b-8391cc693406",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.47.143.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:05:13.000Z",
      "valid_until": "2026-04-09T11:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T10:13:06.551Z",
      "x_nadsec_last_seen": "2026-03-08T10:15:13.728Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-08T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--0a6c8b19-290f-47da-9760-f1552be5820b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.220.248.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:05:13.000Z",
      "valid_until": "2026-04-09T11:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-08T10:44:57.761Z",
      "x_nadsec_last_seen": "2026-03-08T10:44:58.688Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-08T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--fcc1b5e9-4fd5-4a59-8b79-acb223a3bace",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.80.56.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:05:13.000Z",
      "valid_until": "2026-04-09T11:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-08T10:53:59.719Z",
      "x_nadsec_last_seen": "2026-03-08T11:19:13.989Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-08T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--1b2a70de-e9e6-4d3d-8456-607f04e20edf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.202.22.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:05:13.000Z",
      "valid_until": "2026-04-09T11:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T10:19:25.396Z",
      "x_nadsec_last_seen": "2026-03-08T10:21:31.629Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-08T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7497d09e-a654-4e04-ac4b-23d3ad1dfc0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:05:13.000Z",
      "valid_until": "2026-04-09T11:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T10:13:06.586Z",
      "x_nadsec_last_seen": "2026-03-29T08:04:06.674Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-08T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37492; asn_org=ORANGE",
      "id": "indicator--9dc11573-4c91-4b82-8ff0-38e3c1928985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.230.216.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:05:13.000Z",
      "valid_until": "2026-04-09T11:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T10:54:29.599Z",
      "x_nadsec_last_seen": "2026-03-08T10:56:35.955Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37492"
      ],
      "x_nadsec_orgs": [
        "ORANGE"
      ]
    },
    {
      "created": "2026-03-08T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=48775; asn_org=Nashnet Rivne LLC",
      "id": "indicator--445adbb7-ea72-4dc1-86e1-b462d83dbbf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.197.56.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:05:13.000Z",
      "valid_until": "2026-04-09T11:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-08T10:57:13.442Z",
      "x_nadsec_last_seen": "2026-03-20T14:38:11.863Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "48775"
      ],
      "x_nadsec_orgs": [
        "Nashnet Rivne LLC"
      ]
    },
    {
      "created": "2026-03-08T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--dc1ae783-95e1-40fd-9faf-4ae721f12a57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:05:13.000Z",
      "valid_until": "2026-04-09T11:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T10:29:10.403Z",
      "x_nadsec_last_seen": "2026-03-08T10:29:10.403Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-08T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--69284be3-39bb-44e3-8241-288ae3cac2a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:05:13.000Z",
      "valid_until": "2026-04-09T11:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T10:29:10.114Z",
      "x_nadsec_last_seen": "2026-03-08T10:29:10.114Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-08T12:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--ed184916-88b0-4504-9275-28182fa74ab0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.10.184.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:05:13.000Z",
      "valid_until": "2026-04-09T12:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T11:35:26.037Z",
      "x_nadsec_last_seen": "2026-03-08T11:41:47.501Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-08T12:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--e5cf3508-b9c6-428f-ad0a-f6d3b55459d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.180.184.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:05:13.000Z",
      "valid_until": "2026-04-09T12:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T11:58:36.853Z",
      "x_nadsec_last_seen": "2026-03-08T11:58:36.853Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-08T12:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--c2f0f1a9-1d22-48a4-9689-7c2be4d2f3bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.180.255.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:05:13.000Z",
      "valid_until": "2026-04-09T12:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T12:00:41.469Z",
      "x_nadsec_last_seen": "2026-03-08T12:00:43.059Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-08T12:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--58fe02ae-1cb9-4b8a-a47c-508e15eeee5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.192.142.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:05:13.000Z",
      "valid_until": "2026-04-09T12:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T11:58:36.546Z",
      "x_nadsec_last_seen": "2026-03-08T11:58:36.546Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-08T12:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e74786f0-a6d0-40d1-8000-5303f63dd7d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:05:13.000Z",
      "valid_until": "2026-04-09T12:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-08T11:42:58.012Z",
      "x_nadsec_last_seen": "2026-03-08T11:43:31.646Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-08T12:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8dd88e56-697e-4a06-9451-7505204686b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:05:13.000Z",
      "valid_until": "2026-04-09T12:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T11:35:36.196Z",
      "x_nadsec_last_seen": "2026-03-08T11:35:36.196Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-08T12:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=52570; asn_org=TechInfo Telecomunicacoes Ltda",
      "id": "indicator--0d8c5672-4cd6-4b4e-bca9-94becfab7623",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.96.204.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:05:13.000Z",
      "valid_until": "2026-04-09T12:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T11:36:45.782Z",
      "x_nadsec_last_seen": "2026-03-08T11:44:04.422Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52570"
      ],
      "x_nadsec_orgs": [
        "TechInfo Telecomunicacoes Ltda"
      ]
    },
    {
      "created": "2026-03-08T12:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--fad0a2f1-326c-486d-8acf-a46e5279dbde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.163.87.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:05:13.000Z",
      "valid_until": "2026-04-09T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T11:59:27.400Z",
      "x_nadsec_last_seen": "2026-03-08T12:01:33.952Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-08T12:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--06146911-f05a-4a6e-99c3-f1dd98759d0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:05:13.000Z",
      "valid_until": "2026-04-09T12:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T11:51:00.859Z",
      "x_nadsec_last_seen": "2026-03-11T13:32:38.533Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-08T12:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=GB; asn=209605; asn_org=UAB Host Baltic",
      "id": "indicator--213793c6-fb00-4dcf-85b0-588016536a46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:05:13.000Z",
      "valid_until": "2026-04-09T12:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T11:11:28.829Z",
      "x_nadsec_last_seen": "2026-03-12T02:23:21.751Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "209605"
      ],
      "x_nadsec_orgs": [
        "UAB Host Baltic"
      ]
    },
    {
      "created": "2026-03-08T12:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--0d44ffba-3b59-4ea3-851b-067ef71c538c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T12:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.37.117.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:05:13.000Z",
      "valid_until": "2026-04-09T12:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T11:20:53.255Z",
      "x_nadsec_last_seen": "2026-03-08T11:22:58.394Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-08T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--abaa4e5f-734f-45f6-af86-c0ba202c02b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.188.123.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:05:13.000Z",
      "valid_until": "2026-04-09T13:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T12:58:52.326Z",
      "x_nadsec_last_seen": "2026-03-08T13:00:59.697Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-08T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--bd078f0c-5ccf-46ae-8616-f90545fd6b41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.186.101.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:05:13.000Z",
      "valid_until": "2026-04-09T13:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T12:59:43.954Z",
      "x_nadsec_last_seen": "2026-03-08T13:01:48.680Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-08T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=LT; asn=209605; asn_org=UAB Host Baltic",
      "id": "indicator--d1bdf4fa-03c3-4425-84f1-b38adfffeec7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.98.10.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:05:13.000Z",
      "valid_until": "2026-04-09T13:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T12:49:07.418Z",
      "x_nadsec_last_seen": "2026-03-08T12:49:08.026Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "LT"
      ],
      "x_nadsec_asns": [
        "209605"
      ],
      "x_nadsec_orgs": [
        "UAB Host Baltic"
      ]
    },
    {
      "created": "2026-03-08T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--8d93facd-5669-44a3-b33d-a28df3ab296e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '144.172.98.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:05:13.000Z",
      "valid_until": "2026-04-09T13:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T12:25:23.278Z",
      "x_nadsec_last_seen": "2026-03-08T12:25:23.924Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-03-08T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2ca3e8aa-a790-40f5-8ff7-526c7ae5884c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.62.47.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:05:13.000Z",
      "valid_until": "2026-04-09T13:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T12:08:44.523Z",
      "x_nadsec_last_seen": "2026-03-08T12:08:47.841Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-08T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PE; asn=262210; asn_org=VIETTEL PERU S.A.C.",
      "id": "indicator--7225f06a-5a0a-4424-a77d-f5eb68cacf44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.176.136.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:05:13.000Z",
      "valid_until": "2026-04-09T13:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T12:46:14.739Z",
      "x_nadsec_last_seen": "2026-03-08T12:46:19.327Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "262210"
      ],
      "x_nadsec_orgs": [
        "VIETTEL PERU S.A.C."
      ]
    },
    {
      "created": "2026-03-08T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--81c2aa2a-3c02-43e8-bcee-b2bd6c016126",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.156.55.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:05:13.000Z",
      "valid_until": "2026-04-09T13:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T12:57:43.359Z",
      "x_nadsec_last_seen": "2026-03-08T13:05:30.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-08T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=9930; asn_org=TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "id": "indicator--e71f9d43-87fc-4f65-82de-680b4f9d5ddd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.25.82.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:05:13.000Z",
      "valid_until": "2026-04-09T13:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T12:40:14.844Z",
      "x_nadsec_last_seen": "2026-03-08T12:43:37.049Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9930"
      ],
      "x_nadsec_orgs": [
        "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al"
      ]
    },
    {
      "created": "2026-03-08T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--d6ca33ba-57a7-4d90-a7c4-88b697f403cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.240.224.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:05:13.000Z",
      "valid_until": "2026-04-09T13:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T12:36:50.540Z",
      "x_nadsec_last_seen": "2026-03-08T12:43:18.996Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-03-08T13:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=35177; asn_org=Rostelecom",
      "id": "indicator--3fa1201c-4cad-42f7-bd64-4546e368bf5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T13:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.139.217.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:05:13.000Z",
      "valid_until": "2026-04-09T13:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T12:56:47.814Z",
      "x_nadsec_last_seen": "2026-03-08T12:58:55.447Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "35177"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-08T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--ec08038c-0ba2-4885-988b-e1c5512009bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.147.9.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:05:10.000Z",
      "valid_until": "2026-04-09T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T13:28:20.577Z",
      "x_nadsec_last_seen": "2026-03-08T13:30:26.584Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-08T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=52965; asn_org=1TELECOM SERVICOS DE TECNOLOGIA EM INTERNET LTDA",
      "id": "indicator--6336f467-e2e8-4cc6-85d1-2137e74282e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.221.45.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:05:10.000Z",
      "valid_until": "2026-04-09T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T13:19:06.095Z",
      "x_nadsec_last_seen": "2026-03-08T13:21:12.231Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52965"
      ],
      "x_nadsec_orgs": [
        "1TELECOM SERVICOS DE TECNOLOGIA EM INTERNET LTDA"
      ]
    },
    {
      "created": "2026-03-08T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--1874451f-7cb9-44d7-aecc-1a69f4466014",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.185.105.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:05:10.000Z",
      "valid_until": "2026-04-09T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T13:54:05.488Z",
      "x_nadsec_last_seen": "2026-03-08T13:56:12.821Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-08T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--051be272-2b00-4aeb-898a-44542986de95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.158.237.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:05:10.000Z",
      "valid_until": "2026-04-09T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T13:58:02.805Z",
      "x_nadsec_last_seen": "2026-03-08T14:00:08.670Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-08T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--211e55e7-28f0-41d6-a483-bff672e44685",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.202.56.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:05:10.000Z",
      "valid_until": "2026-04-09T14:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T13:51:34.117Z",
      "x_nadsec_last_seen": "2026-03-08T13:53:40.380Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-03-08T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--f47159c1-afc3-4493-a657-f12091c9bcb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.202.54.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:05:10.000Z",
      "valid_until": "2026-04-09T14:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T13:37:20.214Z",
      "x_nadsec_last_seen": "2026-03-08T13:44:26.527Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-08T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=28539; asn_org=JOSE MIGUEL MACIAS CONTRERAS",
      "id": "indicator--16d486ac-619e-4500-b8e4-c2695e922ef1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.159.104.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:05:10.000Z",
      "valid_until": "2026-04-09T14:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T13:07:35.165Z",
      "x_nadsec_last_seen": "2026-03-11T16:49:52.849Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "28539"
      ],
      "x_nadsec_orgs": [
        "JOSE MIGUEL MACIAS CONTRERAS"
      ]
    },
    {
      "created": "2026-03-08T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=3356; asn_org=Level 3 Parent, LLC",
      "id": "indicator--4c5d2990-b203-42bc-aa1d-96bfb49db163",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '4.16.252.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:05:10.000Z",
      "valid_until": "2026-04-09T14:05:08.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-08T13:56:54.397Z",
      "x_nadsec_last_seen": "2026-03-28T04:52:35.562Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "3356"
      ],
      "x_nadsec_orgs": [
        "Level 3 Parent, LLC"
      ]
    },
    {
      "created": "2026-03-08T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--f2ec1bda-ad99-4911-ab8e-5f7c38216e0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:05:10.000Z",
      "valid_until": "2026-04-09T14:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T13:37:26.667Z",
      "x_nadsec_last_seen": "2026-03-29T08:11:07.917Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-08T14:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--22443efd-7d9a-45ff-829d-7d989582179b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T14:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.40.188.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:05:10.000Z",
      "valid_until": "2026-04-09T14:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T13:06:14.687Z",
      "x_nadsec_last_seen": "2026-03-08T13:07:35.158Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-08T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MO; asn=4609; asn_org=Companhia de Telecomunicacoes de Macau SARL",
      "id": "indicator--803dd376-cea4-4fd4-b629-ea394e40b007",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.31.42.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T15:05:09.000Z",
      "valid_until": "2026-04-09T15:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T14:14:20.320Z",
      "x_nadsec_last_seen": "2026-03-08T14:20:49.981Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MO"
      ],
      "x_nadsec_asns": [
        "4609"
      ],
      "x_nadsec_orgs": [
        "Companhia de Telecomunicacoes de Macau SARL"
      ]
    },
    {
      "created": "2026-03-08T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DE; asn=394089; asn_org=Google LLC",
      "id": "indicator--e6c9e068-03d8-47b1-b9ac-759fb7477f72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '144.125.65.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T15:05:09.000Z",
      "valid_until": "2026-04-09T15:05:08.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-08T14:47:26.071Z",
      "x_nadsec_last_seen": "2026-03-15T16:47:27.867Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "394089"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-08T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--3c9ab011-e09b-4985-ac82-99d25611a8ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.157.229.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T15:05:09.000Z",
      "valid_until": "2026-04-09T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T14:22:39.235Z",
      "x_nadsec_last_seen": "2026-03-08T14:24:45.083Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-08T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CL; asn=14259; asn_org=Gtd Internet S.A.",
      "id": "indicator--2a8d84fb-5cdf-46ee-a6b6-8757212a1563",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.215.205.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T15:05:09.000Z",
      "valid_until": "2026-04-09T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T14:58:35.033Z",
      "x_nadsec_last_seen": "2026-03-08T14:58:41.619Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "14259"
      ],
      "x_nadsec_orgs": [
        "Gtd Internet S.A."
      ]
    },
    {
      "created": "2026-03-08T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d81f4dc2-356a-4266-bb91-7ec487224d04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.51.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T15:05:09.000Z",
      "valid_until": "2026-04-09T15:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T15:03:44.762Z",
      "x_nadsec_last_seen": "2026-03-08T15:03:55.056Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-08T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AM; asn=49800; asn_org=GNC-Alfa CJSC",
      "id": "indicator--98f336bd-169e-488d-a802-8eae570e4199",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.47.192.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T15:05:09.000Z",
      "valid_until": "2026-04-09T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T14:58:33.307Z",
      "x_nadsec_last_seen": "2026-03-08T15:00:40.206Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "49800"
      ],
      "x_nadsec_orgs": [
        "GNC-Alfa CJSC"
      ]
    },
    {
      "created": "2026-03-08T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--f1eef516-3add-43b1-bed2-62733719145f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.112.110.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T15:05:09.000Z",
      "valid_until": "2026-04-09T15:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T14:05:32.716Z",
      "x_nadsec_last_seen": "2026-03-08T14:12:42.748Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-08T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--5cb262fd-2d22-4342-a878-934d4f0615be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T15:05:09.000Z",
      "valid_until": "2026-04-09T15:05:08.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-08T14:39:39.608Z",
      "x_nadsec_last_seen": "2026-03-08T14:40:01.705Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-08T15:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--b3a2704e-5e7c-4a73-bfbb-ae2e26565566",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T15:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.207.225.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T15:05:09.000Z",
      "valid_until": "2026-04-09T15:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T14:53:49.349Z",
      "x_nadsec_last_seen": "2026-03-08T14:55:53.765Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-03-08T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b8966cbd-07d8-442e-a008-de818f21433c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.240.72.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:05:09.000Z",
      "valid_until": "2026-04-09T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T15:37:36.136Z",
      "x_nadsec_last_seen": "2026-03-08T15:39:42.282Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-08T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--dd11f98c-3b29-4d4e-ba78-c406309f9202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.70.131.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:05:09.000Z",
      "valid_until": "2026-04-09T16:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T15:07:50.061Z",
      "x_nadsec_last_seen": "2026-03-08T15:14:31.938Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-08T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mqttd; ports=1883; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--00269f29-fa19-4916-a767-f9a7f7b8300b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '164.90.228.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:05:09.000Z",
      "valid_until": "2026-04-09T16:05:08.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-08T15:33:13.703Z",
      "x_nadsec_last_seen": "2026-03-08T15:33:19.079Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-08T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--c4d874a3-0f0f-4df1-95ab-108ae1d65f55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.254.158.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:05:09.000Z",
      "valid_until": "2026-04-09T16:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T15:39:02.777Z",
      "x_nadsec_last_seen": "2026-03-08T15:41:07.188Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-08T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=FR; asn=3215; asn_org=Orange",
      "id": "indicator--ca456de4-0e3e-4fe0-a71f-5d396fe11145",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.251.68.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:05:09.000Z",
      "valid_until": "2026-04-09T16:05:08.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-03-08T15:39:09.887Z",
      "x_nadsec_last_seen": "2026-03-29T12:42:04.552Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "3215"
      ],
      "x_nadsec_orgs": [
        "Orange"
      ]
    },
    {
      "created": "2026-03-08T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fb335778-1449-45d0-a83b-7f2fcdf4b5ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:05:09.000Z",
      "valid_until": "2026-04-09T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T15:42:52.100Z",
      "x_nadsec_last_seen": "2026-03-23T23:36:03.865Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-08T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b35f1435-424a-4782-8cca-fe0560996fae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:05:09.000Z",
      "valid_until": "2026-04-09T16:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T15:34:35.948Z",
      "x_nadsec_last_seen": "2026-03-08T15:34:35.948Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-08T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8fc2bdfb-c186-4a92-aec8-ead34d7de314",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:05:09.000Z",
      "valid_until": "2026-04-09T16:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T15:39:14.404Z",
      "x_nadsec_last_seen": "2026-03-08T15:39:36.040Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-08T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--8d1387fd-d638-4aae-87df-a6aab4790efb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.76.153.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:05:09.000Z",
      "valid_until": "2026-04-09T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T16:02:10.362Z",
      "x_nadsec_last_seen": "2026-03-08T16:04:17.306Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-08T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MK; asn=6821; asn_org=Makedonski Telekom AD-Skopje",
      "id": "indicator--b0fac396-320d-4b10-8e2c-4e7a29451a48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.125.164.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:05:09.000Z",
      "valid_until": "2026-04-09T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T15:28:44.553Z",
      "x_nadsec_last_seen": "2026-03-08T15:30:51.803Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MK"
      ],
      "x_nadsec_asns": [
        "6821"
      ],
      "x_nadsec_orgs": [
        "Makedonski Telekom AD-Skopje"
      ]
    },
    {
      "created": "2026-03-08T16:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=33934; asn_org=Rostelecom",
      "id": "indicator--e8c9c327-d5ea-464a-81cf-0cce81a463ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T16:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.239.138.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:05:09.000Z",
      "valid_until": "2026-04-09T16:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T15:50:50.126Z",
      "x_nadsec_last_seen": "2026-03-08T15:52:57.379Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "33934"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-08T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BH; asn=31452; asn_org=Zain Bahrain B.s.c.",
      "id": "indicator--cffe7098-d64e-451c-a150-2c4789319dfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.161.224.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:05:09.000Z",
      "valid_until": "2026-04-09T17:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T16:13:00.807Z",
      "x_nadsec_last_seen": "2026-03-08T16:13:06.834Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BH"
      ],
      "x_nadsec_asns": [
        "31452"
      ],
      "x_nadsec_orgs": [
        "Zain Bahrain B.s.c."
      ]
    },
    {
      "created": "2026-03-08T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--a553121f-821d-46b2-b32a-b4ae290771dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.193.39.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:05:09.000Z",
      "valid_until": "2026-04-09T17:05:08.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-08T16:58:32.491Z",
      "x_nadsec_last_seen": "2026-03-08T16:59:04.946Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-08T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--5b0f8354-330f-4077-a2bc-10a2700d2832",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.86.113.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:05:09.000Z",
      "valid_until": "2026-04-09T17:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T17:02:41.485Z",
      "x_nadsec_last_seen": "2026-03-08T17:02:42.178Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-03-08T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=201086; asn_org=ServerPlusInternet Sunucu Hizmetleri",
      "id": "indicator--abfdeff7-a03f-48c4-805c-11aba2c574bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.254.95.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:05:09.000Z",
      "valid_until": "2026-04-09T17:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T16:05:22.594Z",
      "x_nadsec_last_seen": "2026-03-08T16:05:22.820Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "201086"
      ],
      "x_nadsec_orgs": [
        "ServerPlusInternet Sunucu Hizmetleri"
      ]
    },
    {
      "created": "2026-03-08T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cbee9f50-b9f3-46db-bb35-07745541f999",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.127.218.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:05:09.000Z",
      "valid_until": "2026-04-09T17:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T16:58:34.903Z",
      "x_nadsec_last_seen": "2026-03-29T21:58:10.236Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-08T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=SG; asn=4657; asn_org=StarHub Ltd",
      "id": "indicator--d1f5881b-b55e-40a4-8b3e-a3dba2834da6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.117.103.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:05:09.000Z",
      "valid_until": "2026-04-09T17:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T16:57:34.461Z",
      "x_nadsec_last_seen": "2026-03-12T12:26:37.089Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "4657"
      ],
      "x_nadsec_orgs": [
        "StarHub Ltd"
      ]
    },
    {
      "created": "2026-03-08T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--b64a1414-1f03-4c59-b740-15c83ff40e1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.45.62.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:05:09.000Z",
      "valid_until": "2026-04-09T17:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T16:53:58.025Z",
      "x_nadsec_last_seen": "2026-03-08T17:00:55.259Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-03-08T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=269820; asn_org=FULL DATA COMUNICACIONES C.A.",
      "id": "indicator--16ac90d1-6871-4d43-a276-c14be28fac11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.43.209.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:05:09.000Z",
      "valid_until": "2026-04-09T17:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T16:23:12.369Z",
      "x_nadsec_last_seen": "2026-03-08T16:28:12.614Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "269820"
      ],
      "x_nadsec_orgs": [
        "FULL DATA COMUNICACIONES C.A."
      ]
    },
    {
      "created": "2026-03-08T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ES; asn=12479; asn_org=Orange Espagne SA",
      "id": "indicator--6a3607a8-cb7d-41ea-a0da-a8ba040fac29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.62.36.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T17:05:09.000Z",
      "valid_until": "2026-04-09T17:05:08.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-08T16:10:32.532Z",
      "x_nadsec_last_seen": "2026-03-19T23:53:35.558Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "12479"
      ],
      "x_nadsec_orgs": [
        "Orange Espagne SA"
      ]
    },
    {
      "created": "2026-03-08T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KR; asn=17853; asn_org=LGTELECOM",
      "id": "indicator--5d7134c2-4309-44ea-b405-8f3342c1c935",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.96.145.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T18:05:13.000Z",
      "valid_until": "2026-04-09T18:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-08T17:16:12.572Z",
      "x_nadsec_last_seen": "2026-03-08T18:09:11.710Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "17853"
      ],
      "x_nadsec_orgs": [
        "LGTELECOM"
      ]
    },
    {
      "created": "2026-03-08T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=35699; asn_org=Adamo Telecom Iberia S.A.",
      "id": "indicator--6f4c4f35-3990-46a2-826e-d46ea6d6be93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.129.233.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T18:05:13.000Z",
      "valid_until": "2026-04-09T18:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T17:24:23.268Z",
      "x_nadsec_last_seen": "2026-03-08T17:26:29.942Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "35699"
      ],
      "x_nadsec_orgs": [
        "Adamo Telecom Iberia S.A."
      ]
    },
    {
      "created": "2026-03-08T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c7152a83-7e12-48ce-be12-97d72ab51699",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.135.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T18:05:13.000Z",
      "valid_until": "2026-04-09T18:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T18:02:59.473Z",
      "x_nadsec_last_seen": "2026-03-08T18:03:24.129Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-08T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--5e6ed41b-6beb-4a52-8f15-18899a5736d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.129.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T18:05:13.000Z",
      "valid_until": "2026-04-09T18:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-08T17:53:43.161Z",
      "x_nadsec_last_seen": "2026-03-29T18:32:36.330Z",
      "x_nadsec_ports": [
        "1723",
        "21"
      ],
      "x_nadsec_services": [
        "pptpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-08T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2478880a-5bdb-4352-8651-37eaf5d84486",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T18:05:13.000Z",
      "valid_until": "2026-04-09T18:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T17:17:02.010Z",
      "x_nadsec_last_seen": "2026-03-08T17:17:02.010Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-08T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=26077; asn_org=Nextlink Broadband",
      "id": "indicator--886ae124-2d36-41a6-88f6-03383b0f42e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.128.53.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T18:05:13.000Z",
      "valid_until": "2026-04-09T18:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T17:16:22.266Z",
      "x_nadsec_last_seen": "2026-03-08T17:18:28.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "26077"
      ],
      "x_nadsec_orgs": [
        "Nextlink Broadband"
      ]
    },
    {
      "created": "2026-03-08T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--a328bd72-1437-41ab-a10c-8a8c1979c0dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.58.207.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:05:13.000Z",
      "valid_until": "2026-04-09T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T18:41:43.957Z",
      "x_nadsec_last_seen": "2026-03-08T18:42:03.781Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-08T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--42aaa3b7-a45f-4559-9fb5-0a349e935d73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.128.247.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:05:13.000Z",
      "valid_until": "2026-04-09T19:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T18:56:04.621Z",
      "x_nadsec_last_seen": "2026-03-08T18:56:05.666Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-08T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--754cde3f-1810-4252-8bf4-5903d84c57ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.227.71.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:05:13.000Z",
      "valid_until": "2026-04-09T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T18:29:54.748Z",
      "x_nadsec_last_seen": "2026-03-08T18:32:00.963Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-08T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6e594d7b-6c01-4f35-bba5-0cb514b5af8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.162.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:05:13.000Z",
      "valid_until": "2026-04-09T19:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T18:22:07.028Z",
      "x_nadsec_last_seen": "2026-03-08T18:26:26.034Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-08T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5b347790-4286-49f2-8457-0115956e71d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:05:13.000Z",
      "valid_until": "2026-04-09T19:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T18:20:58.650Z",
      "x_nadsec_last_seen": "2026-03-08T18:20:58.650Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-08T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2885be14-8065-44c3-87dd-48fcead7e24f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.168.122.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:05:13.000Z",
      "valid_until": "2026-04-09T19:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T18:26:50.081Z",
      "x_nadsec_last_seen": "2026-03-09T16:55:14.198Z",
      "x_nadsec_ports": [
        "27017",
        "1433"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-08T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1599fc8a-8b74-442d-b816-156c8f005a87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.171.8.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:05:13.000Z",
      "valid_until": "2026-04-09T19:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T18:15:43.644Z",
      "x_nadsec_last_seen": "2026-03-08T18:15:43.935Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-08T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f628e081-0c46-464c-9158-706f27ce473f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:05:13.000Z",
      "valid_until": "2026-04-09T19:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T18:14:25.050Z",
      "x_nadsec_last_seen": "2026-03-08T18:14:35.210Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-08T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mirrorc; ports=36955; cc=MX; asn=265625; asn_org=Jafica Telecomunicaciones",
      "id": "indicator--c1d3d6a6-0fa0-4c13-ad89-24fafbd36561",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.124.160.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:05:13.000Z",
      "valid_until": "2026-04-09T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T18:44:30.117Z",
      "x_nadsec_last_seen": "2026-03-08T18:49:05.757Z",
      "x_nadsec_ports": [
        "42",
        "36955",
        "43153"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "265625"
      ],
      "x_nadsec_orgs": [
        "Jafica Telecomunicaciones"
      ]
    },
    {
      "created": "2026-03-08T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC; user(top)=**",
      "id": "indicator--e2a703d9-e976-408d-8e8e-d993c540d9aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.67.77.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:05:13.000Z",
      "valid_until": "2026-04-09T19:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T18:53:55.366Z",
      "x_nadsec_last_seen": "2026-03-08T18:53:55.366Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-08T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37671; asn_org=GLOBALNET-AS",
      "id": "indicator--de3423f5-4aef-4309-a548-4049456bd0d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.225.18.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:05:13.000Z",
      "valid_until": "2026-04-09T19:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-08T18:35:52.827Z",
      "x_nadsec_last_seen": "2026-03-08T19:21:56.936Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37671"
      ],
      "x_nadsec_orgs": [
        "GLOBALNET-AS"
      ]
    },
    {
      "created": "2026-03-08T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VE; asn=263703; asn_org=VIGINET C.A",
      "id": "indicator--e1eb6d23-16e6-4352-8daf-d412d7c0962e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.186.209.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:05:13.000Z",
      "valid_until": "2026-04-09T19:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T18:57:05.921Z",
      "x_nadsec_last_seen": "2026-03-08T18:57:06.199Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "263703"
      ],
      "x_nadsec_orgs": [
        "VIGINET C.A"
      ]
    },
    {
      "created": "2026-03-08T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e0b4a066-e2ae-44eb-bac4-9a249da2529d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.23.151.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:05:13.000Z",
      "valid_until": "2026-04-09T19:05:12.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-08T18:05:44.412Z",
      "x_nadsec_last_seen": "2026-03-30T16:08:38.233Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-08T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--f84369f0-0862-47e7-aa18-605bef6ede89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.26.233.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:05:13.000Z",
      "valid_until": "2026-04-09T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T19:03:05.930Z",
      "x_nadsec_last_seen": "2026-03-08T19:05:13.204Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-08T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PY; asn=264631; asn_org=RED PARAGUAYA DE TELECOMUNICACIONES SA",
      "id": "indicator--fbedf4da-67d2-4184-97c7-937e4dfd5d04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.202.210.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:05:14.000Z",
      "valid_until": "2026-04-09T20:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T19:06:12.214Z",
      "x_nadsec_last_seen": "2026-03-08T19:06:18.337Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "264631"
      ],
      "x_nadsec_orgs": [
        "RED PARAGUAYA DE TELECOMUNICACIONES SA"
      ]
    },
    {
      "created": "2026-03-08T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=IN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e7b45664-48c0-4d2a-9ebe-c5ff8da4b20a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.156.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:05:14.000Z",
      "valid_until": "2026-04-09T20:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T19:47:18.695Z",
      "x_nadsec_last_seen": "2026-03-08T19:47:39.796Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-08T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--829eba47-a798-4493-bed2-1bf53b27ec20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:05:14.000Z",
      "valid_until": "2026-04-09T20:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T19:31:13.545Z",
      "x_nadsec_last_seen": "2026-03-08T19:31:13.545Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-08T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--583f1779-671e-4143-9eb6-41fe5d68fbaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '164.92.201.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:05:14.000Z",
      "valid_until": "2026-04-09T20:05:12.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-08T19:46:53.921Z",
      "x_nadsec_last_seen": "2026-03-08T19:47:56.564Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-08T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3b985400-1911-4835-90e2-5d45f07bcb83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.172.106.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:05:14.000Z",
      "valid_until": "2026-04-09T20:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T19:48:04.511Z",
      "x_nadsec_last_seen": "2026-03-08T19:48:05.113Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-08T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones",
      "id": "indicator--fc8944b2-b1dc-4cae-a3a3-b3bb51f2e0c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.48.173.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:05:14.000Z",
      "valid_until": "2026-04-09T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T19:20:27.355Z",
      "x_nadsec_last_seen": "2026-03-08T19:22:34.451Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UY"
      ],
      "x_nadsec_asns": [
        "6057"
      ],
      "x_nadsec_orgs": [
        "Administracion Nacional de Telecomunicaciones"
      ]
    },
    {
      "created": "2026-03-08T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ZA; asn=3741; asn_org=NTT-DATA-Inc",
      "id": "indicator--48ad820d-0ef4-495f-8514-9cfbc5139151",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.33.226.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:05:14.000Z",
      "valid_until": "2026-04-09T20:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T19:05:18.721Z",
      "x_nadsec_last_seen": "2026-03-08T19:05:18.922Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "3741"
      ],
      "x_nadsec_orgs": [
        "NTT-DATA-Inc"
      ]
    },
    {
      "created": "2026-03-08T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RO; asn=204428; asn_org=SS-Net",
      "id": "indicator--83502710-1daa-4142-a877-8a0a036bb51c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:05:14.000Z",
      "valid_until": "2026-04-09T20:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T19:55:32.272Z",
      "x_nadsec_last_seen": "2026-03-08T19:55:32.272Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "204428"
      ],
      "x_nadsec_orgs": [
        "SS-Net"
      ]
    },
    {
      "created": "2026-03-08T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--1671e23a-3784-4f7d-8e5d-c5bae2b4569f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '86.98.11.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:05:14.000Z",
      "valid_until": "2026-04-09T20:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T19:53:24.021Z",
      "x_nadsec_last_seen": "2026-03-08T19:57:53.051Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-03-08T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d4e0ce1f-357c-4f2f-a2f1-4568b1deb36b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.141.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:05:13.000Z",
      "valid_until": "2026-04-09T21:05:12.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-08T20:20:26.003Z",
      "x_nadsec_last_seen": "2026-03-08T20:21:28.643Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-08T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD",
      "id": "indicator--5c63ddd0-de0b-4920-8ebd-aa5d6eeb6841",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:05:13.000Z",
      "valid_until": "2026-04-09T21:05:12.000Z",
      "x_nadsec_event_count": 1395,
      "x_nadsec_first_seen": "2026-03-08T20:37:14.897Z",
      "x_nadsec_last_seen": "2026-03-14T04:13:17.871Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***********r",
        "a***********r",
        "a************r",
        "k*****e"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6",
        "*",
        "***",
        "",
        "1***5"
      ]
    },
    {
      "created": "2026-03-08T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--4f971776-3f3a-4aba-8f20-a44d35139b6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.242.224.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:05:13.000Z",
      "valid_until": "2026-04-09T21:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T20:14:04.072Z",
      "x_nadsec_last_seen": "2026-03-08T20:16:08.601Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-08T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--08810622-1007-453f-a718-55d03f687fe2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.176.170.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:05:13.000Z",
      "valid_until": "2026-04-09T21:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-08T20:43:10.542Z",
      "x_nadsec_last_seen": "2026-03-08T20:50:16.463Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-08T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=28343; asn_org=UNIFIQUE TELECOMUNICACOES SA",
      "id": "indicator--16e1955b-5689-4099-b79b-5a9f80d1a33e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.192.215.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:05:13.000Z",
      "valid_until": "2026-04-09T21:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T21:02:55.015Z",
      "x_nadsec_last_seen": "2026-03-08T21:05:01.586Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28343"
      ],
      "x_nadsec_orgs": [
        "UNIFIQUE TELECOMUNICACOES SA"
      ]
    },
    {
      "created": "2026-03-08T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--31b3bd1b-1633-45b2-9957-3138c5611f11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.232.139.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:05:13.000Z",
      "valid_until": "2026-04-09T21:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T20:46:33.883Z",
      "x_nadsec_last_seen": "2026-03-08T20:48:39.788Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-08T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=7738; asn_org=V tal",
      "id": "indicator--89e698e1-1ddf-4038-9c8c-46f52651f188",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.80.88.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:05:13.000Z",
      "valid_until": "2026-04-09T21:05:12.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-08T20:29:44.556Z",
      "x_nadsec_last_seen": "2026-03-19T23:08:08.844Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "7738"
      ],
      "x_nadsec_orgs": [
        "V tal"
      ]
    },
    {
      "created": "2026-03-08T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27754; asn_org=Cooperativa Batan de Obras y Serv. Publicos Ltda",
      "id": "indicator--070c107e-cda0-4245-9b96-ff0155701385",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.80.224.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:05:13.000Z",
      "valid_until": "2026-04-09T21:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T20:18:13.797Z",
      "x_nadsec_last_seen": "2026-03-08T20:18:21.346Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27754"
      ],
      "x_nadsec_orgs": [
        "Cooperativa Batan de Obras y Serv. Publicos Ltda"
      ]
    },
    {
      "created": "2026-03-08T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--303f0768-53d1-4837-afb6-acd5dd63f2d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.73.38.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:05:13.000Z",
      "valid_until": "2026-04-09T21:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T20:16:07.909Z",
      "x_nadsec_last_seen": "2026-03-08T20:16:07.909Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-08T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fb68cbdd-02af-4d4e-87fc-cd91deab4a89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.101.178.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:05:13.000Z",
      "valid_until": "2026-04-09T21:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T20:21:36.517Z",
      "x_nadsec_last_seen": "2026-03-08T20:21:37.122Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-08T21:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=BG; asn=213438; asn_org=ColocaTel Inc.; user(top)=r**t",
      "id": "indicator--c6acc65a-c6a1-462f-b5ee-a75af12cc304",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T21:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:05:13.000Z",
      "valid_until": "2026-04-09T21:05:12.000Z",
      "x_nadsec_event_count": 1088,
      "x_nadsec_first_seen": "2026-03-08T20:57:14.629Z",
      "x_nadsec_last_seen": "2026-03-31T22:24:57.272Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "213438"
      ],
      "x_nadsec_orgs": [
        "ColocaTel Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--38af5f3f-e8da-4d54-a512-3ece5ad10091",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.124.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T21:09:31.267Z",
      "x_nadsec_last_seen": "2026-03-09T15:13:40.357Z",
      "x_nadsec_ports": [
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--c3909a32-5289-4aeb-a98a-81e3658965cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.182.81.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T21:14:56.588Z",
      "x_nadsec_last_seen": "2026-03-08T21:15:03.180Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=DE; asn=24940; asn_org=Hetzner Online GmbH",
      "id": "indicator--4833820d-5ff8-42ee-abf0-d855d5be18a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.104.10.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T22:00:44.280Z",
      "x_nadsec_last_seen": "2026-03-09T13:09:59.521Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "24940"
      ],
      "x_nadsec_orgs": [
        "Hetzner Online GmbH"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=***; pass(top)=*",
      "id": "indicator--6c596739-0c85-48c9-9445-e7e74d7a2e28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 1389,
      "x_nadsec_first_seen": "2026-03-08T21:47:31.731Z",
      "x_nadsec_last_seen": "2026-03-14T04:27:34.555Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "*",
        "j**e",
        "j*******.",
        "j*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "*",
        "***",
        "***",
        "Z******6",
        "1******8"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=7******e; pass(top)=C****4",
      "id": "indicator--334dfe69-26cc-448e-8f7a-de43003484b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 1390,
      "x_nadsec_first_seen": "2026-03-08T21:48:54.079Z",
      "x_nadsec_last_seen": "2026-03-14T04:39:13.915Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "***",
        "*",
        "*"
      ],
      "x_nadsec_passwords_attempted": [
        "*",
        "***",
        "***",
        "1******8",
        "F**********1"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=S**e",
      "id": "indicator--3702811f-4a59-4d43-bfd1-04d4d9278cb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 1388,
      "x_nadsec_first_seen": "2026-03-08T21:49:58.768Z",
      "x_nadsec_last_seen": "2026-03-14T04:10:57.362Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "*",
        "m***a",
        "**",
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "*",
        "",
        "1**4",
        "3**********5"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=a*******c; pass(top)=1*******3",
      "id": "indicator--8a3fc1b3-621e-46df-8ad9-d35860ef7b01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 1391,
      "x_nadsec_first_seen": "2026-03-08T21:51:48.346Z",
      "x_nadsec_last_seen": "2026-03-14T04:24:44.784Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "m**k",
        "m****r",
        "m***o",
        "m****n"
      ],
      "x_nadsec_passwords_attempted": [
        "A******4",
        "a****a",
        "***",
        "A******6",
        "D*****b"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=a**l; pass(top)=1***5",
      "id": "indicator--34e10eff-f403-4e08-9475-4f86b87dd9d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 1388,
      "x_nadsec_first_seen": "2026-03-08T21:53:18.251Z",
      "x_nadsec_last_seen": "2026-03-14T06:01:05.609Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***n",
        "***",
        "**",
        "a**l"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "*",
        "1***5",
        "1****6",
        "3**********5"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=a***n; pass(top)=Q******!",
      "id": "indicator--62f1eda2-298f-439a-8120-a60f2cdaf76a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 1387,
      "x_nadsec_first_seen": "2026-03-08T21:54:31.658Z",
      "x_nadsec_last_seen": "2026-03-14T04:36:00.397Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***n",
        "k***n",
        "a********t",
        "k**a"
      ],
      "x_nadsec_passwords_attempted": [
        "a******!",
        "***",
        "1****6",
        "1**4",
        "T******4"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=a***********r; pass(top)=F********3",
      "id": "indicator--95782468-3416-4149-b636-1fdfaa2df606",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 1389,
      "x_nadsec_first_seen": "2026-03-08T21:58:54.762Z",
      "x_nadsec_last_seen": "2026-03-14T04:27:32.706Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***********r",
        "l*****t",
        "l***a",
        "l*******9"
      ],
      "x_nadsec_passwords_attempted": [
        "A******4",
        "a****a",
        "A******6",
        "A*****1",
        "1***5"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=a***********r; pass(top)=***",
      "id": "indicator--cd8ed947-ea4b-4549-b733-aa46df06dc43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 1389,
      "x_nadsec_first_seen": "2026-03-08T21:59:54.244Z",
      "x_nadsec_last_seen": "2026-03-14T04:40:20.018Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "a***********r",
        "a***a",
        "j**n",
        "a***d"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6",
        "1******8",
        "***",
        "1******f",
        "1**4"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=a********s; pass(top)=***",
      "id": "indicator--f8a31662-8cac-459f-a62b-781770235472",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 1392,
      "x_nadsec_first_seen": "2026-03-08T22:01:03.284Z",
      "x_nadsec_last_seen": "2026-03-14T04:50:43.085Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "a**x",
        "a*****o",
        "a**n"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "",
        "1******8",
        "D*****b",
        "1**4"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=a****s; pass(top)=P*******1",
      "id": "indicator--dfbc852d-079b-4ead-aa12-7093db407ef5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 1390,
      "x_nadsec_first_seen": "2026-03-08T22:02:35.181Z",
      "x_nadsec_last_seen": "2026-03-14T04:46:42.246Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "a*****n",
        "a******a",
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "1**4",
        "1****6",
        "1******8",
        "3**********5"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=***; pass(top)=*",
      "id": "indicator--15060d73-b72a-43e1-b980-e76b11b99ab8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 1389,
      "x_nadsec_first_seen": "2026-03-08T21:39:17.472Z",
      "x_nadsec_last_seen": "2026-03-14T04:51:14.704Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "l**o",
        "**",
        "*",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "*",
        "m****n",
        "3**********5",
        "*",
        "***"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=1******1; pass(top)=P******d",
      "id": "indicator--841ae0a7-25cd-421a-a76f-b0c35359e0f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 1390,
      "x_nadsec_first_seen": "2026-03-08T21:43:52.256Z",
      "x_nadsec_last_seen": "2026-03-14T04:30:01.853Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "*",
        "l*******p",
        "k****n",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "P******d",
        "*",
        "***",
        "",
        "*"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=2******4; pass(top)=2******4",
      "id": "indicator--01c23d87-2135-4fe6-951e-088187fbcd06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 1390,
      "x_nadsec_first_seen": "2026-03-08T21:45:42.288Z",
      "x_nadsec_last_seen": "2026-03-14T05:08:54.552Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "m***o",
        "m**e",
        "*",
        "m*****l"
      ],
      "x_nadsec_passwords_attempted": [
        "m****n",
        "*",
        "***",
        "P******d",
        "Z******6"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--58706e79-9fd7-463d-a0cd-77b9e608ce9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.45.132.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T21:29:26.859Z",
      "x_nadsec_last_seen": "2026-03-08T21:31:33.740Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--49889bc5-d9f7-4b1f-b8d4-f4bf38ecc8d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.133.157.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-03-08T21:54:34.876Z",
      "x_nadsec_last_seen": "2026-03-11T21:54:24.367Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-08T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--8fdb8bac-1ca9-4be5-9f37-31a18339b666",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.228.130.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:05:13.000Z",
      "valid_until": "2026-04-09T22:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T21:32:28.662Z",
      "x_nadsec_last_seen": "2026-03-08T21:34:34.201Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=f*****1; pass(top)=f***i",
      "id": "indicator--c68656be-3c2d-4229-b7db-b25d7b8b1e9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1378,
      "x_nadsec_first_seen": "2026-03-08T22:38:43.289Z",
      "x_nadsec_last_seen": "2026-03-14T03:37:49.033Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "t**t",
        "t***r",
        "t******r",
        "f***d"
      ],
      "x_nadsec_passwords_attempted": [
        "C*****4",
        "f***i",
        "***",
        "1****6",
        "1**4"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=f**l; pass(top)=f**l",
      "id": "indicator--e7c331a9-4a08-4884-aa37-d96ad94a3b53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 700,
      "x_nadsec_first_seen": "2026-03-08T22:41:29.659Z",
      "x_nadsec_last_seen": "2026-03-13T01:59:08.406Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "g**i",
        "f*******i",
        "g*****l",
        "f**a"
      ],
      "x_nadsec_passwords_attempted": [
        "*",
        "***",
        "1****6",
        "1**4",
        "1******8"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=g********************o; pass(top)=R***C",
      "id": "indicator--c09bac66-bf91-4f4c-9906-2ede6d042620",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1372,
      "x_nadsec_first_seen": "2026-03-08T22:42:22.695Z",
      "x_nadsec_last_seen": "2026-03-14T03:37:32.434Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "g******m",
        "g****t",
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        "1**4",
        "1****6",
        "***",
        "F**********1",
        ""
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=g***e; pass(top)=D*****b",
      "id": "indicator--6a249b04-9e62-415a-98df-34a67b0fa73c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1372,
      "x_nadsec_first_seen": "2026-03-08T22:43:15.625Z",
      "x_nadsec_last_seen": "2026-03-14T03:31:24.910Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "g**g",
        "g***t",
        "t***t",
        "g**x"
      ],
      "x_nadsec_passwords_attempted": [
        "I******3",
        "1**4",
        "D*****b",
        "***",
        "1****6"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=g***t; pass(top)=^*******************L",
      "id": "indicator--21d5de2f-3aae-4734-9ef8-d91b20d83259",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1376,
      "x_nadsec_first_seen": "2026-03-08T22:44:05.607Z",
      "x_nadsec_last_seen": "2026-03-14T03:30:22.373Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "g***t",
        "***",
        "h****o",
        "s********r"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "1****6",
        "",
        "3**********5",
        "s***s"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=h****r; pass(top)=3**********5",
      "id": "indicator--d34b1894-15ac-45a2-a9ed-980586f1d947",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1374,
      "x_nadsec_first_seen": "2026-03-08T22:45:01.586Z",
      "x_nadsec_last_seen": "2026-03-14T03:40:16.841Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "u**r",
        "u***1",
        "u*********d",
        "u*******t"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "1****6",
        "u**r",
        "*",
        ""
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=i**o@ccs70.ru; pass(top)=3**7",
      "id": "indicator--38bdee9b-47a2-420c-b5f2-31ae5d9f043a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1379,
      "x_nadsec_first_seen": "2026-03-08T22:47:52.404Z",
      "x_nadsec_last_seen": "2026-03-14T03:49:17.862Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "***",
        "v**y",
        "i********n"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "1****6",
        "D*****b",
        "1******8",
        "*"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=***; pass(top)=***",
      "id": "indicator--96f2e712-6238-4c8f-b66a-f428f13d82a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1365,
      "x_nadsec_first_seen": "2026-03-08T22:49:14.229Z",
      "x_nadsec_last_seen": "2026-03-14T05:20:16.680Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "**",
        "i****l",
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        "*",
        "1****6",
        "***",
        "e******6",
        ""
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=15; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=b**y; pass(top)=***",
      "id": "indicator--bb3c2f35-a9a2-4d97-893f-b36e3dff1ba3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1383,
      "x_nadsec_first_seen": "2026-03-08T22:12:50.550Z",
      "x_nadsec_last_seen": "2026-03-14T05:23:35.861Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "m****e",
        "b*****a",
        "m*****a",
        "b****d"
      ],
      "x_nadsec_passwords_attempted": [
        "1**4",
        "1****6",
        "***",
        "1***5",
        "D*****b"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=15; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=b******n; pass(top)=s******n",
      "id": "indicator--4dc9759a-f92f-412e-8d7f-d5d5b05e6400",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1382,
      "x_nadsec_first_seen": "2026-03-08T22:14:43.288Z",
      "x_nadsec_last_seen": "2026-03-14T04:08:47.478Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "b*****a",
        "m***l",
        "m****a",
        "m*********r"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "u**r",
        "1****6",
        "D*****b",
        "1**4"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=15; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=**; pass(top)=**",
      "id": "indicator--17ed093a-4c79-4050-92b0-e9ef9bef2684",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1379,
      "x_nadsec_first_seen": "2026-03-08T22:15:54.883Z",
      "x_nadsec_last_seen": "2026-03-14T04:18:48.992Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "b***o",
        "**",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1**4",
        "D*****b",
        "***",
        "1****6",
        "F**********1"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=b*******t; pass(top)=B*******t",
      "id": "indicator--0d5dd88f-5757-46d0-9309-5054ed3357f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1064,
      "x_nadsec_first_seen": "2026-03-08T22:18:07.392Z",
      "x_nadsec_last_seen": "2026-03-14T05:51:33.534Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "b********************s",
        "b****r",
        "b****n"
      ],
      "x_nadsec_passwords_attempted": [
        "*",
        "***",
        "1****6",
        "F**********1",
        "D*****b"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=c*****c; pass(top)=1***5",
      "id": "indicator--a053f927-2f75-406d-81e9-87beb4f21231",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1381,
      "x_nadsec_first_seen": "2026-03-08T22:20:22.016Z",
      "x_nadsec_last_seen": "2026-03-14T04:11:01.939Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "c*****c",
        "p*****r",
        "c****s",
        "c***l"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "1****6",
        "*",
        "1**4",
        ""
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=c****o; pass(top)=***",
      "id": "indicator--4be34a8b-12c9-48e4-a31a-c2b4bdc2454d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1377,
      "x_nadsec_first_seen": "2026-03-08T22:21:32.825Z",
      "x_nadsec_last_seen": "2026-03-14T05:47:54.147Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "p****m",
        "p**m",
        "p******r",
        "c***s"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "1**4",
        "1***5",
        "1******8",
        "*"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=c*******e; pass(top)=A****3",
      "id": "indicator--ed658101-1700-49eb-9c55-731b33726bed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1380,
      "x_nadsec_first_seen": "2026-03-08T22:22:43.502Z",
      "x_nadsec_last_seen": "2026-03-14T04:33:21.080Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "c***e",
        "p**********h",
        "c***y"
      ],
      "x_nadsec_passwords_attempted": [
        "3**********5",
        "***",
        "1****6",
        "1**4",
        ""
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=c****1; pass(top)=0******,",
      "id": "indicator--05399f35-4162-4825-afbd-d904d88415d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1375,
      "x_nadsec_first_seen": "2026-03-08T22:24:51.407Z",
      "x_nadsec_last_seen": "2026-03-14T04:25:59.279Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "***",
        "c**********b",
        "c******a"
      ],
      "x_nadsec_passwords_attempted": [
        "*",
        "0******,",
        "***",
        "3**********5",
        "1**4"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=***; pass(top)=A*******5",
      "id": "indicator--ee29da1d-cb57-4c92-a031-ec84109eea60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1378,
      "x_nadsec_first_seen": "2026-03-08T22:25:05.678Z",
      "x_nadsec_last_seen": "2026-03-14T03:56:22.806Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "r****t",
        "r******y",
        "c************y"
      ],
      "x_nadsec_passwords_attempted": [
        "a****a",
        "***",
        "a******6",
        "1****6",
        "1***5"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=***; pass(top)=1********0",
      "id": "indicator--f1f80c3e-dd62-4807-ac96-fde61bca66fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1378,
      "x_nadsec_first_seen": "2026-03-08T22:26:22.765Z",
      "x_nadsec_last_seen": "2026-03-14T04:43:32.626Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "d*****e",
        "d***d",
        "r***s",
        "d****l"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "*",
        "1****6",
        "1**4",
        "D*****b"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=d***o; pass(top)=1******8",
      "id": "indicator--f721eea2-a3ab-4c64-826a-e4fa63bb99c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1379,
      "x_nadsec_first_seen": "2026-03-08T22:26:42.064Z",
      "x_nadsec_last_seen": "2026-03-14T05:47:35.890Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "d***o",
        "***",
        "o****e",
        "d**o"
      ],
      "x_nadsec_passwords_attempted": [
        "*",
        "***",
        "F**********1",
        "1****6",
        ""
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=d**i; pass(top)=d**i",
      "id": "indicator--28fda1d0-e472-4d4a-90b9-ad1df83de198",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1383,
      "x_nadsec_first_seen": "2026-03-08T22:27:55.679Z",
      "x_nadsec_last_seen": "2026-03-14T03:47:14.786Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "s***e",
        "s***p",
        "d****e"
      ],
      "x_nadsec_passwords_attempted": [
        "1*****a",
        "***",
        "1**4",
        "W******1",
        "1****6"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=d***o; pass(top)=1***5",
      "id": "indicator--a4ffd61d-addb-4ac7-841d-e95686ff3b90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1386,
      "x_nadsec_first_seen": "2026-03-08T22:28:57.905Z",
      "x_nadsec_last_seen": "2026-03-14T03:31:48.990Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "d***o",
        "d***************n",
        "p******a",
        "p***p"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "1**4",
        "1****6",
        "1******8",
        "*"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=d******o; pass(top)=1**4",
      "id": "indicator--eeb4c841-7351-4d70-a7e7-92345e01f98b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-08T22:29:54.207Z",
      "x_nadsec_last_seen": "2026-03-08T23:38:31.133Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "d******s",
        "d******o",
        "d***r",
        "d******e",
        "d*****c"
      ],
      "x_nadsec_passwords_attempted": [
        "D*******3",
        "",
        "0**2",
        "1**4",
        "A*********1"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=***; pass(top)=1******X",
      "id": "indicator--18257931-c386-4689-bd96-499e81a7ed7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1372,
      "x_nadsec_first_seen": "2026-03-08T22:30:51.726Z",
      "x_nadsec_last_seen": "2026-03-14T04:40:33.881Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "e*****r",
        "***",
        "p***o",
        "s************n"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "1**4",
        "1****6",
        "D*****b",
        "*"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=e*********m; pass(top)=E****8",
      "id": "indicator--b48fd33f-2bef-46d0-a838-b0289f32e580",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1380,
      "x_nadsec_first_seen": "2026-03-08T22:31:59.804Z",
      "x_nadsec_last_seen": "2026-03-14T05:23:08.561Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "r***r",
        "***",
        "r**l",
        "r******r"
      ],
      "x_nadsec_passwords_attempted": [
        "1**4",
        "***",
        "1****6",
        "",
        "*"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=e******e; pass(top)=P***a",
      "id": "indicator--8cd923b7-8c7e-4843-a7b7-4aafb3f9cfac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1383,
      "x_nadsec_first_seen": "2026-03-08T22:34:01.275Z",
      "x_nadsec_last_seen": "2026-03-14T03:46:26.509Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "r**t",
        "r***n",
        "v*******a",
        "e*******p"
      ],
      "x_nadsec_passwords_attempted": [
        "P*******1",
        "***",
        "1**4",
        "*",
        ""
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=e***********h; pass(top)=E****4",
      "id": "indicator--c363e4a0-c4a1-481e-9870-358b217f7dc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1375,
      "x_nadsec_first_seen": "2026-03-08T22:35:05.761Z",
      "x_nadsec_last_seen": "2026-03-14T03:23:04.352Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "***",
        "e**l",
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "1**4",
        "*",
        "1****6",
        ""
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=e****t; pass(top)=E****T",
      "id": "indicator--88ee7fa0-cf65-4e38-b20f-83ab884c370f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1379,
      "x_nadsec_first_seen": "2026-03-08T22:36:35.138Z",
      "x_nadsec_last_seen": "2026-03-14T03:40:03.325Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "r**t",
        "s******2",
        "**",
        "e*****n"
      ],
      "x_nadsec_passwords_attempted": [
        "*",
        "***",
        "1****6",
        "1**4",
        ""
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=f****1; pass(top)=6****1",
      "id": "indicator--97d0f59a-4d67-489b-90b8-9f77afc25919",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1358,
      "x_nadsec_first_seen": "2026-03-08T22:37:47.761Z",
      "x_nadsec_last_seen": "2026-03-14T05:50:04.297Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "t**t",
        "t***1",
        "p******l",
        "p******p"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6",
        "***",
        "1**4",
        "6****1",
        ""
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=18; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=**; pass(top)=1****6",
      "id": "indicator--428b13a0-af6f-45b5-bda9-bb8718d6b73d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1387,
      "x_nadsec_first_seen": "2026-03-08T22:05:56.621Z",
      "x_nadsec_last_seen": "2026-03-14T04:33:59.963Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "a****a",
        "***",
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        "3**********5",
        "***",
        "1**4",
        "1******8",
        ""
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=17; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=a**a; pass(top)=A******0",
      "id": "indicator--d25fb1d6-88e1-404e-abfb-6ec06ad94ba8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1387,
      "x_nadsec_first_seen": "2026-03-08T22:07:05.099Z",
      "x_nadsec_last_seen": "2026-03-14T04:41:16.548Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "a*****o",
        "n*****a",
        "a****b"
      ],
      "x_nadsec_passwords_attempted": [
        "P*******1",
        "***",
        "1**4",
        "1******8",
        "1****6"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=18; services=mssqld; ports=1433; cc=NL; asn=202412; asn_org=Omegatech LTD; user(top)=a*****k; pass(top)=a*****k",
      "id": "indicator--f32e8bb5-eb0d-4de4-8405-81c8cb966d65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.54.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1386,
      "x_nadsec_first_seen": "2026-03-08T22:08:11.350Z",
      "x_nadsec_last_seen": "2026-03-14T04:41:14.374Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "n****s",
        "n**************r",
        "n***************r",
        "n***m"
      ],
      "x_nadsec_passwords_attempted": [
        "A******4",
        "*",
        "***",
        "",
        "1**4"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--5d0e47db-a7e8-4fbd-8e2c-165e7d8255ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.178.138.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T22:05:41.494Z",
      "x_nadsec_last_seen": "2026-03-08T22:07:48.436Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi",
      "id": "indicator--c3f2107d-6c00-4839-a748-84b011bcc10a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.156.73.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-08T22:16:40.369Z",
      "x_nadsec_last_seen": "2026-03-18T21:09:05.281Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "211736"
      ],
      "x_nadsec_orgs": [
        "FOP Dmytro Nedilskyi"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--2ef6fb13-b474-438b-b19c-d689c381ef05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.157.156.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T22:35:37.111Z",
      "x_nadsec_last_seen": "2026-03-08T22:37:42.837Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VE; asn=269820; asn_org=FULL DATA COMUNICACIONES C.A.",
      "id": "indicator--826c8421-37e0-4c0a-8318-ea35d2b16b97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.33.206.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-08T22:36:05.416Z",
      "x_nadsec_last_seen": "2026-03-08T22:36:05.721Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "269820"
      ],
      "x_nadsec_orgs": [
        "FULL DATA COMUNICACIONES C.A."
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LA; asn=9873; asn_org=Lao Telecom Communication, LTC",
      "id": "indicator--df1eb664-e708-4d5b-864b-ce84d8a9e8c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.137.141.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T22:41:05.851Z",
      "x_nadsec_last_seen": "2026-03-08T22:43:10.520Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "9873"
      ],
      "x_nadsec_orgs": [
        "Lao Telecom Communication, LTC"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a2f0c99c-5859-43e5-ae7e-11a97a8e8695",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T22:27:40.303Z",
      "x_nadsec_last_seen": "2026-03-08T22:27:40.303Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TR; asn=197720; asn_org=TURKTICARET.NET YAZILIM HIZMETLERI SAN. ve TIC. A.S.",
      "id": "indicator--677b0f76-049a-432a-9ffe-ecd53e530ab4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.186.19.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T22:41:31.128Z",
      "x_nadsec_last_seen": "2026-03-08T22:41:31.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "197720"
      ],
      "x_nadsec_orgs": [
        "TURKTICARET.NET YAZILIM HIZMETLERI SAN. ve TIC. A.S."
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=**; pass(top)=h****1",
      "id": "indicator--61883f2e-71aa-442f-b9b2-a96d61abed5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.92.243.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1378,
      "x_nadsec_first_seen": "2026-03-08T22:45:59.556Z",
      "x_nadsec_last_seen": "2026-03-14T04:29:45.301Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "**",
        "h***e",
        "i******n",
        "v******a"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6",
        "***",
        "*",
        "",
        "1***5"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=***; pass(top)=***",
      "id": "indicator--fb81f16f-448f-4736-a608-12d4f90a7895",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.92.243.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1275,
      "x_nadsec_first_seen": "2026-03-08T22:46:56.335Z",
      "x_nadsec_last_seen": "2026-03-13T19:18:14.014Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "i************v",
        "i*****s",
        "z****a"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "D*****b",
        "1****6",
        "*",
        "*"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=18; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=a*****n; pass(top)=S*********1",
      "id": "indicator--5883bb84-68ba-4bdd-b1ff-f3b642735518",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.92.243.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1391,
      "x_nadsec_first_seen": "2026-03-08T22:09:27.818Z",
      "x_nadsec_last_seen": "2026-03-14T04:31:45.574Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "a***t",
        "n****a",
        "s*****k"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "1****6",
        "1**4",
        "3**********5",
        "1******8"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=17; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=a**i; pass(top)=B*****A",
      "id": "indicator--a3f2c293-5167-46b4-9a02-8e14709d2d26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.92.243.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1385,
      "x_nadsec_first_seen": "2026-03-08T22:11:13.458Z",
      "x_nadsec_last_seen": "2026-03-14T04:58:12.119Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "b****p",
        "**",
        "a**i"
      ],
      "x_nadsec_passwords_attempted": [
        "*",
        "1******@",
        "***",
        "1****6",
        "D*****b"
      ]
    },
    {
      "created": "2026-03-08T23:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=j****1; pass(top)=w*****e",
      "id": "indicator--7c321b0f-80ae-4ecd-9c8d-6d305aed95d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-08T23:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.92.243.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:05:07.000Z",
      "valid_until": "2026-04-09T23:05:06.000Z",
      "x_nadsec_event_count": 1385,
      "x_nadsec_first_seen": "2026-03-08T22:50:41.331Z",
      "x_nadsec_last_seen": "2026-03-14T04:55:44.740Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "j**i",
        "***",
        "y***n",
        "j***s"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "1******8",
        "1****6",
        "*",
        "D*****b"
      ]
    },
    {
      "created": "2026-03-09T00:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--91972114-d7ed-4468-a2dc-b4e2b5a00cf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.176.161.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:05:07.000Z",
      "valid_until": "2026-04-10T00:05:05.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-08T23:07:18.493Z",
      "x_nadsec_last_seen": "2026-03-08T23:25:08.288Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-09T00:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=SA; asn=35819; asn_org=Etihad Etisalat, a joint stock company",
      "id": "indicator--59f37f63-c2f9-46db-a2eb-bd5fdb4240d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.224.151.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:05:07.000Z",
      "valid_until": "2026-04-10T00:05:05.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-08T23:47:30.710Z",
      "x_nadsec_last_seen": "2026-03-09T00:06:50.191Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "35819"
      ],
      "x_nadsec_orgs": [
        "Etihad Etisalat, a joint stock company"
      ]
    },
    {
      "created": "2026-03-09T00:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--bc33101d-7195-4ec1-a2d9-0d0184b6d5fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.180.216.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:05:07.000Z",
      "valid_until": "2026-04-10T00:05:05.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-08T23:09:22.500Z",
      "x_nadsec_last_seen": "2026-03-26T08:51:31.463Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-09T00:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--90782e9b-6a2f-418b-8029-d983b418a490",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:05:07.000Z",
      "valid_until": "2026-04-10T00:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T23:40:31.956Z",
      "x_nadsec_last_seen": "2026-03-08T23:40:31.956Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-09T00:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=LT; asn=209605; asn_org=UAB Host Baltic",
      "id": "indicator--fdfc767d-3012-402a-84b1-f55acece7c35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.36.81.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:05:07.000Z",
      "valid_until": "2026-04-10T00:05:05.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-08T23:17:28.636Z",
      "x_nadsec_last_seen": "2026-03-26T21:38:57.575Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LT"
      ],
      "x_nadsec_asns": [
        "209605"
      ],
      "x_nadsec_orgs": [
        "UAB Host Baltic"
      ]
    },
    {
      "created": "2026-03-09T00:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a06d57a3-6d69-47db-8d9c-2a46d5bc8192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:05:07.000Z",
      "valid_until": "2026-04-10T00:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T23:20:27.907Z",
      "x_nadsec_last_seen": "2026-03-08T23:20:27.907Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-09T00:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9ae5ef12-5a67-4374-93e1-ddeb8f510ab8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:05:07.000Z",
      "valid_until": "2026-04-10T00:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-08T23:32:26.579Z",
      "x_nadsec_last_seen": "2026-03-08T23:32:26.579Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-09T00:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=39891; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--8d2b84f0-a6d4-4280-b1b8-f3dd70faf64d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T00:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.41.120.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:05:07.000Z",
      "valid_until": "2026-04-10T00:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-08T23:09:41.680Z",
      "x_nadsec_last_seen": "2026-03-08T23:11:48.799Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "39891"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BI; asn=37545; asn_org=BBSS",
      "id": "indicator--e19ada8e-071f-4f34-9b7b-df295da2ffca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.134.100.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:05:10.000Z",
      "valid_until": "2026-04-10T01:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T00:38:24.827Z",
      "x_nadsec_last_seen": "2026-03-09T00:38:24.996Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BI"
      ],
      "x_nadsec_asns": [
        "37545"
      ],
      "x_nadsec_orgs": [
        "BBSS"
      ]
    },
    {
      "created": "2026-03-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--692c5a2b-ab35-4f63-a0c6-9ae80a249b26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.51.241.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:05:10.000Z",
      "valid_until": "2026-04-10T01:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-09T00:27:27.590Z",
      "x_nadsec_last_seen": "2026-03-14T13:35:35.224Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-03-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--bdfed098-3063-4116-9841-19eb7779fd9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.230.253.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:05:10.000Z",
      "valid_until": "2026-04-10T01:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T01:04:46.062Z",
      "x_nadsec_last_seen": "2026-03-09T01:04:51.989Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--daa727b8-b7ed-40fd-af9d-51fe2d5ad3a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.212.176.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:05:10.000Z",
      "valid_until": "2026-04-10T01:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T00:54:01.366Z",
      "x_nadsec_last_seen": "2026-03-09T00:56:07.793Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=52783; asn_org=ALCANS TELECOM LTDA",
      "id": "indicator--c2295769-b90c-4177-8960-fd140393922a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.200.69.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:05:10.000Z",
      "valid_until": "2026-04-10T01:05:08.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-09T00:15:09.687Z",
      "x_nadsec_last_seen": "2026-03-17T12:22:24.187Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52783"
      ],
      "x_nadsec_orgs": [
        "ALCANS TELECOM LTDA"
      ]
    },
    {
      "created": "2026-03-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--ff196346-70ac-48b7-aa08-d27ff390d955",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.11.154.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:05:10.000Z",
      "valid_until": "2026-04-10T01:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T01:03:40.685Z",
      "x_nadsec_last_seen": "2026-03-09T01:10:11.586Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-03-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--35667023-4f52-44b2-81bd-3a85ac3dcc0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.73.67.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:05:10.000Z",
      "valid_until": "2026-04-10T01:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T00:48:27.048Z",
      "x_nadsec_last_seen": "2026-03-09T00:48:27.048Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--566d92f6-1198-4f93-92d1-4492949e2b2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:05:10.000Z",
      "valid_until": "2026-04-10T01:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T00:47:07.440Z",
      "x_nadsec_last_seen": "2026-03-20T20:30:15.203Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--990b99f0-80e9-4061-a997-9baeb575f31f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.78.113.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:05:10.000Z",
      "valid_until": "2026-04-10T01:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T01:01:10.090Z",
      "x_nadsec_last_seen": "2026-03-09T01:01:15.114Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-09T01:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PH; asn=9927; asn_org=Philippine Global Communications Corporation",
      "id": "indicator--bf2de3dc-ef35-4aef-9a20-2645f6846524",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T01:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.97.171.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:05:10.000Z",
      "valid_until": "2026-04-10T01:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T00:49:14.376Z",
      "x_nadsec_last_seen": "2026-03-09T00:49:15.028Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9927"
      ],
      "x_nadsec_orgs": [
        "Philippine Global Communications Corporation"
      ]
    },
    {
      "created": "2026-03-09T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=131711; asn_org=PT Global Teknologi Teraindo",
      "id": "indicator--c1872a5b-ff54-4b84-bce0-7ea4aefb9bc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.9.126.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:05:03.000Z",
      "valid_until": "2026-04-10T02:05:02.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-09T01:33:15.657Z",
      "x_nadsec_last_seen": "2026-03-09T03:00:33.885Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "131711"
      ],
      "x_nadsec_orgs": [
        "PT Global Teknologi Teraindo"
      ]
    },
    {
      "created": "2026-03-09T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--c301aa11-2900-45c8-864f-5da22223ba1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.3.174.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:05:03.000Z",
      "valid_until": "2026-04-10T02:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T01:12:40.691Z",
      "x_nadsec_last_seen": "2026-03-09T01:14:45.940Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-09T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--2e4ace29-dd99-4801-89d5-1e0de7c9f0c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.163.204.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:05:03.000Z",
      "valid_until": "2026-04-10T02:05:02.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-03-09T02:00:02.483Z",
      "x_nadsec_last_seen": "2026-03-10T12:07:44.189Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-09T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--7233bf12-e2f5-41d4-911f-ab6a54154a9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.224.182.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:05:03.000Z",
      "valid_until": "2026-04-10T02:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T01:26:44.090Z",
      "x_nadsec_last_seen": "2026-03-09T01:31:16.326Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-09T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--7127e4af-e78b-44bc-9f01-2325af512f2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.42.215.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:05:03.000Z",
      "valid_until": "2026-04-10T02:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T01:22:31.473Z",
      "x_nadsec_last_seen": "2026-03-09T01:29:30.896Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-09T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12730; asn_org=Rostelecom",
      "id": "indicator--a8dfbcc2-4a97-4609-ac51-7381d23a8b1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.26.252.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:05:03.000Z",
      "valid_until": "2026-04-10T02:05:02.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-09T01:07:38.246Z",
      "x_nadsec_last_seen": "2026-03-09T03:33:16.257Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12730"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-09T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7f5c226a-5425-42a0-b114-7590a5053532",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:05:03.000Z",
      "valid_until": "2026-04-10T02:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T01:32:45.254Z",
      "x_nadsec_last_seen": "2026-03-09T01:32:45.633Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-09T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--59085736-d867-43f6-bf97-0f1cf25a28af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:05:03.000Z",
      "valid_until": "2026-04-10T02:05:02.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-09T01:18:29.695Z",
      "x_nadsec_last_seen": "2026-03-19T06:47:34.697Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-09T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--0c72b107-23c2-46b2-bfe6-d07197a68799",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.60.70.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:05:03.000Z",
      "valid_until": "2026-04-10T02:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T01:41:44.339Z",
      "x_nadsec_last_seen": "2026-03-09T01:41:44.658Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-03-09T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=209489; asn_org=Azintex.com LLC",
      "id": "indicator--351c6750-cbe2-4830-83df-41c9531cc870",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.20.48.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:05:03.000Z",
      "valid_until": "2026-04-10T02:05:02.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-09T01:14:53.547Z",
      "x_nadsec_last_seen": "2026-03-14T10:26:22.447Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "209489"
      ],
      "x_nadsec_orgs": [
        "Azintex.com LLC"
      ]
    },
    {
      "created": "2026-03-09T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=136698; asn_org=Devdarpan Broadband Pvt. Ltd.",
      "id": "indicator--f9717278-6ab2-4098-b4f4-0ed507d9662f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.83.9.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:05:13.000Z",
      "valid_until": "2026-04-10T03:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T02:56:55.789Z",
      "x_nadsec_last_seen": "2026-03-09T02:56:55.836Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "136698"
      ],
      "x_nadsec_orgs": [
        "Devdarpan Broadband Pvt. Ltd."
      ]
    },
    {
      "created": "2026-03-09T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--d7f3ceb6-2e25-4eaf-87cd-b345cb129140",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.59.231.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:05:13.000Z",
      "valid_until": "2026-04-10T03:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T02:28:50.540Z",
      "x_nadsec_last_seen": "2026-03-09T02:34:12.392Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-09T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--64a1d319-e416-46c8-bcaf-b74dd64ab01a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:05:13.000Z",
      "valid_until": "2026-04-10T03:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T02:58:03.639Z",
      "x_nadsec_last_seen": "2026-03-15T04:42:57.291Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-09T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KG; asn=207369; asn_org=Skynet Telecom, LLC",
      "id": "indicator--0eb6477e-709c-4be7-94de-499f8f1517ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.138.186.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:05:13.000Z",
      "valid_until": "2026-04-10T03:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T02:13:29.362Z",
      "x_nadsec_last_seen": "2026-03-09T02:13:36.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "207369"
      ],
      "x_nadsec_orgs": [
        "Skynet Telecom, LLC"
      ]
    },
    {
      "created": "2026-03-09T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dca7cda3-87ae-45dd-8aa3-6ec089afeddf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:05:13.000Z",
      "valid_until": "2026-04-10T03:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T02:57:50.497Z",
      "x_nadsec_last_seen": "2026-03-09T02:57:50.497Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-09T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=8075; asn_org=Microsoft Corporation; user(top)=**",
      "id": "indicator--821d1789-daf2-456f-b5e5-eeb5f6dd3816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.197.12.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:05:13.000Z",
      "valid_until": "2026-04-10T03:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T02:25:58.563Z",
      "x_nadsec_last_seen": "2026-03-09T02:25:58.563Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-09T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--d093e284-ce3c-4cc8-ae89-4c23145a5fc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.88.51.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:05:13.000Z",
      "valid_until": "2026-04-10T03:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T02:34:35.158Z",
      "x_nadsec_last_seen": "2026-03-09T02:34:40.661Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-09T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--068e6bb5-804b-4501-874a-877bae37a383",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.208.111.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T03:05:13.000Z",
      "valid_until": "2026-04-10T03:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T02:55:48.535Z",
      "x_nadsec_last_seen": "2026-03-09T03:03:40.013Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-09T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=4761; asn_org=INDOSAT Internet Network Provider",
      "id": "indicator--360307a6-6ef4-4f32-8be4-7551024ea754",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.10.44.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:05:13.000Z",
      "valid_until": "2026-04-10T04:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T03:55:14.082Z",
      "x_nadsec_last_seen": "2026-03-09T04:00:10.831Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4761"
      ],
      "x_nadsec_orgs": [
        "INDOSAT Internet Network Provider"
      ]
    },
    {
      "created": "2026-03-09T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--ee65f894-bbb1-41d2-8546-7aa9bbdea6a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.92.145.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:05:13.000Z",
      "valid_until": "2026-04-10T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T03:36:40.504Z",
      "x_nadsec_last_seen": "2026-03-09T03:38:47.221Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-09T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--a9519e4f-b636-41a4-be54-e464e5749257",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:05:13.000Z",
      "valid_until": "2026-04-10T04:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-09T03:16:40.154Z",
      "x_nadsec_last_seen": "2026-03-10T22:38:13.597Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-09T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--36bc55d3-6224-40f3-b0e0-fee6469deefa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.251.156.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:05:13.000Z",
      "valid_until": "2026-04-10T04:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T03:28:10.841Z",
      "x_nadsec_last_seen": "2026-03-09T03:34:47.006Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-09T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8c42d68e-02b9-4acc-92bc-2fd5724f7b24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.55.42.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:05:13.000Z",
      "valid_until": "2026-04-10T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T03:16:25.928Z",
      "x_nadsec_last_seen": "2026-03-31T21:34:30.652Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-09T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--76f35d21-e2f2-4f8a-95c7-6de8b666ae4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '218.166.194.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:05:13.000Z",
      "valid_until": "2026-04-10T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T03:51:27.540Z",
      "x_nadsec_last_seen": "2026-03-09T03:53:32.226Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-09T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--9c8b667b-f375-4f48-90e2-29e273dce9db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.38.53.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:05:13.000Z",
      "valid_until": "2026-04-10T04:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T03:58:31.018Z",
      "x_nadsec_last_seen": "2026-03-09T03:58:31.018Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-09T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--c69d5fb8-40b8-495d-ac85-46db6a167325",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.72.1.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:05:13.000Z",
      "valid_until": "2026-04-10T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T04:00:04.397Z",
      "x_nadsec_last_seen": "2026-03-09T04:02:12.827Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-09T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--be1ef614-660d-4613-937c-5dd440910814",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.82.38.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:05:13.000Z",
      "valid_until": "2026-04-10T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T03:32:35.083Z",
      "x_nadsec_last_seen": "2026-03-09T03:34:40.129Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-09T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=4787; asn_org=PT Cyberindo Aditama",
      "id": "indicator--71fc90f7-3031-4827-bd69-0b2c68b9cdfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.114.112.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:05:02.000Z",
      "valid_until": "2026-04-10T05:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-09T04:41:49.058Z",
      "x_nadsec_last_seen": "2026-03-17T13:03:13.968Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4787"
      ],
      "x_nadsec_orgs": [
        "PT Cyberindo Aditama"
      ]
    },
    {
      "created": "2026-03-09T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=132116; asn_org=Ani Network Pvt Ltd",
      "id": "indicator--a8a18360-02a6-40a3-a704-2882d23b5a0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.40.200.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:05:02.000Z",
      "valid_until": "2026-04-10T05:05:01.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-09T04:40:00.072Z",
      "x_nadsec_last_seen": "2026-03-12T18:42:30.973Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132116"
      ],
      "x_nadsec_orgs": [
        "Ani Network Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-09T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=47; services=smbd; ports=445; cc=ID; asn=4761; asn_org=INDOSAT Internet Network Provider",
      "id": "indicator--26d135ce-5511-4765-a266-75d8756e6b4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.8.201.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:05:02.000Z",
      "valid_until": "2026-04-10T05:05:01.000Z",
      "x_nadsec_event_count": 47,
      "x_nadsec_first_seen": "2026-03-09T04:55:59.856Z",
      "x_nadsec_last_seen": "2026-03-09T05:00:09.697Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4761"
      ],
      "x_nadsec_orgs": [
        "INDOSAT Internet Network Provider"
      ]
    },
    {
      "created": "2026-03-09T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=24122; asn_org=BDCOM Online Limited",
      "id": "indicator--8fa4d47e-12b0-4da3-9bab-404aa6724691",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.40.82.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:05:02.000Z",
      "valid_until": "2026-04-10T05:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-09T04:40:39.767Z",
      "x_nadsec_last_seen": "2026-03-31T10:01:40.311Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "24122"
      ],
      "x_nadsec_orgs": [
        "BDCOM Online Limited"
      ]
    },
    {
      "created": "2026-03-09T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--ab54f0e4-4168-4707-9f9a-525cf385e062",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.253.188.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:05:02.000Z",
      "valid_until": "2026-04-10T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T04:10:57.533Z",
      "x_nadsec_last_seen": "2026-03-09T04:13:02.920Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-03-09T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=23956; asn_org=AmberIT Limited",
      "id": "indicator--d42751d5-2061-4860-9919-61c318e30ac4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.4.113.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:05:02.000Z",
      "valid_until": "2026-04-10T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T04:34:53.895Z",
      "x_nadsec_last_seen": "2026-03-09T04:36:58.632Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23956"
      ],
      "x_nadsec_orgs": [
        "AmberIT Limited"
      ]
    },
    {
      "created": "2026-03-09T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=23688; asn_org=Link3 Technologies Ltd.",
      "id": "indicator--28b7e96c-17cd-40c0-a6f2-fa66abe74b42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.147.139.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:05:02.000Z",
      "valid_until": "2026-04-10T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T04:50:26.525Z",
      "x_nadsec_last_seen": "2026-03-09T04:52:32.459Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23688"
      ],
      "x_nadsec_orgs": [
        "Link3 Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-09T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7525bcf1-4314-4c0f-ac68-da2286508080",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:05:02.000Z",
      "valid_until": "2026-04-10T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T04:32:33.375Z",
      "x_nadsec_last_seen": "2026-03-09T04:32:33.375Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-09T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=138277; asn_org=Radinet Info Solutions Private Limited",
      "id": "indicator--0486ec42-cd2e-47a8-80ec-0b928c1f831e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.167.195.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:05:14.000Z",
      "valid_until": "2026-04-10T06:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T05:46:05.812Z",
      "x_nadsec_last_seen": "2026-03-09T05:48:10.735Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138277"
      ],
      "x_nadsec_orgs": [
        "Radinet Info Solutions Private Limited"
      ]
    },
    {
      "created": "2026-03-09T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--46a103a8-a262-423e-b330-a789c6dfb046",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.137.213.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:05:14.000Z",
      "valid_until": "2026-04-10T06:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T05:58:13.697Z",
      "x_nadsec_last_seen": "2026-03-09T06:00:18.469Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-09T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--21de56bc-f3b3-48b3-8886-dd27fe6f4278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.186.190.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:05:14.000Z",
      "valid_until": "2026-04-10T06:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T05:53:31.385Z",
      "x_nadsec_last_seen": "2026-03-09T05:55:37.421Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-09T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--3788e15d-b735-4c90-8634-d847eafee109",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:05:14.000Z",
      "valid_until": "2026-04-10T06:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T05:41:36.357Z",
      "x_nadsec_last_seen": "2026-03-09T05:41:43.718Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-03-09T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--016df86d-a143-4275-9f46-7fc8212720a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.254.169.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:05:14.000Z",
      "valid_until": "2026-04-10T06:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T05:15:22.379Z",
      "x_nadsec_last_seen": "2026-03-09T05:17:27.259Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-09T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--afac0980-7d22-463c-80ec-868748b6b0f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.73.225.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:05:14.000Z",
      "valid_until": "2026-04-10T06:05:13.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T06:04:07.792Z",
      "x_nadsec_last_seen": "2026-03-09T06:04:39.421Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-09T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--36aff66c-644e-4830-b407-284f9e017b78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:05:14.000Z",
      "valid_until": "2026-04-10T06:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T05:58:07.565Z",
      "x_nadsec_last_seen": "2026-03-09T05:58:07.565Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-09T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--1d70dfcf-15e5-4eca-a07e-7037fd59da3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.77.206.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:05:14.000Z",
      "valid_until": "2026-04-10T06:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T06:03:06.839Z",
      "x_nadsec_last_seen": "2026-03-09T06:03:13.506Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-03-09T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12714; asn_org=PJSC MegaFon",
      "id": "indicator--96c2ffff-81f1-4b94-9768-1e1dc6f1dc4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.111.15.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:05:14.000Z",
      "valid_until": "2026-04-10T06:05:13.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T05:57:20.375Z",
      "x_nadsec_last_seen": "2026-03-12T11:23:47.801Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12714"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-09T06:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=29456; asn_org=Rostelecom",
      "id": "indicator--8a233ca3-4998-4c93-83b4-5cf5a5ad79ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T06:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.151.114.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T06:05:14.000Z",
      "valid_until": "2026-04-10T06:05:13.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T05:33:04.703Z",
      "x_nadsec_last_seen": "2026-03-09T05:42:01.536Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "29456"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-09T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--2d13ecce-bc09-4ce5-b8e6-20da17e7ed63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.20.218.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:05:13.000Z",
      "valid_until": "2026-04-10T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T06:51:25.289Z",
      "x_nadsec_last_seen": "2026-03-09T06:53:30.839Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-09T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--60f213c1-da4c-4708-beba-23d9779e4a05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.136.221.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:05:13.000Z",
      "valid_until": "2026-04-10T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T06:20:18.419Z",
      "x_nadsec_last_seen": "2026-03-09T06:20:23.240Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-09T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b5f1eb1b-0c26-4750-af02-e16a6e94a029",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.40.13.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:05:13.000Z",
      "valid_until": "2026-04-10T07:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T06:41:05.675Z",
      "x_nadsec_last_seen": "2026-03-09T06:43:10.385Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-09T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a544a7b2-ee0b-4afa-b9b0-23a08673a089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.4.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:05:13.000Z",
      "valid_until": "2026-04-10T07:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-09T06:45:34.916Z",
      "x_nadsec_last_seen": "2026-03-09T06:47:31.173Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-09T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6e72f6b9-ff8b-440b-89ae-8059b7caf90e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:05:13.000Z",
      "valid_until": "2026-04-10T07:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T06:50:03.851Z",
      "x_nadsec_last_seen": "2026-03-21T05:35:07.445Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-09T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--d191a660-0b16-445b-a5e6-295dbad19a55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.192.58.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:05:13.000Z",
      "valid_until": "2026-04-10T07:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T06:26:30.493Z",
      "x_nadsec_last_seen": "2026-03-09T06:26:30.493Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-09T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=56272; asn_org=Pulse Telesystems Pvt Ltd",
      "id": "indicator--95846250-70a0-4e7f-90e5-e517bfe4adf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.235.120.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:05:13.000Z",
      "valid_until": "2026-04-10T07:05:12.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-09T07:00:03.680Z",
      "x_nadsec_last_seen": "2026-03-09T07:30:22.773Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "56272"
      ],
      "x_nadsec_orgs": [
        "Pulse Telesystems Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-09T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--da8ddf07-ba07-4689-9950-d02cab5567b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.142.74.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:05:13.000Z",
      "valid_until": "2026-04-10T07:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T06:13:42.998Z",
      "x_nadsec_last_seen": "2026-03-09T06:13:43.104Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-09T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c66c4eef-7211-4408-aed3-70a445e276d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.168.13.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:05:13.000Z",
      "valid_until": "2026-04-10T07:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T06:44:23.134Z",
      "x_nadsec_last_seen": "2026-03-09T06:44:33.277Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-09T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=4618; asn_org=Internet Thailand Company Limited",
      "id": "indicator--d6f6dedc-10d0-4ec1-8dcf-b356bca0f595",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.150.132.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:05:13.000Z",
      "valid_until": "2026-04-10T07:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T06:31:42.237Z",
      "x_nadsec_last_seen": "2026-03-09T08:35:45.278Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "4618"
      ],
      "x_nadsec_orgs": [
        "Internet Thailand Company Limited"
      ]
    },
    {
      "created": "2026-03-09T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=32475; asn_org=Internap Holding LLC",
      "id": "indicator--94596175-4e57-4e86-93bc-deffbc03efa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:05:13.000Z",
      "valid_until": "2026-04-10T07:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-09T06:10:12.518Z",
      "x_nadsec_last_seen": "2026-03-13T08:29:31.772Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32475"
      ],
      "x_nadsec_orgs": [
        "Internap Holding LLC"
      ]
    },
    {
      "created": "2026-03-09T07:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--29b3442f-f06a-48d9-9acf-5c1876ccc730",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T07:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.126.124.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:05:13.000Z",
      "valid_until": "2026-04-10T07:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T06:22:48.356Z",
      "x_nadsec_last_seen": "2026-03-09T06:30:33.383Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-09T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133982; asn_org=Excitel Broadband Private Limited",
      "id": "indicator--de5039f5-43f2-4af9-8e42-086846a33770",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.110.48.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:05:13.000Z",
      "valid_until": "2026-04-10T08:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-09T07:53:42.469Z",
      "x_nadsec_last_seen": "2026-03-09T09:54:32.999Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133982"
      ],
      "x_nadsec_orgs": [
        "Excitel Broadband Private Limited"
      ]
    },
    {
      "created": "2026-03-09T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=TW; asn=3462; asn_org=Data Communication Business Group; user(top)=**; pass(top)=1**4",
      "id": "indicator--c2c2dd18-7533-435c-8d2b-1d797789ed9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.38.196.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:05:13.000Z",
      "valid_until": "2026-04-10T08:05:12.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-09T07:24:46.361Z",
      "x_nadsec_last_seen": "2026-03-09T07:24:55.270Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1**4"
      ]
    },
    {
      "created": "2026-03-09T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--8720210c-7044-41d9-ad75-cf434fe52d44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.201.203.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:05:13.000Z",
      "valid_until": "2026-04-10T08:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T07:13:18.826Z",
      "x_nadsec_last_seen": "2026-03-09T07:13:18.826Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-09T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--8749a426-c832-4b64-8e8c-be33c1e01e64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.25.224.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:05:13.000Z",
      "valid_until": "2026-04-10T08:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T07:28:57.671Z",
      "x_nadsec_last_seen": "2026-03-09T07:35:53.875Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-09T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--3431212b-71a0-4a60-81bf-d078032da9bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.161.72.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:05:13.000Z",
      "valid_until": "2026-04-10T08:05:12.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-03-09T07:41:30.263Z",
      "x_nadsec_last_seen": "2026-03-09T07:44:02.294Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-09T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--a9c2224c-6bef-421a-8166-37b2c99cd8e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.26.120.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:05:13.000Z",
      "valid_until": "2026-04-10T08:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T07:56:58.780Z",
      "x_nadsec_last_seen": "2026-03-09T07:59:03.745Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-09T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BZ; asn=28094; asn_org=Southern Cable Network",
      "id": "indicator--cfd2ebfa-ba56-48f9-8b77-93d587d3d656",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.123.208.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:05:13.000Z",
      "valid_until": "2026-04-10T08:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T07:45:50.274Z",
      "x_nadsec_last_seen": "2026-03-09T07:47:56.721Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BZ"
      ],
      "x_nadsec_asns": [
        "28094"
      ],
      "x_nadsec_orgs": [
        "Southern Cable Network"
      ]
    },
    {
      "created": "2026-03-09T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--23774ec6-59f4-4c1f-a22d-a1c0f58f0fc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.56.36.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:05:13.000Z",
      "valid_until": "2026-04-10T08:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T07:55:35.131Z",
      "x_nadsec_last_seen": "2026-03-09T07:55:40.963Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-09T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=36; services=smbd; ports=445; cc=US; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.83.240.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:05:13.000Z",
      "valid_until": "2026-04-10T08:05:12.000Z",
      "x_nadsec_event_count": 36,
      "x_nadsec_first_seen": "2026-03-09T07:42:07.190Z",
      "x_nadsec_last_seen": "2026-03-09T07:48:05.167Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "445",
        "1433",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-03-09T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=30936; asn_org=RENET COM Ltd.",
      "id": "indicator--1ce10881-54ed-4753-99ec-f281886c41a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.116.45.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:05:13.000Z",
      "valid_until": "2026-04-10T08:05:12.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-09T07:18:34.197Z",
      "x_nadsec_last_seen": "2026-03-13T05:50:53.268Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "30936"
      ],
      "x_nadsec_orgs": [
        "RENET COM Ltd."
      ]
    },
    {
      "created": "2026-03-09T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--137a961f-6999-4529-a951-236537f1e016",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:05:13.000Z",
      "valid_until": "2026-04-10T08:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T07:41:08.305Z",
      "x_nadsec_last_seen": "2026-03-09T07:41:08.639Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-09T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=JO; asn=8376; asn_org=Jordan Data Communications Company LLC",
      "id": "indicator--30006ed8-fd23-4e85-9ecc-a4bc7804cf3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.249.71.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:05:13.000Z",
      "valid_until": "2026-04-10T08:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T07:48:39.401Z",
      "x_nadsec_last_seen": "2026-03-09T07:48:44.727Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "8376"
      ],
      "x_nadsec_orgs": [
        "Jordan Data Communications Company LLC"
      ]
    },
    {
      "created": "2026-03-09T08:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--fe6cc1dc-b646-4128-b2a7-86f6ee0b4044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T08:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.156.109.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:05:13.000Z",
      "valid_until": "2026-04-10T08:05:12.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-03-09T07:29:16.921Z",
      "x_nadsec_last_seen": "2026-03-24T18:06:19.311Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-09T09:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=134884; asn_org=ARICHWAL IT SERVICES PRIVATE LIMITED",
      "id": "indicator--d5724d5b-d6de-44d8-ae6d-912d9389e1a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T09:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.84.166.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T09:05:14.000Z",
      "valid_until": "2026-04-10T09:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T08:44:58.937Z",
      "x_nadsec_last_seen": "2026-03-09T08:52:28.981Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134884"
      ],
      "x_nadsec_orgs": [
        "ARICHWAL IT SERVICES PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-09T09:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b9ccb2d4-7474-4d06-b1e0-3a632714dc4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T09:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.161.254.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T09:05:14.000Z",
      "valid_until": "2026-04-10T09:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-09T08:32:30.798Z",
      "x_nadsec_last_seen": "2026-03-18T03:11:29.427Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-09T09:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=mysqld; ports=3306; cc=CN; asn=151185; asn_org=China Telecom; user(top)=r**t",
      "id": "indicator--19883920-1d16-4649-88c4-55e8b40486b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T09:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.80.15.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T09:05:14.000Z",
      "valid_until": "2026-04-10T09:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T08:13:50.247Z",
      "x_nadsec_last_seen": "2026-03-09T08:13:56.790Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "151185"
      ],
      "x_nadsec_orgs": [
        "China Telecom"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-09T09:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=52864; asn_org=Fillnet Com. e Ser. LTDA",
      "id": "indicator--079df935-db26-42de-99c8-274b17ff227b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T09:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.124.161.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T09:05:14.000Z",
      "valid_until": "2026-04-10T09:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T08:19:13.122Z",
      "x_nadsec_last_seen": "2026-03-09T08:21:19.456Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52864"
      ],
      "x_nadsec_orgs": [
        "Fillnet Com. e Ser. LTDA"
      ]
    },
    {
      "created": "2026-03-09T09:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=17665; asn_org=ONEOTT INTERTAINMENT LIMITED",
      "id": "indicator--9eba8943-8c2f-420e-89c1-f6c4443b8ffa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T09:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.194.97.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T09:05:14.000Z",
      "valid_until": "2026-04-10T09:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T08:15:26.446Z",
      "x_nadsec_last_seen": "2026-03-09T08:21:51.079Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17665"
      ],
      "x_nadsec_orgs": [
        "ONEOTT INTERTAINMENT LIMITED"
      ]
    },
    {
      "created": "2026-03-09T09:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9b5590dd-c973-4a2d-821c-057fb452a5aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T09:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.142.57.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T09:05:14.000Z",
      "valid_until": "2026-04-10T09:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T08:54:52.429Z",
      "x_nadsec_last_seen": "2026-03-09T08:54:52.688Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-09T09:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a8a5a697-3970-431b-b05a-afaea6bd0128",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T09:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '57.151.98.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T09:05:14.000Z",
      "valid_until": "2026-04-10T09:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T08:29:30.181Z",
      "x_nadsec_last_seen": "2026-03-09T08:29:40.392Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-09T09:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=16637; asn_org=MTN Business Solutions",
      "id": "indicator--efa9399f-ecf8-484f-abfa-060f4d505faa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T09:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.8.6.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T09:05:14.000Z",
      "valid_until": "2026-04-10T09:05:12.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-09T08:51:56.333Z",
      "x_nadsec_last_seen": "2026-03-18T02:49:56.337Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "16637"
      ],
      "x_nadsec_orgs": [
        "MTN Business Solutions"
      ]
    },
    {
      "created": "2026-03-09T09:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=GB; asn=13285; asn_org=TalkTalk",
      "id": "indicator--9e52a1a0-7a27-4a2f-930c-29eb52287ab0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T09:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.47.12.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T09:05:14.000Z",
      "valid_until": "2026-04-10T09:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T08:31:35.593Z",
      "x_nadsec_last_seen": "2026-03-09T08:31:35.949Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "13285"
      ],
      "x_nadsec_orgs": [
        "TalkTalk"
      ]
    },
    {
      "created": "2026-03-09T09:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=KG; asn=12997; asn_org=OJSC Kyrgyztelecom; user(top)=l***l; pass(top)=t*****g",
      "id": "indicator--94f0ab99-5f02-4606-8926-98615918304f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T09:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.72.180.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T09:05:14.000Z",
      "valid_until": "2026-04-10T09:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T08:33:01.437Z",
      "x_nadsec_last_seen": "2026-03-09T08:33:01.437Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "12997"
      ],
      "x_nadsec_orgs": [
        "OJSC Kyrgyztelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "l***l"
      ],
      "x_nadsec_passwords_attempted": [
        "t*****g"
      ]
    },
    {
      "created": "2026-03-09T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--05da9e2e-d27b-4b54-834f-8384a301e30b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.223.129.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:05:13.000Z",
      "valid_until": "2026-04-10T10:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T09:17:52.211Z",
      "x_nadsec_last_seen": "2026-03-09T09:24:49.009Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-09T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45582; asn_org=VAINAVI INDUSTIES LTD, INTERNET SERVICE PROVIDER, INDIA",
      "id": "indicator--23b56b94-0c8f-4cc9-afa5-09b853400b26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.235.53.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:05:13.000Z",
      "valid_until": "2026-04-10T10:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T09:44:41.162Z",
      "x_nadsec_last_seen": "2026-03-09T09:44:46.117Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45582"
      ],
      "x_nadsec_orgs": [
        "VAINAVI INDUSTIES LTD, INTERNET SERVICE PROVIDER, INDIA"
      ]
    },
    {
      "created": "2026-03-09T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--f29352d4-2956-4813-a708-103112e303c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.225.49.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:05:13.000Z",
      "valid_until": "2026-04-10T10:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T10:01:57.293Z",
      "x_nadsec_last_seen": "2026-03-09T11:24:17.692Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-09T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4c4d78d6-08fb-48b4-bf45-f7ba5db2d832",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.191.103.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:05:13.000Z",
      "valid_until": "2026-04-10T10:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T09:17:18.737Z",
      "x_nadsec_last_seen": "2026-03-09T09:19:25.802Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-09T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--080714b3-3de5-410f-b285-c5a830c2f834",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.136.75.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:05:13.000Z",
      "valid_until": "2026-04-10T10:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T09:24:18.038Z",
      "x_nadsec_last_seen": "2026-03-09T09:26:25.322Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-03-09T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--def3b2ec-404a-46ff-8aac-7f1eaa481c4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.78.84.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:05:13.000Z",
      "valid_until": "2026-04-10T10:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T10:01:50.475Z",
      "x_nadsec_last_seen": "2026-03-09T10:08:21.960Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-09T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--0cf49ea8-9e89-4b92-90c6-a2de6bac2695",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:05:13.000Z",
      "valid_until": "2026-04-10T10:05:12.000Z",
      "x_nadsec_event_count": 100,
      "x_nadsec_first_seen": "2026-03-09T09:45:33.544Z",
      "x_nadsec_last_seen": "2026-03-23T19:15:25.159Z",
      "x_nadsec_ports": [
        "445",
        "135",
        "1883",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "mqttd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-03-09T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--c453c8ac-e1ac-4fb2-97cd-d9025e4341a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.189.185.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:05:13.000Z",
      "valid_until": "2026-04-10T10:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T09:17:32.632Z",
      "x_nadsec_last_seen": "2026-03-09T09:19:38.533Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-09T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.",
      "id": "indicator--a324169d-98cd-49e7-8446-80067d3e2722",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.188.110.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:05:13.000Z",
      "valid_until": "2026-04-10T10:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T09:36:29.768Z",
      "x_nadsec_last_seen": "2026-03-09T09:43:16.942Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11172"
      ],
      "x_nadsec_orgs": [
        "Alestra, S. de R.L. de C.V."
      ]
    },
    {
      "created": "2026-03-09T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=38482; asn_org=Biznet ISP",
      "id": "indicator--00055c8a-af74-4d5b-a002-c32f0b0ecf8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.142.83.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:05:13.000Z",
      "valid_until": "2026-04-10T10:05:12.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-09T09:36:31.438Z",
      "x_nadsec_last_seen": "2026-03-27T11:52:05.505Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "38482"
      ],
      "x_nadsec_orgs": [
        "Biznet ISP"
      ]
    },
    {
      "created": "2026-03-09T10:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--cc628057-cf6c-441d-b184-a05a0e800779",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T10:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.65.211.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:05:13.000Z",
      "valid_until": "2026-04-10T10:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-09T09:09:50.227Z",
      "x_nadsec_last_seen": "2026-03-16T06:22:09.903Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-09T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=138842; asn_org=PT Internetwork Komunikasi Indonesia",
      "id": "indicator--bfe917a0-5871-4682-8c57-4262d48e74ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.138.68.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:05:07.000Z",
      "valid_until": "2026-04-10T11:05:05.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-03-09T10:34:24.574Z",
      "x_nadsec_last_seen": "2026-03-26T15:44:45.375Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "138842"
      ],
      "x_nadsec_orgs": [
        "PT Internetwork Komunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-09T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132559; asn_org=Gatik Business Solutions",
      "id": "indicator--2cd6b6ad-116b-4cf3-aebf-7479f542db6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.16.69.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:05:07.000Z",
      "valid_until": "2026-04-10T11:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T10:19:46.592Z",
      "x_nadsec_last_seen": "2026-03-09T10:21:51.205Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132559"
      ],
      "x_nadsec_orgs": [
        "Gatik Business Solutions"
      ]
    },
    {
      "created": "2026-03-09T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--336bb054-c345-4edc-8904-b8310ccd3127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.135.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:05:07.000Z",
      "valid_until": "2026-04-10T11:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T10:18:41.715Z",
      "x_nadsec_last_seen": "2026-03-09T10:18:41.715Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-09T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--cc957eef-0be9-4515-a232-b277e01846a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.232.147.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:05:07.000Z",
      "valid_until": "2026-04-10T11:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T10:24:29.162Z",
      "x_nadsec_last_seen": "2026-03-12T11:56:31.373Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-09T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--a8ed9102-746e-4216-85fb-cdbe84e2ccb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.238.0.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:05:07.000Z",
      "valid_until": "2026-04-10T11:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T10:24:29.519Z",
      "x_nadsec_last_seen": "2026-03-12T11:56:29.491Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-09T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--ec9c81da-c20a-4d4a-a325-73a3230b7e6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.38.21.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:05:07.000Z",
      "valid_until": "2026-04-10T11:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T10:26:34.385Z",
      "x_nadsec_last_seen": "2026-03-12T11:54:24.584Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-09T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=24211; asn_org=PT. Detik Ini JUga",
      "id": "indicator--c79e292f-71c6-4c72-ba75-4102685db064",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.49.223.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:05:11.000Z",
      "valid_until": "2026-04-10T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T11:33:07.514Z",
      "x_nadsec_last_seen": "2026-03-09T11:35:11.759Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "24211"
      ],
      "x_nadsec_orgs": [
        "PT. Detik Ini JUga"
      ]
    },
    {
      "created": "2026-03-09T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=16345; asn_org=PVimpelCom",
      "id": "indicator--908f3cce-7ed8-4d12-af3d-b65e1dd65d96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.70.209.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:05:11.000Z",
      "valid_until": "2026-04-10T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T11:22:53.879Z",
      "x_nadsec_last_seen": "2026-03-09T11:26:20.779Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "16345"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-03-09T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PY; asn=264631; asn_org=RED PARAGUAYA DE TELECOMUNICACIONES SA; user(top)=**",
      "id": "indicator--b914b07f-7fd4-47a4-8491-9ffc85fcc8d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.202.210.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:05:11.000Z",
      "valid_until": "2026-04-10T12:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T12:03:47.149Z",
      "x_nadsec_last_seen": "2026-03-09T12:03:47.149Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "264631"
      ],
      "x_nadsec_orgs": [
        "RED PARAGUAYA DE TELECOMUNICACIONES SA"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-09T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--c5b2de4e-b12f-46a8-a34d-f5a5cc07cc4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.236.61.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:05:11.000Z",
      "valid_until": "2026-04-10T12:05:09.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-09T11:05:32.812Z",
      "x_nadsec_last_seen": "2026-03-28T00:40:54.760Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-09T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--dcce629b-9b5d-4a0c-86d0-934c9a8ac1b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.26.146.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:05:11.000Z",
      "valid_until": "2026-04-10T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T11:40:16.845Z",
      "x_nadsec_last_seen": "2026-03-09T11:42:23.311Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-03-09T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=US; asn=11976; asn_org=Fidelity Communication International Inc.; user(top)=**",
      "id": "indicator--81c801ee-1975-4d17-bfc8-f0009aee9e0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '24.40.241.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:05:11.000Z",
      "valid_until": "2026-04-10T12:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T11:32:34.631Z",
      "x_nadsec_last_seen": "2026-03-09T11:32:35.913Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11976"
      ],
      "x_nadsec_orgs": [
        "Fidelity Communication International Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-09T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--330f320b-4f3c-48ba-9e6e-b15f4095b47a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:05:11.000Z",
      "valid_until": "2026-04-10T12:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T12:04:39.682Z",
      "x_nadsec_last_seen": "2026-03-21T03:11:44.901Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-09T12:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=RU; asn=211860; asn_org=Nerushenko Vyacheslav Nikolaevich",
      "id": "indicator--adc0b2d7-8dc3-424f-b0a0-d22aebc3ee1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T12:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.147.85.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:05:11.000Z",
      "valid_until": "2026-04-10T12:05:09.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-09T11:18:45.555Z",
      "x_nadsec_last_seen": "2026-03-19T05:03:08.675Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "211860"
      ],
      "x_nadsec_orgs": [
        "Nerushenko Vyacheslav Nikolaevich"
      ]
    },
    {
      "created": "2026-03-09T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2717; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--606708e8-9d0b-49d8-a379-c9899a88dc4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.187.10.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:05:03.000Z",
      "valid_until": "2026-04-10T13:05:01.000Z",
      "x_nadsec_event_count": 3147,
      "x_nadsec_first_seen": "2026-03-09T12:09:38.900Z",
      "x_nadsec_last_seen": "2026-03-09T13:14:32.067Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-03-09T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=132445; asn_org=Khetan Cable Network Pvt. Limited",
      "id": "indicator--f364dbbc-4fa9-4153-86fe-cb7c49032ac0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.21.55.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:05:03.000Z",
      "valid_until": "2026-04-10T13:05:01.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-03-09T12:59:59.321Z",
      "x_nadsec_last_seen": "2026-03-30T13:47:32.947Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132445"
      ],
      "x_nadsec_orgs": [
        "Khetan Cable Network Pvt. Limited"
      ]
    },
    {
      "created": "2026-03-09T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--b3b9b88c-52aa-4609-ad1f-1e5b1f43cef6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.7.236.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:05:03.000Z",
      "valid_until": "2026-04-10T13:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-09T12:09:03.827Z",
      "x_nadsec_last_seen": "2026-03-22T03:10:15.479Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-09T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--7ba511f7-362f-4c2b-93e4-95971c64bedc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.215.199.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:05:03.000Z",
      "valid_until": "2026-04-10T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T12:43:44.145Z",
      "x_nadsec_last_seen": "2026-03-09T12:45:56.357Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-09T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=22411; asn_org=GTD PERU S.A",
      "id": "indicator--ed837419-6522-46c3-97bb-a257e6c267bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.132.159.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:05:03.000Z",
      "valid_until": "2026-04-10T13:05:01.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-09T12:35:46.624Z",
      "x_nadsec_last_seen": "2026-03-24T19:38:49.518Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "22411"
      ],
      "x_nadsec_orgs": [
        "GTD PERU S.A"
      ]
    },
    {
      "created": "2026-03-09T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--2af95ea8-f3dc-4e9a-994e-b609277f9927",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.115.171.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:05:03.000Z",
      "valid_until": "2026-04-10T13:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T12:35:47.774Z",
      "x_nadsec_last_seen": "2026-03-09T12:36:43.483Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-09T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RS; asn=60871; asn_org=COMNET Sh.p.k",
      "id": "indicator--5b571c25-04f7-4f85-b048-603c1e22446c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.24.32.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:05:03.000Z",
      "valid_until": "2026-04-10T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T13:03:40.829Z",
      "x_nadsec_last_seen": "2026-03-09T13:05:48.462Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "60871"
      ],
      "x_nadsec_orgs": [
        "COMNET Sh.p.k"
      ]
    },
    {
      "created": "2026-03-09T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=20485; asn_org=Joint Stock Company TransTeleCom",
      "id": "indicator--43ff2ade-52aa-4879-a9b2-350ec0b44a0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.43.245.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:05:03.000Z",
      "valid_until": "2026-04-10T13:05:01.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-03-09T12:15:58.709Z",
      "x_nadsec_last_seen": "2026-03-23T16:08:16.410Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "20485"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company TransTeleCom"
      ]
    },
    {
      "created": "2026-03-09T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--d4760efa-c1ff-4fae-beac-794bd982a261",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.248.174.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:05:03.000Z",
      "valid_until": "2026-04-10T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T12:18:56.431Z",
      "x_nadsec_last_seen": "2026-03-09T12:21:04.332Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-03-09T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=149877; asn_org=PT Integrasi Jaringan Ekosistem",
      "id": "indicator--10bb9844-b64f-4eed-bcd3-7203965ba9b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.125.82.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:05:03.000Z",
      "valid_until": "2026-04-10T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T12:15:49.244Z",
      "x_nadsec_last_seen": "2026-03-09T12:17:53.672Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "149877"
      ],
      "x_nadsec_orgs": [
        "PT Integrasi Jaringan Ekosistem"
      ]
    },
    {
      "created": "2026-03-09T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--a5c936ef-a875-401c-8889-93cfccf2a064",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:05:03.000Z",
      "valid_until": "2026-04-10T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T12:25:20.354Z",
      "x_nadsec_last_seen": "2026-03-09T12:25:20.354Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-09T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=RU; asn=214664; asn_org=JSC Buduschee",
      "id": "indicator--1351e28d-90c1-4d3b-9013-98c90792cd0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.91.64.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T13:05:03.000Z",
      "valid_until": "2026-04-10T13:05:01.000Z",
      "x_nadsec_event_count": 25,
      "x_nadsec_first_seen": "2026-03-07T17:39:27.681Z",
      "x_nadsec_last_seen": "2026-03-20T23:29:29.989Z",
      "x_nadsec_ports": [
        "27017",
        "21"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "214664"
      ],
      "x_nadsec_orgs": [
        "JSC Buduschee"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s"
      ]
    },
    {
      "created": "2026-03-09T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--2d42eb9f-d2da-4a61-8363-7b4ea1d1d93f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.139.68.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:05:13.000Z",
      "valid_until": "2026-04-10T14:05:12.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-09T13:44:14.412Z",
      "x_nadsec_last_seen": "2026-03-09T16:13:36.973Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-09T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--4bcdec07-8071-43f7-8073-a1e9b9f300f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.199.114.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:05:13.000Z",
      "valid_until": "2026-04-10T14:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T13:46:07.554Z",
      "x_nadsec_last_seen": "2026-03-09T13:48:14.074Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-09T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=270638; asn_org=Sellnet Telecom",
      "id": "indicator--c85bf9ac-6e42-4f68-9352-16c73bc764dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.192.117.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:05:13.000Z",
      "valid_until": "2026-04-10T14:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T14:04:52.898Z",
      "x_nadsec_last_seen": "2026-03-09T14:06:59.884Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "270638"
      ],
      "x_nadsec_orgs": [
        "Sellnet Telecom"
      ]
    },
    {
      "created": "2026-03-09T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--4342f417-5b97-434c-9414-1cc23c1f5724",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:05:13.000Z",
      "valid_until": "2026-04-10T14:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T13:58:13.711Z",
      "x_nadsec_last_seen": "2026-03-30T11:59:22.676Z",
      "x_nadsec_ports": [
        "21",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-09T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--49cf923f-6047-4c01-a355-0e75764e7a7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.157.38.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:05:13.000Z",
      "valid_until": "2026-04-10T14:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T13:47:49.429Z",
      "x_nadsec_last_seen": "2026-03-09T13:49:55.589Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-09T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--abe9af9e-b1b2-4581-bd7e-1259db241349",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.189.219.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:05:13.000Z",
      "valid_until": "2026-04-10T14:05:12.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-03-09T13:32:18.000Z",
      "x_nadsec_last_seen": "2026-03-09T13:33:12.396Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-09T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ffb3bac5-32ca-434b-84fa-46600d3e3106",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.189.228.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:05:13.000Z",
      "valid_until": "2026-04-10T14:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T13:30:35.228Z",
      "x_nadsec_last_seen": "2026-03-09T13:30:35.228Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-09T14:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--fbe3db7f-7751-43ff-8353-96735979d23c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T14:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:05:13.000Z",
      "valid_until": "2026-04-10T14:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-09T13:59:00.071Z",
      "x_nadsec_last_seen": "2026-03-31T14:08:51.879Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-09T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--be7ff182-da8c-49fb-92ed-d15926c31e3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.88.112.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T15:05:02.000Z",
      "valid_until": "2026-04-10T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T14:20:49.207Z",
      "x_nadsec_last_seen": "2026-03-09T14:20:53.853Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-09T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--c537c958-5684-41b2-9370-04ebc917514b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.96.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T15:05:02.000Z",
      "valid_until": "2026-04-10T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T14:16:37.026Z",
      "x_nadsec_last_seen": "2026-03-09T14:16:37.427Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-09T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--82f24e57-e0e8-4e37-a993-93f275004040",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.71.140.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T15:05:02.000Z",
      "valid_until": "2026-04-10T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T14:55:10.612Z",
      "x_nadsec_last_seen": "2026-03-09T14:55:10.612Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-09T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--96510211-fc1a-490e-8420-3b699dc55af3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.115.237.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T15:05:02.000Z",
      "valid_until": "2026-04-10T15:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-09T14:45:45.957Z",
      "x_nadsec_last_seen": "2026-03-20T08:48:16.922Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-09T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--09c5b029-e06f-4aac-90d6-6047deba4ddf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T15:05:02.000Z",
      "valid_until": "2026-04-10T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T14:23:05.309Z",
      "x_nadsec_last_seen": "2026-03-09T14:23:05.309Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-09T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--afad4e05-1800-4442-847e-c56d600b5998",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.111.213.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T15:05:02.000Z",
      "valid_until": "2026-04-10T15:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-09T14:38:16.743Z",
      "x_nadsec_last_seen": "2026-03-30T00:58:49.408Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-09T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=3326; asn_org=Private Joint Stock Company datagroup",
      "id": "indicator--3c287608-8d00-4455-998e-49b6ff5f6cc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.164.169.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T15:05:02.000Z",
      "valid_until": "2026-04-10T15:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-09T14:49:51.842Z",
      "x_nadsec_last_seen": "2026-03-16T12:56:25.808Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "3326"
      ],
      "x_nadsec_orgs": [
        "Private Joint Stock Company datagroup"
      ]
    },
    {
      "created": "2026-03-09T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--8bae08a2-790b-4d37-a2f4-f833e3ef3fb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T15:05:02.000Z",
      "valid_until": "2026-04-10T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T14:15:05.394Z",
      "x_nadsec_last_seen": "2026-03-14T12:07:52.515Z",
      "x_nadsec_ports": [
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-09T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--163b7800-2aaa-4ac4-aaf3-e4292d8aeff2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T15:05:02.000Z",
      "valid_until": "2026-04-10T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T14:37:35.158Z",
      "x_nadsec_last_seen": "2026-03-09T14:37:35.158Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-09T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--735fe69f-ea17-4e5d-b866-1f6ffac93e64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.80.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:05:13.000Z",
      "valid_until": "2026-04-10T16:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T15:08:17.435Z",
      "x_nadsec_last_seen": "2026-03-09T15:15:50.264Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-09T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--0e5959f1-b939-4b48-8f5b-37496e9d0ba9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.68.84.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:05:13.000Z",
      "valid_until": "2026-04-10T16:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T15:37:01.134Z",
      "x_nadsec_last_seen": "2026-03-09T15:43:38.738Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-09T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fc0f1455-1436-4447-8632-d3dca1fd6776",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:05:13.000Z",
      "valid_until": "2026-04-10T16:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T15:19:37.821Z",
      "x_nadsec_last_seen": "2026-03-20T07:58:21.600Z",
      "x_nadsec_ports": [
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-09T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37492; asn_org=ORANGE",
      "id": "indicator--7f7b8cd5-ee10-4b3d-ab85-b425bcf1758c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.228.175.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:05:13.000Z",
      "valid_until": "2026-04-10T16:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-09T15:24:53.213Z",
      "x_nadsec_last_seen": "2026-03-09T16:29:07.806Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37492"
      ],
      "x_nadsec_orgs": [
        "ORANGE"
      ]
    },
    {
      "created": "2026-03-09T16:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--8d9ab4cf-4498-4d67-82f7-c709990ce756",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T16:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.153.231.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:05:13.000Z",
      "valid_until": "2026-04-10T16:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T15:42:06.677Z",
      "x_nadsec_last_seen": "2026-03-09T15:42:06.677Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-09T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=138317; asn_org=Gaurav Communication Pvt. Ltd.",
      "id": "indicator--69ae34fd-e72f-4453-a9c5-4d008e1bc4d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.132.197.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:05:13.000Z",
      "valid_until": "2026-04-10T18:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T17:34:45.023Z",
      "x_nadsec_last_seen": "2026-03-09T17:37:42.063Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138317"
      ],
      "x_nadsec_orgs": [
        "Gaurav Communication Pvt. Ltd."
      ]
    },
    {
      "created": "2026-03-09T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e6fc313a-f1e6-4ee0-a4be-962af2ef9050",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.162.43.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:05:13.000Z",
      "valid_until": "2026-04-10T18:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T17:26:57.724Z",
      "x_nadsec_last_seen": "2026-03-09T17:27:02.492Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-09T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--9c9a0ade-e06a-465b-8ba2-1fe732aa2b8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:05:13.000Z",
      "valid_until": "2026-04-10T18:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T17:55:26.594Z",
      "x_nadsec_last_seen": "2026-03-09T17:57:23.841Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-03-09T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--b0dba9ff-dc3b-447b-af62-4610b9c23bd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.153.120.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:05:13.000Z",
      "valid_until": "2026-04-10T18:05:12.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-09T17:13:08.598Z",
      "x_nadsec_last_seen": "2026-03-26T05:29:20.347Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-03-09T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=2561; asn_org=EUN",
      "id": "indicator--ad278eee-cf70-45e1-bb80-c97f35f4dd6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.227.21.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:05:13.000Z",
      "valid_until": "2026-04-10T18:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T18:04:32.584Z",
      "x_nadsec_last_seen": "2026-03-09T18:05:27.823Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "2561"
      ],
      "x_nadsec_orgs": [
        "EUN"
      ]
    },
    {
      "created": "2026-03-09T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--fbbbeca7-0e8b-4d1f-8f13-cd4cb2b14822",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.120.235.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:05:13.000Z",
      "valid_until": "2026-04-10T18:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T17:20:10.377Z",
      "x_nadsec_last_seen": "2026-03-09T17:27:25.786Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4538"
      ],
      "x_nadsec_orgs": [
        "China Education and Research Network Center"
      ]
    },
    {
      "created": "2026-03-09T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--abf0b2de-4276-4acb-8fcd-76b0d3db58de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:05:13.000Z",
      "valid_until": "2026-04-10T18:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T17:16:07.309Z",
      "x_nadsec_last_seen": "2026-03-09T17:16:07.309Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-09T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MY; asn=9930; asn_org=TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "id": "indicator--99c82b5f-889e-4682-8015-3ad158aabb9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.24.73.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:05:13.000Z",
      "valid_until": "2026-04-10T18:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T17:09:29.958Z",
      "x_nadsec_last_seen": "2026-03-09T17:09:55.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9930"
      ],
      "x_nadsec_orgs": [
        "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al"
      ]
    },
    {
      "created": "2026-03-09T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=25513; asn_org=PJSC Moscow city telephone network",
      "id": "indicator--6e2ecb29-d08a-46a3-8dfc-5221ba4af758",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.190.61.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:05:13.000Z",
      "valid_until": "2026-04-10T18:05:12.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-09T17:31:46.880Z",
      "x_nadsec_last_seen": "2026-03-13T05:09:37.756Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25513"
      ],
      "x_nadsec_orgs": [
        "PJSC Moscow city telephone network"
      ]
    },
    {
      "created": "2026-03-09T18:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8402; asn_org=PVimpelCom",
      "id": "indicator--98121836-56b0-4c86-a890-7d533854437c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T18:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.24.211.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:05:13.000Z",
      "valid_until": "2026-04-10T18:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T17:41:06.841Z",
      "x_nadsec_last_seen": "2026-03-09T17:46:57.544Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8402"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-03-09T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--45dcc314-4f5a-4d2d-8777-17d5510ef94f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.213.111.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:05:13.000Z",
      "valid_until": "2026-04-10T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T18:12:11.718Z",
      "x_nadsec_last_seen": "2026-03-09T18:14:18.787Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-09T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--b26596fc-dbe4-4c32-8d0a-9577a010cc49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.92.247.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:05:13.000Z",
      "valid_until": "2026-04-10T19:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-09T18:15:24.287Z",
      "x_nadsec_last_seen": "2026-03-23T14:31:51.997Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-09T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mongod; ports=27017; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--9a83f710-0bc4-4797-85d1-1b66ed2316db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.133.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:05:13.000Z",
      "valid_until": "2026-04-10T19:05:12.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-09T18:57:32.822Z",
      "x_nadsec_last_seen": "2026-03-09T18:57:50.668Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-09T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4211ca5d-d958-4a7d-966c-f6c098a3de38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.162.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:05:13.000Z",
      "valid_until": "2026-04-10T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T18:25:23.533Z",
      "x_nadsec_last_seen": "2026-03-09T18:25:52.695Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-09T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=VN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--983fbc8a-3477-4e05-9c36-d0fd15ecc048",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.221.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:05:13.000Z",
      "valid_until": "2026-04-10T19:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T18:40:20.031Z",
      "x_nadsec_last_seen": "2026-03-09T18:40:40.965Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-09T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--44afcb42-d37f-43c4-9322-f3d3044743ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:05:13.000Z",
      "valid_until": "2026-04-10T19:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T18:38:52.786Z",
      "x_nadsec_last_seen": "2026-03-09T18:38:52.786Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-09T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27983; asn_org=Red Intercable Digital S.A.",
      "id": "indicator--daa99f6c-3211-4f7d-adfd-a69c993a8368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.62.246.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:05:13.000Z",
      "valid_until": "2026-04-10T19:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-09T18:16:28.410Z",
      "x_nadsec_last_seen": "2026-03-25T17:58:03.113Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27983"
      ],
      "x_nadsec_orgs": [
        "Red Intercable Digital S.A."
      ]
    },
    {
      "created": "2026-03-09T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--cc094863-4a41-4935-bdfc-02032c4f4b96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.90.192.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:05:13.000Z",
      "valid_until": "2026-04-10T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T18:06:17.923Z",
      "x_nadsec_last_seen": "2026-03-09T18:08:24.986Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-03-09T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--989d08a2-a547-4a57-a4c2-0f393840af00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.76.111.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:05:13.000Z",
      "valid_until": "2026-04-10T19:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-09T18:33:04.693Z",
      "x_nadsec_last_seen": "2026-03-30T12:55:36.680Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-03-09T19:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=269814; asn_org=PROLUX COMSER S.A.",
      "id": "indicator--8bff66d1-98b2-45d5-9523-2e503d4b06e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T19:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.186.24.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:05:13.000Z",
      "valid_until": "2026-04-10T19:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T19:00:15.203Z",
      "x_nadsec_last_seen": "2026-03-09T19:02:22.470Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "269814"
      ],
      "x_nadsec_orgs": [
        "PROLUX COMSER S.A."
      ]
    },
    {
      "created": "2026-03-09T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=64030; asn_org=Politeknik Negeri Semarang",
      "id": "indicator--9d0572fe-0ea7-41dc-8207-f3f6048bca1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.214.229.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:05:13.000Z",
      "valid_until": "2026-04-10T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T19:50:48.350Z",
      "x_nadsec_last_seen": "2026-03-09T23:06:01.179Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "64030"
      ],
      "x_nadsec_orgs": [
        "Politeknik Negeri Semarang"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-09T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133982; asn_org=Excitel Broadband Private Limited",
      "id": "indicator--c5d4e221-c8df-48da-85e7-318e4faec334",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.235.219.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:05:13.000Z",
      "valid_until": "2026-04-10T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T19:10:44.986Z",
      "x_nadsec_last_seen": "2026-03-09T19:12:50.886Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133982"
      ],
      "x_nadsec_orgs": [
        "Excitel Broadband Private Limited"
      ]
    },
    {
      "created": "2026-03-09T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--082f5f14-2214-42e9-b893-f60650b69d51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.185.109.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:05:13.000Z",
      "valid_until": "2026-04-10T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T19:48:39.629Z",
      "x_nadsec_last_seen": "2026-03-09T19:50:46.220Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-09T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4e46b47b-f645-4049-b265-e1b472786020",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.124.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:05:13.000Z",
      "valid_until": "2026-04-10T20:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T19:20:55.215Z",
      "x_nadsec_last_seen": "2026-03-09T19:20:56.033Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-09T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--46a3bc73-7c1f-4a2d-9593-462207dff9c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.245.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:05:13.000Z",
      "valid_until": "2026-04-10T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T19:16:39.918Z",
      "x_nadsec_last_seen": "2026-03-09T19:16:58.757Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-09T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DO; asn=6400; asn_org=Compania Dominicana de Telefonos S. A.",
      "id": "indicator--89ec3059-22e1-4f49-aba6-8f936123cd7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.52.13.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:05:13.000Z",
      "valid_until": "2026-04-10T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T19:22:36.979Z",
      "x_nadsec_last_seen": "2026-03-09T19:24:42.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "6400"
      ],
      "x_nadsec_orgs": [
        "Compania Dominicana de Telefonos S. A."
      ]
    },
    {
      "created": "2026-03-09T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--66148da9-103b-430b-815a-958c22ee0920",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.155.105.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:05:13.000Z",
      "valid_until": "2026-04-10T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T19:29:25.494Z",
      "x_nadsec_last_seen": "2026-03-09T19:31:31.629Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-09T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--99b1e952-2624-49ee-8eba-7faf7548bd81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.82.81.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:05:13.000Z",
      "valid_until": "2026-04-10T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T19:42:15.617Z",
      "x_nadsec_last_seen": "2026-03-09T19:44:23.202Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-09T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--83c74af0-06b5-44f7-a457-9e8bad8ec33d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.106.195.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:05:13.000Z",
      "valid_until": "2026-04-10T20:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T19:55:25.550Z",
      "x_nadsec_last_seen": "2026-03-09T19:55:25.550Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-09T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PT; asn=15525; asn_org=Servicos De Comunicacoes E Multimedia S.A.",
      "id": "indicator--311dd54b-83b3-4032-a408-e8abe9ed8bc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.55.176.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:05:13.000Z",
      "valid_until": "2026-04-10T20:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T19:55:10.721Z",
      "x_nadsec_last_seen": "2026-03-09T20:02:00.860Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "15525"
      ],
      "x_nadsec_orgs": [
        "Servicos De Comunicacoes E Multimedia S.A."
      ]
    },
    {
      "created": "2026-03-09T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--ef8e3ddc-0f12-4f06-b53c-3c11890c56c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.106.128.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:05:13.000Z",
      "valid_until": "2026-04-10T20:05:12.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-09T19:23:26.519Z",
      "x_nadsec_last_seen": "2026-03-15T17:54:39.730Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-09T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=267798; asn_org=GENERACION WI-FI SA",
      "id": "indicator--9aa1811a-3223-4414-a09f-bb1e16ce92a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.181.47.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:05:13.000Z",
      "valid_until": "2026-04-10T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T19:29:50.167Z",
      "x_nadsec_last_seen": "2026-03-09T19:31:58.148Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "267798"
      ],
      "x_nadsec_orgs": [
        "GENERACION WI-FI SA"
      ]
    },
    {
      "created": "2026-03-09T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HU; asn=5483; asn_org=Magyar Telekom Plc.",
      "id": "indicator--bbf84186-6e7a-4caf-a134-15926f8b10e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.182.243.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:05:13.000Z",
      "valid_until": "2026-04-10T20:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-09T19:17:19.709Z",
      "x_nadsec_last_seen": "2026-03-26T17:17:18.073Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HU"
      ],
      "x_nadsec_asns": [
        "5483"
      ],
      "x_nadsec_orgs": [
        "Magyar Telekom Plc."
      ]
    },
    {
      "created": "2026-03-09T20:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--562eabc6-25da-433d-bc5c-fd19158ea163",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T20:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.80.4.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:05:13.000Z",
      "valid_until": "2026-04-10T20:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T19:10:58.217Z",
      "x_nadsec_last_seen": "2026-03-09T19:10:58.217Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-09T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--ab19ea38-fe00-4695-b188-464d8c549de2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.0.171.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:05:02.000Z",
      "valid_until": "2026-04-10T21:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T20:44:06.751Z",
      "x_nadsec_last_seen": "2026-03-09T20:50:28.318Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-09T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--c2f9443e-8dac-47ba-97d5-d24bc8724ce0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.53.228.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:05:02.000Z",
      "valid_until": "2026-04-10T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T21:02:54.099Z",
      "x_nadsec_last_seen": "2026-03-09T21:02:54.171Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-09T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=9931; asn_org=National Telecom Public Company Limited",
      "id": "indicator--5f309b36-6547-4491-8689-39b85d4bcec9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.155.204.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:05:02.000Z",
      "valid_until": "2026-04-10T21:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-09T20:26:22.094Z",
      "x_nadsec_last_seen": "2026-03-09T21:09:03.955Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "9931"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-09T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--48c96873-b9c4-4aea-93e0-628d2efcdd6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:05:02.000Z",
      "valid_until": "2026-04-10T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T20:35:24.593Z",
      "x_nadsec_last_seen": "2026-03-11T16:47:00.600Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-09T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--e63a5135-ce20-469c-b900-c8a98bf401cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.235.18.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:05:02.000Z",
      "valid_until": "2026-04-10T21:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T20:46:31.644Z",
      "x_nadsec_last_seen": "2026-03-10T01:54:39.608Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-09T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--4d4d26e3-589d-4bd5-becd-21d36d898ec2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.235.40.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:05:02.000Z",
      "valid_until": "2026-04-10T21:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T20:46:31.393Z",
      "x_nadsec_last_seen": "2026-03-10T01:53:53.912Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-09T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--858f6349-b242-41fc-a083-22bcd579e0b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:05:02.000Z",
      "valid_until": "2026-04-10T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T20:13:44.192Z",
      "x_nadsec_last_seen": "2026-03-13T17:15:19.798Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-09T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BO; asn=26210; asn_org=AXS Bolivia S. A.",
      "id": "indicator--8178b7e5-124f-4fa5-92c4-3b24af4e0f0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.105.215.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:05:02.000Z",
      "valid_until": "2026-04-10T21:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-09T20:22:04.822Z",
      "x_nadsec_last_seen": "2026-03-12T14:37:08.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "26210"
      ],
      "x_nadsec_orgs": [
        "AXS Bolivia S. A."
      ]
    },
    {
      "created": "2026-03-09T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.",
      "id": "indicator--9ac952f4-9bf2-4b22-a709-97ca9d0b868c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.188.91.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:05:02.000Z",
      "valid_until": "2026-04-10T21:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-09T20:35:10.505Z",
      "x_nadsec_last_seen": "2026-03-15T17:44:41.404Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11172"
      ],
      "x_nadsec_orgs": [
        "Alestra, S. de R.L. de C.V."
      ]
    },
    {
      "created": "2026-03-09T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--f5b63a64-bcd3-4d87-a366-df387c22db0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.242.27.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:05:02.000Z",
      "valid_until": "2026-04-10T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T20:29:25.922Z",
      "x_nadsec_last_seen": "2026-03-09T20:33:31.514Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-09T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=JO; asn=9038; asn_org=Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co",
      "id": "indicator--bdd126a6-2d7e-4ad2-8f84-b0e86e01b8d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.118.18.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:05:02.000Z",
      "valid_until": "2026-04-10T21:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-09T20:37:49.616Z",
      "x_nadsec_last_seen": "2026-03-29T07:01:38.841Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "9038"
      ],
      "x_nadsec_orgs": [
        "Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co"
      ]
    },
    {
      "created": "2026-03-09T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=265523; asn_org=Sierra Madre Internet SA de CV",
      "id": "indicator--e7192a67-a376-4489-b7ee-62f833596aab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.188.94.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:05:02.000Z",
      "valid_until": "2026-04-10T21:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T20:32:31.375Z",
      "x_nadsec_last_seen": "2026-03-09T20:34:45.430Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "265523"
      ],
      "x_nadsec_orgs": [
        "Sierra Madre Internet SA de CV"
      ]
    },
    {
      "created": "2026-03-09T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--192f198d-1fe0-4ce1-80d2-7330f1f37def",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.228.188.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:05:03.000Z",
      "valid_until": "2026-04-10T22:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T21:23:39.175Z",
      "x_nadsec_last_seen": "2026-03-09T21:30:58.450Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-09T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=PL; asn=9009; asn_org=M247 Europe SRL; user(top)=a*******s; pass(top)=g***********t@gmail.com",
      "id": "indicator--7628f64b-27a0-4261-9183-ded40c0097ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.70.161.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:05:03.000Z",
      "valid_until": "2026-04-10T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T21:38:40.538Z",
      "x_nadsec_last_seen": "2026-03-09T21:38:45.583Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "9009"
      ],
      "x_nadsec_orgs": [
        "M247 Europe SRL"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "g*********************m",
        "y********************m"
      ]
    },
    {
      "created": "2026-03-09T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AR; asn=27747; asn_org=Telecentro S.A.",
      "id": "indicator--5221a78d-faca-49f8-889c-84bf32b8eda4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.45.253.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:05:03.000Z",
      "valid_until": "2026-04-10T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T21:16:41.778Z",
      "x_nadsec_last_seen": "2026-03-09T21:18:46.374Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27747"
      ],
      "x_nadsec_orgs": [
        "Telecentro S.A."
      ]
    },
    {
      "created": "2026-03-09T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--bb69ddce-c65d-4de2-b8d2-c0ae9f41ed56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.181.187.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:05:03.000Z",
      "valid_until": "2026-04-10T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T21:41:52.496Z",
      "x_nadsec_last_seen": "2026-03-09T21:43:58.927Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-09T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--b6b98985-0ebe-4889-ae2a-2de2f8eb7399",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.125.237.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:05:03.000Z",
      "valid_until": "2026-04-10T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T21:16:41.451Z",
      "x_nadsec_last_seen": "2026-03-09T21:18:48.038Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-03-09T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--ee6bc55f-d597-4279-8c02-a11120fbb18d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.130.75.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:05:03.000Z",
      "valid_until": "2026-04-10T22:05:01.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-09T21:27:56.241Z",
      "x_nadsec_last_seen": "2026-03-18T21:20:12.834Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-09T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0f6bf8f8-beb1-4371-beda-1428aed01545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:05:03.000Z",
      "valid_until": "2026-04-10T22:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-09T21:59:08.075Z",
      "x_nadsec_last_seen": "2026-03-30T17:19:58.678Z",
      "x_nadsec_ports": [
        "3306",
        "1723"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-09T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CR; asn=11830; asn_org=Instituto Costarricense de Electricidad y Telecom.",
      "id": "indicator--a14b5ac0-be08-4020-8a38-fa319b39a583",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.191.196.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:05:03.000Z",
      "valid_until": "2026-04-10T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T21:20:49.852Z",
      "x_nadsec_last_seen": "2026-03-09T21:20:49.852Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CR"
      ],
      "x_nadsec_asns": [
        "11830"
      ],
      "x_nadsec_orgs": [
        "Instituto Costarricense de Electricidad y Telecom."
      ]
    },
    {
      "created": "2026-03-09T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e299dc71-8d8c-47c7-988a-4e2831106c4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.216.189.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:05:03.000Z",
      "valid_until": "2026-04-10T22:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-09T21:17:02.418Z",
      "x_nadsec_last_seen": "2026-03-30T07:13:49.376Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-09T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--e2345ba1-3a74-479a-817b-dc147e117d9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.188.46.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:05:03.000Z",
      "valid_until": "2026-04-10T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T21:31:03.036Z",
      "x_nadsec_last_seen": "2026-03-18T17:13:32.151Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-09T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--6cdb775f-fcfc-4da6-b9c9-6e4b4723beae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.134.135.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:05:14.000Z",
      "valid_until": "2026-04-10T23:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T23:01:30.052Z",
      "x_nadsec_last_seen": "2026-03-09T23:03:36.467Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-03-09T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--fa1b04d0-1682-413d-bdfe-5b0502b989fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.178.210.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:05:14.000Z",
      "valid_until": "2026-04-10T23:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T22:09:46.408Z",
      "x_nadsec_last_seen": "2026-03-09T22:11:53.582Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-09T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SO; asn=37371; asn_org=HORMUUD",
      "id": "indicator--5f74999b-7ce4-4d88-87fa-e0d1ff3c1164",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.145.169.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:05:14.000Z",
      "valid_until": "2026-04-10T23:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T22:08:42.983Z",
      "x_nadsec_last_seen": "2026-03-09T22:10:50.142Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SO"
      ],
      "x_nadsec_asns": [
        "37371"
      ],
      "x_nadsec_orgs": [
        "HORMUUD"
      ]
    },
    {
      "created": "2026-03-09T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--faa994ad-831d-40eb-bbfe-df1992b302e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-09T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:05:14.000Z",
      "valid_until": "2026-04-10T23:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T22:48:26.788Z",
      "x_nadsec_last_seen": "2026-03-09T22:48:26.788Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-03-10T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services; user(top)=**",
      "id": "indicator--db7a33f8-383a-48e5-8ecd-d39459e00d74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.160.3.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:05:14.000Z",
      "valid_until": "2026-04-11T00:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T23:28:44.941Z",
      "x_nadsec_last_seen": "2026-03-09T23:28:44.941Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-10T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--268d43fe-54f3-4de6-80ff-8b537c88e01e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.161.225.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:05:14.000Z",
      "valid_until": "2026-04-11T00:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T23:18:36.628Z",
      "x_nadsec_last_seen": "2026-03-09T23:25:24.091Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-10T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=135905; asn_org=VIETNAM POSTS AND TELECOMMUNICATIONS GROUP",
      "id": "indicator--1692ac69-0145-4d65-be3d-37a6cb244d67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.225.219.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:05:14.000Z",
      "valid_until": "2026-04-11T00:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T23:17:47.810Z",
      "x_nadsec_last_seen": "2026-03-09T23:17:47.892Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135905"
      ],
      "x_nadsec_orgs": [
        "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP"
      ]
    },
    {
      "created": "2026-03-10T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6083eda7-aca2-4af8-bc20-d36152e0e5da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.176.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:05:14.000Z",
      "valid_until": "2026-04-11T00:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T23:58:32.973Z",
      "x_nadsec_last_seen": "2026-03-09T23:58:32.973Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--06838dd0-65d0-4b77-aabc-5ec811c9cf27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.177.162.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:05:14.000Z",
      "valid_until": "2026-04-11T00:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T23:10:56.166Z",
      "x_nadsec_last_seen": "2026-03-09T23:13:02.720Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-10T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=6147; asn_org=INTEGRATEL PERU S.A.A.",
      "id": "indicator--da342d4d-b25b-4289-9afe-e5f40afd26e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.43.149.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:05:14.000Z",
      "valid_until": "2026-04-11T00:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T23:39:42.722Z",
      "x_nadsec_last_seen": "2026-03-09T23:41:49.790Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "6147"
      ],
      "x_nadsec_orgs": [
        "INTEGRATEL PERU S.A.A."
      ]
    },
    {
      "created": "2026-03-10T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--fa5423f8-6894-4eba-b4cd-fdf18c39bb47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.219.202.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:05:14.000Z",
      "valid_until": "2026-04-11T00:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-09T23:39:00.740Z",
      "x_nadsec_last_seen": "2026-03-09T23:41:07.493Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-10T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--159ab205-c168-4fec-9aa2-7e6eae7f81e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.59.14.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:05:14.000Z",
      "valid_until": "2026-04-11T00:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T00:03:30.944Z",
      "x_nadsec_last_seen": "2026-03-10T00:05:37.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-03-10T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--02233260-9932-4056-b92c-67fcac37ef9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:05:14.000Z",
      "valid_until": "2026-04-11T00:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T23:14:37.344Z",
      "x_nadsec_last_seen": "2026-03-09T23:14:37.344Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-10T00:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--40b0e6ad-060b-4d0b-8532-a43648859ec8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T00:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T00:05:14.000Z",
      "valid_until": "2026-04-11T00:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-09T23:14:37.618Z",
      "x_nadsec_last_seen": "2026-03-09T23:14:37.618Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-10T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ID; asn=46023; asn_org=PT Quantum Tera Network; user(top)=**",
      "id": "indicator--11a8ee0d-a036-4ab4-a174-d0228d25d4f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.75.54.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:05:13.000Z",
      "valid_until": "2026-04-11T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T00:53:58.378Z",
      "x_nadsec_last_seen": "2026-03-10T00:53:58.378Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "46023"
      ],
      "x_nadsec_orgs": [
        "PT Quantum Tera Network"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-10T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=35815; asn_org=LLC Cifrovie Seti Urala",
      "id": "indicator--debdce57-4015-4471-8218-bff52e80f4ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.198.107.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:05:13.000Z",
      "valid_until": "2026-04-11T01:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T00:25:12.861Z",
      "x_nadsec_last_seen": "2026-03-10T00:27:19.956Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "35815"
      ],
      "x_nadsec_orgs": [
        "LLC Cifrovie Seti Urala"
      ]
    },
    {
      "created": "2026-03-10T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--cb931ad9-dbff-4283-a787-2ddb5a09992a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.1.213.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:05:13.000Z",
      "valid_until": "2026-04-11T01:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-10T00:08:10.940Z",
      "x_nadsec_last_seen": "2026-03-10T00:25:12.918Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-03-10T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=141688; asn_org=Telangana Fiber Grid Corporation Limited",
      "id": "indicator--8e647bc5-6a19-49d7-a560-7bbcac060f89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.91.190.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:05:13.000Z",
      "valid_until": "2026-04-11T01:05:12.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-10T00:14:02.404Z",
      "x_nadsec_last_seen": "2026-03-24T20:04:00.519Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141688"
      ],
      "x_nadsec_orgs": [
        "Telangana Fiber Grid Corporation Limited"
      ]
    },
    {
      "created": "2026-03-10T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=15; services=mssqld; ports=1433; cc=US; asn=202412; asn_org=Omegatech LTD; user(top)=d*******h; pass(top)=d*******h",
      "id": "indicator--7ad2f004-3842-4fdc-8cc7-48cd88c032b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:05:13.000Z",
      "valid_until": "2026-04-11T01:05:12.000Z",
      "x_nadsec_event_count": 1051,
      "x_nadsec_first_seen": "2026-03-10T00:07:20.036Z",
      "x_nadsec_last_seen": "2026-03-14T03:46:44.136Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US",
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "w***a",
        "d***a",
        "d*****r",
        "w****m"
      ],
      "x_nadsec_passwords_attempted": [
        "A*******3",
        "***",
        "1****6",
        "1**4",
        "*"
      ]
    },
    {
      "created": "2026-03-10T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--006ad327-51c0-4681-a976-555c34346c2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.35.108.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:05:13.000Z",
      "valid_until": "2026-04-11T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T00:08:16.922Z",
      "x_nadsec_last_seen": "2026-03-10T00:08:16.922Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--63b59e9d-b63e-46ac-ab43-bcce5138e02d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.202.18.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:05:13.000Z",
      "valid_until": "2026-04-11T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T00:39:08.102Z",
      "x_nadsec_last_seen": "2026-03-10T00:39:08.102Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-10T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--fb8302fd-cb82-4f8d-be32-4b2df96bd950",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.94.187.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:05:13.000Z",
      "valid_until": "2026-04-11T01:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T00:47:32.235Z",
      "x_nadsec_last_seen": "2026-03-10T00:47:32.235Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-10T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--cb83aeeb-95b5-4b89-8c49-ad44f0eef02e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.119.226.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:05:13.000Z",
      "valid_until": "2026-04-11T01:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T00:31:08.568Z",
      "x_nadsec_last_seen": "2026-03-10T00:37:47.440Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-10T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=RU; asn=21479; asn_org=Rostelecom",
      "id": "indicator--8926f3d6-9cbd-42e9-9fa5-e90a1142d475",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.68.13.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:05:13.000Z",
      "valid_until": "2026-04-11T01:05:12.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-10T00:38:35.308Z",
      "x_nadsec_last_seen": "2026-03-21T08:06:28.488Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "21479"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-10T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IT; asn=30848; asn_org=UNIDATA S.p.A.",
      "id": "indicator--8f101f7e-442c-450c-96ad-8d41309d0bde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.217.182.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:05:13.000Z",
      "valid_until": "2026-04-11T01:05:12.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-10T00:28:15.286Z",
      "x_nadsec_last_seen": "2026-03-25T03:56:30.959Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30848"
      ],
      "x_nadsec_orgs": [
        "UNIDATA S.p.A."
      ]
    },
    {
      "created": "2026-03-10T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=45305; asn_org=Lintas Data Prima, PT",
      "id": "indicator--d352157d-6710-4048-82a3-ba3c512f73a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.28.112.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:05:13.000Z",
      "valid_until": "2026-04-11T02:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T01:40:12.480Z",
      "x_nadsec_last_seen": "2026-03-10T01:42:16.704Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "45305"
      ],
      "x_nadsec_orgs": [
        "Lintas Data Prima, PT"
      ]
    },
    {
      "created": "2026-03-10T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--ff92b26f-95a4-4ac5-886d-7f8373af19fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.97.54.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:05:13.000Z",
      "valid_until": "2026-04-11T02:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T01:26:54.029Z",
      "x_nadsec_last_seen": "2026-03-10T01:28:58.681Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-10T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--2b9e869d-34be-423c-9b9c-a45771ca1225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.8.101.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:05:13.000Z",
      "valid_until": "2026-04-11T02:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T01:45:38.176Z",
      "x_nadsec_last_seen": "2026-03-10T01:45:38.176Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-10T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--8df60de4-961e-467a-9cf6-17e1e6b059b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.211.110.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:05:13.000Z",
      "valid_until": "2026-04-11T02:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-10T01:08:22.846Z",
      "x_nadsec_last_seen": "2026-03-10T01:44:16.575Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-03-10T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=63859; asn_org=PT. Eka Mas Republik",
      "id": "indicator--96e05b5c-9b8b-4aad-878b-dd5a2bdb6c0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '158.140.166.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:05:13.000Z",
      "valid_until": "2026-04-11T02:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T01:40:12.365Z",
      "x_nadsec_last_seen": "2026-03-10T01:40:12.365Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "63859"
      ],
      "x_nadsec_orgs": [
        "PT. Eka Mas Republik"
      ]
    },
    {
      "created": "2026-03-10T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=63859; asn_org=PT. Eka Mas Republik",
      "id": "indicator--462cf62a-249e-49de-bd02-85351ffa63dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '158.140.170.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:05:13.000Z",
      "valid_until": "2026-04-11T02:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T01:42:16.088Z",
      "x_nadsec_last_seen": "2026-03-10T01:42:16.088Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "63859"
      ],
      "x_nadsec_orgs": [
        "PT. Eka Mas Republik"
      ]
    },
    {
      "created": "2026-03-10T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--e16710ef-1bb2-4f71-90c8-e948f14b14a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.88.123.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:05:13.000Z",
      "valid_until": "2026-04-11T02:05:12.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-03-10T01:32:44.466Z",
      "x_nadsec_last_seen": "2026-03-10T01:36:20.492Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-10T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--2122837a-2e82-43b9-b2f4-86012a485028",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:05:13.000Z",
      "valid_until": "2026-04-11T02:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T01:31:19.276Z",
      "x_nadsec_last_seen": "2026-03-10T01:31:39.205Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-10T02:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=200613; asn_org=Imeretinskay Riviera LLC",
      "id": "indicator--02d5cd52-0c71-4ed6-aca0-d84179ead431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T02:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.185.70.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:05:13.000Z",
      "valid_until": "2026-04-11T02:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T01:29:47.636Z",
      "x_nadsec_last_seen": "2026-03-10T01:31:55.426Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "200613"
      ],
      "x_nadsec_orgs": [
        "Imeretinskay Riviera LLC"
      ]
    },
    {
      "created": "2026-03-10T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45903; asn_org=CMC Telecom Infrastructure Company",
      "id": "indicator--f34df281-e5e8-4fc4-a502-a983359d300f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.20.108.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T03:05:13.000Z",
      "valid_until": "2026-04-11T03:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T02:18:03.927Z",
      "x_nadsec_last_seen": "2026-03-10T02:20:07.787Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45903"
      ],
      "x_nadsec_orgs": [
        "CMC Telecom Infrastructure Company"
      ]
    },
    {
      "created": "2026-03-10T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=4761; asn_org=INDOSAT Internet Network Provider",
      "id": "indicator--85f8db57-5973-4866-988a-6e38f0f4ce33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.5.16.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T03:05:13.000Z",
      "valid_until": "2026-04-11T03:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T02:22:34.847Z",
      "x_nadsec_last_seen": "2026-03-10T02:29:13.564Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4761"
      ],
      "x_nadsec_orgs": [
        "INDOSAT Internet Network Provider"
      ]
    },
    {
      "created": "2026-03-10T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=394089; asn_org=Google LLC",
      "id": "indicator--4234a393-41c6-4be0-ab01-7b882472d3e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.41.196.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T03:05:13.000Z",
      "valid_until": "2026-04-11T03:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T02:13:53.852Z",
      "x_nadsec_last_seen": "2026-03-10T02:15:57.515Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "394089"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-10T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--451b5bd4-4d83-4093-87a2-fe1b22a3991e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.105.128.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T03:05:13.000Z",
      "valid_until": "2026-04-11T03:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T02:41:08.685Z",
      "x_nadsec_last_seen": "2026-03-10T02:41:38.685Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-10T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45903; asn_org=CMC Telecom Infrastructure Company",
      "id": "indicator--01fe5d46-1de5-4438-a651-46e9e06c65d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.91.3.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T03:05:13.000Z",
      "valid_until": "2026-04-11T03:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T02:13:25.047Z",
      "x_nadsec_last_seen": "2026-03-10T02:20:08.766Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45903"
      ],
      "x_nadsec_orgs": [
        "CMC Telecom Infrastructure Company"
      ]
    },
    {
      "created": "2026-03-10T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--5857159d-0396-49df-8d41-fb4a48358d29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T03:05:13.000Z",
      "valid_until": "2026-04-11T03:05:12.000Z",
      "x_nadsec_event_count": 74,
      "x_nadsec_first_seen": "2026-03-10T02:19:41.076Z",
      "x_nadsec_last_seen": "2026-03-24T18:27:35.874Z",
      "x_nadsec_ports": [
        "1723",
        "135",
        "1883",
        "21"
      ],
      "x_nadsec_services": [
        "pptpd",
        "epmapper",
        "mqttd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-03-10T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=24207; asn_org=PT NettoCyber Indonesia",
      "id": "indicator--1fa5c130-249e-43f6-b32e-7fed05fa8c23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.153.113.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T03:05:13.000Z",
      "valid_until": "2026-04-11T03:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T03:01:22.751Z",
      "x_nadsec_last_seen": "2026-03-10T03:03:27.185Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "24207"
      ],
      "x_nadsec_orgs": [
        "PT NettoCyber Indonesia"
      ]
    },
    {
      "created": "2026-03-10T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=SA; asn=39891; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--6897122e-8fab-4378-93fd-379ae2520044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '51.253.240.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T03:05:13.000Z",
      "valid_until": "2026-04-11T03:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T02:42:57.719Z",
      "x_nadsec_last_seen": "2026-03-10T02:50:53.253Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "39891"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-10T03:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=3580; asn_org=Planet Networks",
      "id": "indicator--5ffe9873-fa6e-456d-8128-5a9d8215b2e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T03:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '63.133.226.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T03:05:13.000Z",
      "valid_until": "2026-04-11T03:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T02:35:18.854Z",
      "x_nadsec_last_seen": "2026-03-10T02:37:24.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "3580"
      ],
      "x_nadsec_orgs": [
        "Planet Networks"
      ]
    },
    {
      "created": "2026-03-10T04:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2d001cc9-9f16-47a2-afa3-82ede3187b9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.81.0.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:05:15.000Z",
      "valid_until": "2026-04-11T04:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T03:09:41.329Z",
      "x_nadsec_last_seen": "2026-03-10T03:09:41.329Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T04:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--a85e8d80-8fe4-4e7c-840b-40ed03f9a870",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.206.123.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:05:15.000Z",
      "valid_until": "2026-04-11T04:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-10T04:00:01.574Z",
      "x_nadsec_last_seen": "2026-03-10T04:14:33.793Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-10T04:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=15802; asn_org=Emirates Integrated Telecommunications Company PJSC",
      "id": "indicator--7d09b486-3704-4711-bb11-6aae62ae00cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.32.88.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:05:15.000Z",
      "valid_until": "2026-04-11T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T03:09:58.372Z",
      "x_nadsec_last_seen": "2026-03-10T03:12:06.002Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "15802"
      ],
      "x_nadsec_orgs": [
        "Emirates Integrated Telecommunications Company PJSC"
      ]
    },
    {
      "created": "2026-03-10T04:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=43766; asn_org=Mobile Telecommunication Company Saudi Arabia Joint-Stock company",
      "id": "indicator--587c49ff-1c79-420e-8f88-47b9dc79975e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '51.39.214.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:05:15.000Z",
      "valid_until": "2026-04-11T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T03:12:02.016Z",
      "x_nadsec_last_seen": "2026-03-10T03:14:09.475Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "43766"
      ],
      "x_nadsec_orgs": [
        "Mobile Telecommunication Company Saudi Arabia Joint-Stock company"
      ]
    },
    {
      "created": "2026-03-10T04:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:05:15.000Z",
      "valid_until": "2026-04-11T04:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T03:06:30.646Z",
      "x_nadsec_last_seen": "2026-03-21T08:13:52.717Z",
      "x_nadsec_ports": [
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-10T04:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--4565845a-a40c-4578-a541-f050d55ec552",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:05:15.000Z",
      "valid_until": "2026-04-11T04:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T03:33:04.042Z",
      "x_nadsec_last_seen": "2026-03-10T03:33:04.611Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-10T04:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--9a00e738-a9dc-482f-a99f-cebdfeee4267",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '72.255.38.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:05:15.000Z",
      "valid_until": "2026-04-11T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T04:01:23.687Z",
      "x_nadsec_last_seen": "2026-03-10T04:03:30.109Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-10T04:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--c5681b3e-bbf8-4923-b276-4a750ec086c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.204.167.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:05:15.000Z",
      "valid_until": "2026-04-11T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T03:32:11.308Z",
      "x_nadsec_last_seen": "2026-03-10T03:34:17.580Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-10T04:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--cee91b2c-1ec4-4052-9e37-d2641b53a4d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T04:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.188.77.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:05:15.000Z",
      "valid_until": "2026-04-11T04:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T03:26:11.594Z",
      "x_nadsec_last_seen": "2026-03-10T03:28:19.258Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-10T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--491281af-27b5-476a-a663-7f57af064da6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.110.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T05:05:11.000Z",
      "valid_until": "2026-04-11T05:05:10.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-10T04:53:48.340Z",
      "x_nadsec_last_seen": "2026-03-10T14:50:16.855Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-10T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=23688; asn_org=Link3 Technologies Ltd.",
      "id": "indicator--641e1caf-6329-431f-9e4d-bee73f2e251a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '163.47.33.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T05:05:11.000Z",
      "valid_until": "2026-04-11T05:05:10.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-10T04:30:40.866Z",
      "x_nadsec_last_seen": "2026-03-25T06:03:06.317Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23688"
      ],
      "x_nadsec_orgs": [
        "Link3 Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-10T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--d1f1d5b8-4e20-480c-a22b-0254af135760",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.214.216.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T05:05:11.000Z",
      "valid_until": "2026-04-11T05:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T04:33:27.603Z",
      "x_nadsec_last_seen": "2026-03-10T04:33:35.645Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-10T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=FR; asn=43350; asn_org=NForce Entertainment B.V.",
      "id": "indicator--5ee36acd-4492-4b81-af8f-a7b19bbef225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.107.80.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T05:05:11.000Z",
      "valid_until": "2026-04-11T05:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T04:26:13.169Z",
      "x_nadsec_last_seen": "2026-03-12T22:06:25.085Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "43350"
      ],
      "x_nadsec_orgs": [
        "NForce Entertainment B.V."
      ]
    },
    {
      "created": "2026-03-10T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=HK; asn=133201; asn_org=ABCDE GROUP",
      "id": "indicator--fb482bfd-6761-4beb-bdf4-e0857104c658",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.61.86.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T05:05:11.000Z",
      "valid_until": "2026-04-11T05:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T04:36:00.670Z",
      "x_nadsec_last_seen": "2026-03-10T04:36:01.912Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "133201"
      ],
      "x_nadsec_orgs": [
        "ABCDE GROUP"
      ]
    },
    {
      "created": "2026-03-10T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=23688; asn_org=Link3 Technologies Ltd.",
      "id": "indicator--59c49b22-ecdb-4403-bee8-1b8d5f366e40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.147.191.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T05:05:11.000Z",
      "valid_until": "2026-04-11T05:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T04:19:27.435Z",
      "x_nadsec_last_seen": "2026-03-10T04:26:17.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23688"
      ],
      "x_nadsec_orgs": [
        "Link3 Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-10T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--c4ad5430-c997-4d8b-8172-8129928db964",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T05:05:11.000Z",
      "valid_until": "2026-04-11T05:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T04:40:08.324Z",
      "x_nadsec_last_seen": "2026-03-24T17:35:21.160Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-10T05:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--f803cf56-789f-4dfc-bc84-29ad7568441b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T05:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.26.82.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T05:05:11.000Z",
      "valid_until": "2026-04-11T05:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T05:01:36.014Z",
      "x_nadsec_last_seen": "2026-03-10T05:08:37.235Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=131111; asn_org=PT Mora Telematika Indonesia",
      "id": "indicator--ebfdfe3c-75e3-4579-a410-3ac420a45e19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.177.100.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T05:36:49.001Z",
      "x_nadsec_last_seen": "2026-03-10T05:38:53.198Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "131111"
      ],
      "x_nadsec_orgs": [
        "PT Mora Telematika Indonesia"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=137166; asn_org=Satellite Netcom Private Limited",
      "id": "indicator--fab26337-04fe-4ee7-9e35-0f6f602b022c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.251.49.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T05:26:38.023Z",
      "x_nadsec_last_seen": "2026-03-10T05:26:38.165Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "137166"
      ],
      "x_nadsec_orgs": [
        "Satellite Netcom Private Limited"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--e7f77cf4-e766-4d18-bc4b-8c0ac57250d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.155.119.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T05:43:35.721Z",
      "x_nadsec_last_seen": "2026-03-10T05:43:35.721Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--6223c9be-241f-4c0a-820c-7db27162a6dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.96.46.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T05:31:31.921Z",
      "x_nadsec_last_seen": "2026-03-10T05:33:37.039Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e580176e-93be-427a-a77d-7c99d3f9e71c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.170.183.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T05:59:09.495Z",
      "x_nadsec_last_seen": "2026-03-10T06:01:15.129Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7f046e30-a298-4a36-9775-412082a5628f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.190.245.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T05:11:30.327Z",
      "x_nadsec_last_seen": "2026-03-10T05:11:30.327Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--b1f79f88-096c-4fa4-8863-b20db424a5f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.225.168.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T05:12:02.095Z",
      "x_nadsec_last_seen": "2026-03-10T05:12:09.349Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--764ba615-e128-44bb-94d4-45534eb61bba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T05:29:27.623Z",
      "x_nadsec_last_seen": "2026-03-20T17:46:13.728Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--41887a75-9db2-4941-b924-805c0f4c8b78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T05:29:27.918Z",
      "x_nadsec_last_seen": "2026-03-10T05:29:27.918Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=61889; asn_org=BR.Digital Telecom",
      "id": "indicator--ef394677-8aeb-4a43-9e11-ebf49934e9cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.195.241.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-10T05:47:02.865Z",
      "x_nadsec_last_seen": "2026-03-13T14:18:53.130Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "61889"
      ],
      "x_nadsec_orgs": [
        "BR.Digital Telecom"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--8a2412ae-965a-4450-a766-59aac6a05a1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.137.231.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T06:00:16.511Z",
      "x_nadsec_last_seen": "2026-03-10T06:02:22.418Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4d89fed2-e906-41d3-8b32-70e111821041",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T05:59:08.246Z",
      "x_nadsec_last_seen": "2026-03-10T05:59:08.246Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=46063; asn_org=PT.Graha Telekomunikasi Indonesia",
      "id": "indicator--f09aa564-5065-4622-b2d1-f4e037f26ad8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.112.71.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T05:54:27.679Z",
      "x_nadsec_last_seen": "2026-03-10T05:56:31.884Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "46063"
      ],
      "x_nadsec_orgs": [
        "PT.Graha Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--bb036d14-ccbe-4d4f-be31-e7a26be8d17c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.71.16.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T05:25:50.570Z",
      "x_nadsec_last_seen": "2026-03-10T05:27:54.889Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--c23c7daa-b2ba-4716-b104-36839b37d5da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.83.129.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T05:33:59.548Z",
      "x_nadsec_last_seen": "2026-03-10T05:36:04.000Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TJ; asn=208592; asn_org=LLC net Solutions",
      "id": "indicator--c569d0da-4f7e-4fdf-92dc-42ac37a452f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.94.217.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T05:39:07.967Z",
      "x_nadsec_last_seen": "2026-03-10T05:39:08.048Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TJ"
      ],
      "x_nadsec_asns": [
        "208592"
      ],
      "x_nadsec_orgs": [
        "LLC net Solutions"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T05:32:00.392Z",
      "x_nadsec_last_seen": "2026-03-27T14:54:32.685Z",
      "x_nadsec_ports": [
        "1883",
        "21",
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "mqttd",
        "ftpd",
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--7e45a76c-6a12-4159-b430-c9681bd905a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.181.187.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T05:11:07.798Z",
      "x_nadsec_last_seen": "2026-03-10T05:13:15.402Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--82b74816-7825-4241-a8fb-ac74618c8011",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T05:07:22.352Z",
      "x_nadsec_last_seen": "2026-03-10T05:07:22.352Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-10T06:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--54c772d4-4422-4542-bf33-6e31e6d9e3f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T06:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:05:17.000Z",
      "valid_until": "2026-04-11T06:05:10.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T05:07:22.783Z",
      "x_nadsec_last_seen": "2026-03-10T05:07:22.783Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--c2e4cc87-c196-4fe6-883f-663e5a2884f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T06:42:35.114Z",
      "x_nadsec_last_seen": "2026-03-10T06:42:35.114Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--79475ebc-ae55-4861-9935-dcc4c74de0bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T06:42:53.230Z",
      "x_nadsec_last_seen": "2026-03-27T06:38:39.326Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--8b9da76b-9f7d-4dbb-b6b2-333075f3b9f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.160.250.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T06:10:37.064Z",
      "x_nadsec_last_seen": "2026-03-10T06:11:03.842Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=38841; asn_org=kbro CO. Ltd.",
      "id": "indicator--4b289e86-58d0-4cc7-9d9a-ad770a47205d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.195.66.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T06:17:46.849Z",
      "x_nadsec_last_seen": "2026-03-10T06:19:51.665Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "38841"
      ],
      "x_nadsec_orgs": [
        "kbro CO. Ltd."
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=4780; asn_org=Digital United Inc.",
      "id": "indicator--43c5af08-cdc0-4e23-b1fc-159dba807df3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.204.237.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T06:47:30.322Z",
      "x_nadsec_last_seen": "2026-03-10T06:53:54.729Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "4780"
      ],
      "x_nadsec_orgs": [
        "Digital United Inc."
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e7ac0d59-de9e-4844-b044-984b4db868f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.232.181.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T06:35:51.869Z",
      "x_nadsec_last_seen": "2026-03-10T06:37:56.565Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--0a77590f-8854-46e5-94e4-fc4d7c7c5a93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.97.212.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T06:06:42.740Z",
      "x_nadsec_last_seen": "2026-03-10T06:13:30.765Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DO; asn=6400; asn_org=Compania Dominicana de Telefonos S. A.",
      "id": "indicator--d56b9b27-68b1-4c91-bf60-e2fb9fd6a2cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.0.121.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T06:12:46.740Z",
      "x_nadsec_last_seen": "2026-03-10T06:14:52.486Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "6400"
      ],
      "x_nadsec_orgs": [
        "Compania Dominicana de Telefonos S. A."
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=151750; asn_org=K-anandraj Inet Solutions Private Limited",
      "id": "indicator--bd8d326f-eb42-4bf7-a560-d27a1e2bdb5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.15.234.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T06:17:06.210Z",
      "x_nadsec_last_seen": "2026-03-10T06:24:31.655Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151750"
      ],
      "x_nadsec_orgs": [
        "K-anandraj Inet Solutions Private Limited"
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BD; asn=45588; asn_org=Bangladesh Telecommunications Company Limited BTCL, Nationwide PSTN Operator and Data and In",
      "id": "indicator--ef03062f-8d9d-46e8-9832-ada951cf23a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.211.183.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T06:56:41.992Z",
      "x_nadsec_last_seen": "2026-03-10T06:58:48.429Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "45588"
      ],
      "x_nadsec_orgs": [
        "Bangladesh Telecommunications Company Limited BTCL, Nationwide PSTN Operator and Data and In"
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--4893e3de-11f2-4b63-a1ca-fdd0919b4869",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.253.7.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T06:26:40.592Z",
      "x_nadsec_last_seen": "2026-03-10T06:28:45.987Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e14d2941-9e09-455f-be46-e07dca5499fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T06:40:49.772Z",
      "x_nadsec_last_seen": "2026-03-18T08:23:35.283Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--1500edad-7eeb-4cd2-869b-f605e59be349",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.228.3.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T06:16:29.755Z",
      "x_nadsec_last_seen": "2026-03-10T06:18:36.495Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8a0528da-1164-4619-8fed-cdaa320d5ef1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T06:34:19.706Z",
      "x_nadsec_last_seen": "2026-03-10T06:34:19.706Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=25159; asn_org=PJSC MegaFon",
      "id": "indicator--c0eee4fe-ac97-42f5-b6a2-dd265da5fa47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.173.82.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T06:23:35.288Z",
      "x_nadsec_last_seen": "2026-03-10T06:25:40.490Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25159"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--3ca76aed-d25f-455d-886e-1749b769cbbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.137.14.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T06:47:40.188Z",
      "x_nadsec_last_seen": "2026-03-10T06:51:50.018Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--6708445f-3152-41bc-825a-edf28f490f83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.50.186.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T06:25:54.599Z",
      "x_nadsec_last_seen": "2026-03-10T06:25:54.864Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-10T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37671; asn_org=GLOBALNET-AS",
      "id": "indicator--f10b47ca-ac85-4a87-832d-f5185f8de47d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.227.24.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T07:05:03.000Z",
      "valid_until": "2026-04-11T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T06:09:33.317Z",
      "x_nadsec_last_seen": "2026-03-10T06:11:39.439Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37671"
      ],
      "x_nadsec_orgs": [
        "GLOBALNET-AS"
      ]
    },
    {
      "created": "2026-03-10T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--9c44c6fe-73d4-4af6-9a88-dfcf340fa1ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.55.178.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:05:04.000Z",
      "valid_until": "2026-04-11T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T07:25:47.757Z",
      "x_nadsec_last_seen": "2026-03-10T07:27:53.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-10T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3d2b9df0-2605-461f-b810-78f14ddb214b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.165.167.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:05:04.000Z",
      "valid_until": "2026-04-11T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T07:44:22.378Z",
      "x_nadsec_last_seen": "2026-03-10T07:46:27.146Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-10T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--3eebc7f0-feda-4bd4-b6c4-0064ad56f208",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.8.211.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:05:04.000Z",
      "valid_until": "2026-04-11T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T08:02:20.206Z",
      "x_nadsec_last_seen": "2026-03-10T08:08:54.269Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-03-10T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--a31b6641-8032-4cec-8ebc-b244f0c1634c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.191.254.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:05:04.000Z",
      "valid_until": "2026-04-11T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T07:51:51.037Z",
      "x_nadsec_last_seen": "2026-03-10T07:53:58.163Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-10T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DE; asn=9145; asn_org=EWE-Tel GmbH",
      "id": "indicator--c534357b-5bf4-4629-815c-380e19bb029b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.138.1.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:05:04.000Z",
      "valid_until": "2026-04-11T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T07:54:33.127Z",
      "x_nadsec_last_seen": "2026-03-10T07:56:39.781Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "9145"
      ],
      "x_nadsec_orgs": [
        "EWE-Tel GmbH"
      ]
    },
    {
      "created": "2026-03-10T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--703a5ba5-b1d1-4cd4-b7fd-e47df7edd98f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.224.242.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:05:04.000Z",
      "valid_until": "2026-04-11T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T07:24:48.619Z",
      "x_nadsec_last_seen": "2026-03-10T07:24:58.827Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--deb877a6-9667-49cc-a340-70ce60ea5240",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.20.92.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T09:03:24.358Z",
      "x_nadsec_last_seen": "2026-03-10T09:05:29.338Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=37053; asn_org=RSAWEB Internet Services",
      "id": "indicator--4a647149-f517-44c5-823d-bd555dbe8295",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.214.92.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T08:25:55.915Z",
      "x_nadsec_last_seen": "2026-03-10T08:26:03.520Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37053"
      ],
      "x_nadsec_orgs": [
        "RSAWEB Internet Services"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--067bb73f-f3b1-4234-a3c3-d435b3fd53e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.105.64.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-10T08:59:26.189Z",
      "x_nadsec_last_seen": "2026-03-19T09:24:42.713Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--5b3c0f10-7832-449e-8050-c3bee9222203",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.22.42.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-10T08:17:09.255Z",
      "x_nadsec_last_seen": "2026-03-14T03:14:09.563Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--a93d7a11-bbc9-4d20-b451-2707a5117f95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.167.215.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T08:27:10.015Z",
      "x_nadsec_last_seen": "2026-03-10T08:29:14.679Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--98f7fc97-ed75-400b-a500-c5c507a51b85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.33.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T08:57:15.915Z",
      "x_nadsec_last_seen": "2026-03-10T08:59:20.598Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--c644a39b-600b-4e15-bc16-b070daa4197b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.233.37.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T08:09:36.283Z",
      "x_nadsec_last_seen": "2026-03-10T08:09:36.531Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--5fb02b09-8a32-477b-998e-058444ad0756",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.177.218.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T08:58:09.378Z",
      "x_nadsec_last_seen": "2026-03-10T09:00:15.738Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=52630; asn_org=MOTTANET TI - SERVICOS DE TECNOLOGIA DA INFO",
      "id": "indicator--26987f88-892a-4d84-a92c-5aac841dc215",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.233.6.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-10T08:49:37.605Z",
      "x_nadsec_last_seen": "2026-03-22T12:24:58.945Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52630"
      ],
      "x_nadsec_orgs": [
        "MOTTANET TI - SERVICOS DE TECNOLOGIA DA INFO"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=49350; asn_org=MTS PJSC",
      "id": "indicator--6806aeaf-c013-4c29-bc24-ce8e5903ae15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.218.104.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T08:54:23.390Z",
      "x_nadsec_last_seen": "2026-03-10T08:55:39.327Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "49350"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=49830; asn_org=RESET LLC",
      "id": "indicator--7f61e51e-ec52-4b08-aebb-0be0e663da3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.42.181.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-10T08:56:22.125Z",
      "x_nadsec_last_seen": "2026-03-18T09:16:45.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "49830"
      ],
      "x_nadsec_orgs": [
        "RESET LLC"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VE; asn=27717; asn_org=Corporacion Digitel C.A.",
      "id": "indicator--0e5018fa-1899-428b-bf9b-eabf9cdf592d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.167.48.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-10T08:59:19.179Z",
      "x_nadsec_last_seen": "2026-03-15T09:01:23.832Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "27717"
      ],
      "x_nadsec_orgs": [
        "Corporacion Digitel C.A."
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--7d71af26-ae35-44a8-962e-75809d85b2e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.50.165.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-10T08:30:57.728Z",
      "x_nadsec_last_seen": "2026-03-10T09:06:18.146Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--bfd4ce11-9cdf-46bc-a1f2-e2b9a447f73d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T08:31:56.982Z",
      "x_nadsec_last_seen": "2026-03-10T08:31:56.982Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d2ca6033-fe1d-4174-9e17-daeeeddb4047",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T08:38:10.581Z",
      "x_nadsec_last_seen": "2026-03-10T08:38:58.215Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--5755eae8-fe92-4c25-b0ad-1f4b152d5f45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.232.162.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T08:26:47.672Z",
      "x_nadsec_last_seen": "2026-03-10T08:28:55.369Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--6798f163-2de9-4e5c-8f0a-7626186f73e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.234.10.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T08:57:28.931Z",
      "x_nadsec_last_seen": "2026-03-10T08:59:35.475Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--56ee6284-77dc-4d35-8238-08492da9d86d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.249.221.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T08:33:26.324Z",
      "x_nadsec_last_seen": "2026-03-10T08:33:36.518Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--aabfbbec-43ca-4edf-a0a4-9403ecc4f67b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.127.177.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T08:38:55.685Z",
      "x_nadsec_last_seen": "2026-03-10T08:41:00.391Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=21487; asn_org=Rostelecom",
      "id": "indicator--2c7786b8-ebac-482b-8153-b4fe6bda475b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.185.251.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T08:59:39.380Z",
      "x_nadsec_last_seen": "2026-03-12T15:27:01.868Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "21487"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PL; asn=201814; asn_org=MEVSPACE sp. z o.o.",
      "id": "indicator--f18807b8-4e22-4889-a390-0f770f7405cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.214.55.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T08:24:11.468Z",
      "x_nadsec_last_seen": "2026-03-20T19:41:41.836Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "201814"
      ],
      "x_nadsec_orgs": [
        "MEVSPACE sp. z o.o."
      ]
    },
    {
      "created": "2026-03-10T09:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--52fe56b4-1f4e-4aec-b4d7-bd090c4ffd24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T09:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.89.204.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:05:07.000Z",
      "valid_until": "2026-04-11T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T08:35:34.675Z",
      "x_nadsec_last_seen": "2026-03-10T08:35:34.675Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-10T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=58461; asn_org=CT-HangZhou-IDC",
      "id": "indicator--5a5a6a33-157d-4db9-8134-adeb932fed14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.231.78.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:05:02.000Z",
      "valid_until": "2026-04-11T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T09:52:51.573Z",
      "x_nadsec_last_seen": "2026-03-10T09:52:51.573Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "58461"
      ],
      "x_nadsec_orgs": [
        "CT-HangZhou-IDC"
      ]
    },
    {
      "created": "2026-03-10T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b7f0c4cc-f010-467e-b2bd-190704ea5f1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.75.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:05:02.000Z",
      "valid_until": "2026-04-11T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T09:15:55.401Z",
      "x_nadsec_last_seen": "2026-03-10T09:15:55.401Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--37cd996d-c2be-494a-8f08-bcf492b25fe5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.197.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:05:02.000Z",
      "valid_until": "2026-04-11T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T09:35:53.957Z",
      "x_nadsec_last_seen": "2026-03-13T06:29:46.380Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--06757af2-e5c7-413c-a30b-2aef0e430ad2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.64.208.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:05:02.000Z",
      "valid_until": "2026-04-11T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T09:15:52.133Z",
      "x_nadsec_last_seen": "2026-03-10T09:15:52.133Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=BR; asn=53158; asn_org=Net Turbo Telecom",
      "id": "indicator--ebea11fd-2162-4626-b0e3-1afa2c76e292",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.108.83.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:05:02.000Z",
      "valid_until": "2026-04-11T10:05:01.000Z",
      "x_nadsec_event_count": 21,
      "x_nadsec_first_seen": "2026-03-10T09:23:01.250Z",
      "x_nadsec_last_seen": "2026-03-28T04:38:45.139Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53158"
      ],
      "x_nadsec_orgs": [
        "Net Turbo Telecom"
      ]
    },
    {
      "created": "2026-03-10T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9617d9e2-65e7-46fa-bf34-a76a515a91fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.61.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:05:02.000Z",
      "valid_until": "2026-04-11T10:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T09:57:22.506Z",
      "x_nadsec_last_seen": "2026-03-10T09:57:23.086Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-10T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=23688; asn_org=Link3 Technologies Ltd.",
      "id": "indicator--587db14e-0759-4e25-8bbd-2434b4701a4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.76.96.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:05:02.000Z",
      "valid_until": "2026-04-11T10:05:01.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-10T09:17:16.778Z",
      "x_nadsec_last_seen": "2026-03-11T11:29:14.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23688"
      ],
      "x_nadsec_orgs": [
        "Link3 Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-10T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TN; asn=37492; asn_org=ORANGE; user(top)=**",
      "id": "indicator--8ee63fde-2e0f-40f3-b4cd-3b193cf84d3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.228.170.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:05:02.000Z",
      "valid_until": "2026-04-11T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T09:10:54.278Z",
      "x_nadsec_last_seen": "2026-03-13T09:38:14.835Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37492"
      ],
      "x_nadsec_orgs": [
        "ORANGE"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-10T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--c052e55e-9b6f-4941-98a8-2944861d6859",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.99.187.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:05:02.000Z",
      "valid_until": "2026-04-11T10:05:01.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-03-10T09:39:50.930Z",
      "x_nadsec_last_seen": "2026-03-17T06:43:25.593Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-03-10T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--23768dce-df70-4573-8abc-8970c551ecec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.49.47.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:05:02.000Z",
      "valid_until": "2026-04-11T10:05:01.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-03-10T09:58:45.415Z",
      "x_nadsec_last_seen": "2026-03-10T10:03:49.424Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-10T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IE; asn=6830; asn_org=Liberty Global Europe Holding B.V.",
      "id": "indicator--765bf693-119f-4900-89ac-e6ff860f25d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.100.110.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:05:02.000Z",
      "valid_until": "2026-04-11T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T09:10:34.672Z",
      "x_nadsec_last_seen": "2026-03-10T09:12:48.222Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IE"
      ],
      "x_nadsec_asns": [
        "6830"
      ],
      "x_nadsec_orgs": [
        "Liberty Global Europe Holding B.V."
      ]
    },
    {
      "created": "2026-03-10T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--99f24965-aee6-4095-88c7-ac0dcbb62ed0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:05:02.000Z",
      "valid_until": "2026-04-11T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T09:48:58.012Z",
      "x_nadsec_last_seen": "2026-03-10T09:48:58.012Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-10T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--528d057f-7ec1-4bfb-bc36-77d5949ca368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:05:02.000Z",
      "valid_until": "2026-04-11T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T09:48:58.317Z",
      "x_nadsec_last_seen": "2026-03-10T09:48:58.317Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-10T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--1e7db2d7-2afa-4ed5-97f9-36531282066a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.169.252.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:05:03.000Z",
      "valid_until": "2026-04-11T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T10:19:01.335Z",
      "x_nadsec_last_seen": "2026-03-10T10:21:05.992Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-03-10T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=JP; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f2226a69-1e3a-412a-ac90-3459ac51a2c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.194.228.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:05:03.000Z",
      "valid_until": "2026-04-11T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T10:09:58.024Z",
      "x_nadsec_last_seen": "2026-03-10T10:10:27.039Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-10T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=1267; asn_org=Wind Tre S.p.A.",
      "id": "indicator--20f47096-70eb-407c-ad78-329e86b7258e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '151.46.67.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:05:03.000Z",
      "valid_until": "2026-04-11T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T10:36:06.922Z",
      "x_nadsec_last_seen": "2026-03-10T10:38:13.883Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "1267"
      ],
      "x_nadsec_orgs": [
        "Wind Tre S.p.A."
      ]
    },
    {
      "created": "2026-03-10T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--b40400f5-162b-42fb-bdf1-76fba6149932",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.242.77.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:05:03.000Z",
      "valid_until": "2026-04-11T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T10:42:50.059Z",
      "x_nadsec_last_seen": "2026-03-10T10:44:56.819Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-10T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--7a35054a-bb54-4f0e-9330-20d959fb6fbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.198.219.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:05:03.000Z",
      "valid_until": "2026-04-11T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T10:09:00.930Z",
      "x_nadsec_last_seen": "2026-03-10T10:11:07.870Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-10T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c8c0270d-2607-406b-8e0e-a1e3d90c08d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:05:03.000Z",
      "valid_until": "2026-04-11T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T10:37:54.050Z",
      "x_nadsec_last_seen": "2026-03-10T10:37:54.050Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-10T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--d833e2a4-e5a3-4bd3-bf70-615581fd3cea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.236.77.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:05:03.000Z",
      "valid_until": "2026-04-11T11:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-10T11:01:17.150Z",
      "x_nadsec_last_seen": "2026-03-25T22:02:31.856Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-10T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--3ff3762d-cc7a-4023-94d8-b742a94edb49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.254.250.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:05:03.000Z",
      "valid_until": "2026-04-11T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T10:30:07.819Z",
      "x_nadsec_last_seen": "2026-03-10T10:32:12.266Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-10T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--31fbdd45-aa1d-4c05-bc0e-2b13b11cbbae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.17.54.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:05:03.000Z",
      "valid_until": "2026-04-11T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T10:59:40.567Z",
      "x_nadsec_last_seen": "2026-03-10T11:01:47.775Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-10T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=51622; asn_org=PP IV-COM",
      "id": "indicator--6ea4cdd6-a3b2-46fa-b1ba-7420cab7607e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.162.70.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:05:03.000Z",
      "valid_until": "2026-04-11T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T10:11:52.654Z",
      "x_nadsec_last_seen": "2026-03-10T10:18:47.994Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "51622"
      ],
      "x_nadsec_orgs": [
        "PP IV-COM"
      ]
    },
    {
      "created": "2026-03-10T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--22f7db4e-3477-4aae-b2b1-d57ced56da02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.168.127.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:05:03.000Z",
      "valid_until": "2026-04-11T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T10:29:30.308Z",
      "x_nadsec_last_seen": "2026-03-10T10:29:30.308Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-10T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--32259131-2bf2-4ddf-ac1f-acb694037611",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.48.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:05:03.000Z",
      "valid_until": "2026-04-11T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T10:53:48.224Z",
      "x_nadsec_last_seen": "2026-03-10T10:53:48.224Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-10T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--24495265-c15c-452d-9854-5d4a4a3c4db9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:05:03.000Z",
      "valid_until": "2026-04-11T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T10:08:04.102Z",
      "x_nadsec_last_seen": "2026-03-10T10:08:04.102Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-10T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--dc7ec6fd-c5c1-4e32-bbc3-6ecc7bc34504",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.253.220.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:05:03.000Z",
      "valid_until": "2026-04-11T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T10:58:25.732Z",
      "x_nadsec_last_seen": "2026-03-10T11:04:49.468Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-10T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=TN; asn=37705; asn_org=TOPNET",
      "id": "indicator--2a6119d8-aff7-4ba4-85d4-43267cafe813",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.230.82.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:05:03.000Z",
      "valid_until": "2026-04-11T11:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-10T10:08:22.805Z",
      "x_nadsec_last_seen": "2026-03-10T10:33:31.892Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37705"
      ],
      "x_nadsec_orgs": [
        "TOPNET"
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--4e075342-9fb6-4e23-bf42-687dccfaccd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.53.153.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T11:45:46.440Z",
      "x_nadsec_last_seen": "2026-03-10T11:47:50.855Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--308553fd-c591-4fa9-ae09-60011d6f8bd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.91.93.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T11:08:49.716Z",
      "x_nadsec_last_seen": "2026-03-10T11:08:49.716Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--779c0f72-25d0-444d-a57d-187b6069a18a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.123.96.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T11:30:45.158Z",
      "x_nadsec_last_seen": "2026-03-10T11:37:05.724Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mysqld; ports=3306; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--f5031ef2-314f-4caf-ad26-021337519975",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.58.203.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-10T11:21:10.524Z",
      "x_nadsec_last_seen": "2026-03-10T11:21:11.372Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e72de6a4-0274-48b8-bd21-07caa3addfb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.201.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T11:59:59.416Z",
      "x_nadsec_last_seen": "2026-03-10T11:59:59.416Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--111cef18-3d48-49aa-9ddd-9cd0f8ecc422",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.190.217.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-03-10T11:57:07.507Z",
      "x_nadsec_last_seen": "2026-03-10T11:59:56.218Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f5b1959c-81c2-4d17-a23e-e8688cbce9a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.190.82.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T11:23:36.006Z",
      "x_nadsec_last_seen": "2026-03-11T17:15:25.234Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=11776; asn_org=Breezeline",
      "id": "indicator--0cfaf03a-d2c0-49f7-a3fc-b44bb7cfc777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.188.140.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T12:01:20.000Z",
      "x_nadsec_last_seen": "2026-03-10T12:01:20.113Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11776"
      ],
      "x_nadsec_orgs": [
        "Breezeline"
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--e0319b40-285f-460d-95bd-60530de7d57d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.112.5.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-10T11:36:18.320Z",
      "x_nadsec_last_seen": "2026-03-26T01:49:33.630Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--5d4edaea-2ac4-40d6-821b-7e0edfd0ad22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.85.50.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T11:47:42.852Z",
      "x_nadsec_last_seen": "2026-03-10T11:48:10.026Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=37148; asn_org=globacom-as",
      "id": "indicator--ef8044c1-0f35-49b2-8fb4-9118afcdc72c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.211.57.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T11:14:33.219Z",
      "x_nadsec_last_seen": "2026-03-10T11:14:40.248Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37148"
      ],
      "x_nadsec_orgs": [
        "globacom-as"
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--d8e2ebbc-28c3-4464-b49f-bbb054edec07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.158.157.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T11:13:40.873Z",
      "x_nadsec_last_seen": "2026-03-10T11:14:06.162Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24186"
      ],
      "x_nadsec_orgs": [
        "RailTel Corporation of India Ltd"
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JO; asn=8376; asn_org=Jordan Data Communications Company LLC",
      "id": "indicator--bdca4929-3435-424a-afc0-7cc21f7db0b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.202.72.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T11:14:55.552Z",
      "x_nadsec_last_seen": "2026-03-10T11:19:14.776Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "8376"
      ],
      "x_nadsec_orgs": [
        "Jordan Data Communications Company LLC"
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--e0abc76d-9ce2-433e-ab9d-0f00ae36ff38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.112.115.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T11:31:42.392Z",
      "x_nadsec_last_seen": "2026-03-10T11:38:17.733Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--ba9af086-c53c-451d-b530-c13d13d3a431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.205.181.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-10T11:05:09.769Z",
      "x_nadsec_last_seen": "2026-03-19T16:41:46.067Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TR; asn=51814; asn_org=Yeninet Fiber internet Limited Sirketi",
      "id": "indicator--c3be4557-c1c3-4052-96a8-1c5000f67fcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.181.18.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T12:02:15.785Z",
      "x_nadsec_last_seen": "2026-03-10T12:09:19.784Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "51814"
      ],
      "x_nadsec_orgs": [
        "Yeninet Fiber internet Limited Sirketi"
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--a3a4ea1c-4304-44bd-b67b-f82a2294018d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.71.34.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T11:07:43.214Z",
      "x_nadsec_last_seen": "2026-03-10T11:08:20.664Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-10T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--c7e96d16-cee6-4ab1-8096-06e9e4477f16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:05:03.000Z",
      "valid_until": "2026-04-11T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T11:49:56.171Z",
      "x_nadsec_last_seen": "2026-03-26T02:46:42.758Z",
      "x_nadsec_ports": [
        "3306",
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=49863; asn_org=Lite-Telecom Limited",
      "id": "indicator--44acd02e-58db-4cb9-8be9-613a0a4fefd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.72.243.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T12:19:55.819Z",
      "x_nadsec_last_seen": "2026-03-10T12:19:56.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "49863"
      ],
      "x_nadsec_orgs": [
        "Lite-Telecom Limited"
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=9260; asn_org=Multinet Pakistan Pvt. Ltd.",
      "id": "indicator--8b1ce6ca-1864-442c-811b-ae3685f230ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.209.109.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T12:34:55.835Z",
      "x_nadsec_last_seen": "2026-03-10T12:37:02.140Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9260"
      ],
      "x_nadsec_orgs": [
        "Multinet Pakistan Pvt. Ltd."
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c800b6d3-6259-4b7f-8743-7f76e863a4bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.176.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T12:17:52.466Z",
      "x_nadsec_last_seen": "2026-03-10T12:17:52.466Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=56465; asn_org=Therecom Ltd",
      "id": "indicator--3954758c-fffa-4d00-81a6-85a7b681287b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.120.95.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T12:26:45.698Z",
      "x_nadsec_last_seen": "2026-03-10T12:33:36.824Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "56465"
      ],
      "x_nadsec_orgs": [
        "Therecom Ltd"
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--e64d950c-e45f-49e9-81f9-1f2898487698",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.242.166.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T12:49:36.684Z",
      "x_nadsec_last_seen": "2026-03-10T12:49:36.974Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e9846527-83bc-435a-8ca1-0c5af823b0fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T12:30:37.184Z",
      "x_nadsec_last_seen": "2026-03-17T00:30:53.628Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e372d4db-9ddc-4de8-8225-9fa5565694f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.227.206.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 32,
      "x_nadsec_first_seen": "2026-03-10T12:14:59.217Z",
      "x_nadsec_last_seen": "2026-03-11T08:11:23.372Z",
      "x_nadsec_ports": [
        "27017",
        "1883"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--296190d1-bff4-47ed-856d-f86fcbbf8fc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.69.179.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T12:08:54.164Z",
      "x_nadsec_last_seen": "2026-03-10T12:10:59.215Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9623d3a1-a311-44da-8a84-7f6e40872145",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.166.219.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T12:47:17.550Z",
      "x_nadsec_last_seen": "2026-03-13T08:13:47.015Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=42905; asn_org=LIMANET Ltd.",
      "id": "indicator--daf3d85b-e142-4250-b8bf-6e4a31949b90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.200.151.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-10T12:25:44.112Z",
      "x_nadsec_last_seen": "2026-03-19T19:19:14.417Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "42905"
      ],
      "x_nadsec_orgs": [
        "LIMANET Ltd."
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--46db8633-34a9-4b11-9ee4-2e5c1ac55cb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T12:43:27.045Z",
      "x_nadsec_last_seen": "2026-03-10T12:43:27.045Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--18828608-becb-493b-8fad-ea8c3f3bec0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T12:31:31.505Z",
      "x_nadsec_last_seen": "2026-03-10T12:31:31.505Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--95daa7be-854e-4280-a251-955ad709c6a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.23.117.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T12:05:23.361Z",
      "x_nadsec_last_seen": "2026-03-10T12:12:18.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25159; asn_org=PJSC MegaFon",
      "id": "indicator--b18fd9d3-9ee9-43b6-a0b2-e60ffe01cae7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.173.31.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T12:48:54.533Z",
      "x_nadsec_last_seen": "2026-03-10T12:51:01.477Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25159"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--0d706121-3b5d-488f-bea6-ef9ce580851a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.224.234.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T12:14:49.849Z",
      "x_nadsec_last_seen": "2026-03-10T12:16:54.494Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b6e15e33-be81-442f-b135-46f2c7eca709",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.233.141.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T12:43:15.797Z",
      "x_nadsec_last_seen": "2026-03-10T12:45:20.474Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-10T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--07040373-6541-4c71-b622-0030b62be8ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.225.188.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:05:03.000Z",
      "valid_until": "2026-04-11T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T12:31:17.867Z",
      "x_nadsec_last_seen": "2026-03-10T12:33:24.824Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-03-10T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--67d6a01d-fe77-4d7f-a3b3-e729cc7dd719",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.211.108.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:05:02.000Z",
      "valid_until": "2026-04-11T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T13:17:48.346Z",
      "x_nadsec_last_seen": "2026-03-10T13:18:28.879Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-10T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=138421; asn_org=China Unicom",
      "id": "indicator--e11fc31c-7cf4-4130-959d-ef5fb9e5efcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '140.210.153.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:05:02.000Z",
      "valid_until": "2026-04-11T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T13:58:08.826Z",
      "x_nadsec_last_seen": "2026-03-10T14:00:16.429Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "138421"
      ],
      "x_nadsec_orgs": [
        "China Unicom"
      ]
    },
    {
      "created": "2026-03-10T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9b4d115c-c20f-4429-a818-c70180c27fa6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.42.218.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:05:02.000Z",
      "valid_until": "2026-04-11T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T13:27:34.511Z",
      "x_nadsec_last_seen": "2026-03-10T13:27:34.511Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bd78a04f-84ba-4b82-aca5-ffba397a4466",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:05:02.000Z",
      "valid_until": "2026-04-11T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T13:30:48.409Z",
      "x_nadsec_last_seen": "2026-03-10T13:30:48.409Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-10T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--b3878d94-f634-47c0-a170-47b0a3a8c0a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.115.214.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:05:02.000Z",
      "valid_until": "2026-04-11T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T13:41:19.902Z",
      "x_nadsec_last_seen": "2026-03-10T13:43:26.194Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-10T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CO; asn=10620; asn_org=Telmex Colombia S.A.",
      "id": "indicator--c5faa591-94ec-4129-8048-28f1a961ab7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.53.99.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:05:02.000Z",
      "valid_until": "2026-04-11T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T13:32:50.462Z",
      "x_nadsec_last_seen": "2026-03-10T13:39:45.340Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "10620"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-03-10T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262999; asn_org=IVI TECNOLOGIA E COMUNICACAO LTDA",
      "id": "indicator--33f3cfd4-b7f9-4bb4-bbd5-1cdb59613f0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.226.185.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:05:02.000Z",
      "valid_until": "2026-04-11T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T13:08:19.998Z",
      "x_nadsec_last_seen": "2026-03-10T13:10:26.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262999"
      ],
      "x_nadsec_orgs": [
        "IVI TECNOLOGIA E COMUNICACAO LTDA"
      ]
    },
    {
      "created": "2026-03-10T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--7fde891f-2599-4ead-bba2-40dd842c9f33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.130.242.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:05:02.000Z",
      "valid_until": "2026-04-11T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T13:52:16.683Z",
      "x_nadsec_last_seen": "2026-03-10T13:59:17.471Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-03-10T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--0d4cb208-71d4-4408-bcec-bc907474a351",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.51.114.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:05:02.000Z",
      "valid_until": "2026-04-11T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T13:28:11.368Z",
      "x_nadsec_last_seen": "2026-03-10T13:28:36.499Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-03-10T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=396982; asn_org=Google LLC; user(top)=**",
      "id": "indicator--ea92a6cf-c511-4645-bcd2-09bbc69784a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.93.191.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:05:02.000Z",
      "valid_until": "2026-04-11T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T13:23:26.741Z",
      "x_nadsec_last_seen": "2026-03-10T13:23:26.741Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-10T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--e550a2d5-b28d-425d-8ee4-0de3c650a63b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.233.30.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:05:02.000Z",
      "valid_until": "2026-04-11T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T13:17:03.352Z",
      "x_nadsec_last_seen": "2026-03-10T13:17:03.352Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-10T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e5a5a733-11b6-4c25-b445-d54ccb8f2a21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.23.251.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:05:02.000Z",
      "valid_until": "2026-04-11T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T13:34:56.570Z",
      "x_nadsec_last_seen": "2026-03-10T13:34:56.570Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--266ccfa5-8adb-402b-9658-98817b797357",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.0.206.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:05:02.000Z",
      "valid_until": "2026-04-11T14:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-10T14:02:44.302Z",
      "x_nadsec_last_seen": "2026-03-25T14:42:08.509Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-10T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=197968; asn_org=Comfortel Ltd.",
      "id": "indicator--60df10ca-c556-42da-9d19-b3498dafc11d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.175.175.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:05:13.000Z",
      "valid_until": "2026-04-11T15:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T14:50:20.097Z",
      "x_nadsec_last_seen": "2026-03-10T14:52:27.349Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "197968"
      ],
      "x_nadsec_orgs": [
        "Comfortel Ltd."
      ]
    },
    {
      "created": "2026-03-10T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6293a25e-77e6-4a86-a4fc-d473f336ebd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.199.197.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:05:13.000Z",
      "valid_until": "2026-04-11T15:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T14:20:36.524Z",
      "x_nadsec_last_seen": "2026-03-10T14:20:36.524Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7a6bdbf1-543c-4187-bbf3-249a886d0f7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.128.30.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:05:13.000Z",
      "valid_until": "2026-04-11T15:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T14:57:13.737Z",
      "x_nadsec_last_seen": "2026-03-13T06:46:54.329Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=33934; asn_org=Rostelecom",
      "id": "indicator--e3f1de0b-42ca-40ff-aabb-3ea2e37f9ddc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.35.137.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:05:13.000Z",
      "valid_until": "2026-04-11T15:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T14:45:01.772Z",
      "x_nadsec_last_seen": "2026-03-10T14:46:24.393Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "33934"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-10T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=12252; asn_org=America Movil Peru S.A.C.",
      "id": "indicator--96686af8-9aed-49ba-9649-47a68277fc27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.119.150.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:05:13.000Z",
      "valid_until": "2026-04-11T15:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T14:40:27.987Z",
      "x_nadsec_last_seen": "2026-03-10T14:42:34.813Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "12252"
      ],
      "x_nadsec_orgs": [
        "America Movil Peru S.A.C."
      ]
    },
    {
      "created": "2026-03-10T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--deb9c549-9df8-4e3e-bc2f-94ecc64cc843",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.14.58.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:05:13.000Z",
      "valid_until": "2026-04-11T15:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T14:59:53.386Z",
      "x_nadsec_last_seen": "2026-03-12T08:11:16.404Z",
      "x_nadsec_ports": [
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-10T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SN; asn=8346; asn_org=SONATEL SONATEL-AS Autonomous System; user(top)=**",
      "id": "indicator--c7d1a011-dea1-400f-9223-54bc151599c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.214.47.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:05:13.000Z",
      "valid_until": "2026-04-11T15:05:12.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T14:38:11.956Z",
      "x_nadsec_last_seen": "2026-03-21T20:48:29.559Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SN"
      ],
      "x_nadsec_asns": [
        "8346"
      ],
      "x_nadsec_orgs": [
        "SONATEL SONATEL-AS Autonomous System"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-10T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--ea62c971-51a3-4045-8f4d-e39a8aaf5b12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:05:13.000Z",
      "valid_until": "2026-04-11T15:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T14:39:12.043Z",
      "x_nadsec_last_seen": "2026-03-26T03:27:17.714Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-10T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:05:13.000Z",
      "valid_until": "2026-04-11T15:05:12.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T14:49:32.491Z",
      "x_nadsec_last_seen": "2026-03-11T14:34:14.519Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-10T15:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--78b36540-ea30-4a2a-8821-f21a28877b41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T15:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T15:05:13.000Z",
      "valid_until": "2026-04-11T15:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T14:38:42.742Z",
      "x_nadsec_last_seen": "2026-03-29T15:12:41.142Z",
      "x_nadsec_ports": [
        "445",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-10T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2fdf135c-f7d4-486b-9efc-eec7121f0d48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.162.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:05:03.000Z",
      "valid_until": "2026-04-11T16:05:02.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-10T15:09:05.382Z",
      "x_nadsec_last_seen": "2026-03-17T16:33:25.338Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-10T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--2268ce58-b03a-45ee-9e48-5cdf88ce2db0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.90.27.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:05:03.000Z",
      "valid_until": "2026-04-11T16:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T16:04:26.150Z",
      "x_nadsec_last_seen": "2026-03-10T16:04:26.150Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-10T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--d674daa2-a481-4e9d-a8f7-1fb48a3ab897",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.169.114.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:05:03.000Z",
      "valid_until": "2026-04-11T16:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T15:49:53.269Z",
      "x_nadsec_last_seen": "2026-03-10T15:49:53.343Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-10T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--38ecce0b-8d0d-4171-9cf0-0ac5ee649f4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.227.193.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:05:03.000Z",
      "valid_until": "2026-04-11T16:05:02.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-03-10T15:57:40.148Z",
      "x_nadsec_last_seen": "2026-03-11T13:41:22.059Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-10T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--7d13c679-80ce-48bd-95e6-f437976d3771",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.14.200.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:05:03.000Z",
      "valid_until": "2026-04-11T16:05:02.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-03-10T15:54:24.503Z",
      "x_nadsec_last_seen": "2026-03-10T15:57:57.360Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-03-10T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.",
      "id": "indicator--a1f0dec9-5c5a-4a4b-bafd-e25b2b140209",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.178.140.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:05:03.000Z",
      "valid_until": "2026-04-11T16:05:02.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-10T15:41:31.626Z",
      "x_nadsec_last_seen": "2026-03-10T15:42:45.737Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9269"
      ],
      "x_nadsec_orgs": [
        "Hong Kong Broadband Network Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-03-10T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--aef91ff3-eb98-4f88-a21a-b0a0d8224d36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.210.227.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:05:03.000Z",
      "valid_until": "2026-04-11T16:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T15:47:39.447Z",
      "x_nadsec_last_seen": "2026-03-10T15:49:46.957Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-10T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23949; asn_org=PT Comtronics Systems",
      "id": "indicator--9d10795b-0387-4120-a54a-d5fe0c4fe805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.150.131.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:05:03.000Z",
      "valid_until": "2026-04-11T16:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T15:42:32.628Z",
      "x_nadsec_last_seen": "2026-03-10T15:44:37.554Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23949"
      ],
      "x_nadsec_orgs": [
        "PT Comtronics Systems"
      ]
    },
    {
      "created": "2026-03-10T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--8b41574f-b1f4-4958-9110-d73a2399cbba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.14.33.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:05:03.000Z",
      "valid_until": "2026-04-11T16:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T15:25:52.905Z",
      "x_nadsec_last_seen": "2026-03-25T12:47:41.078Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-10T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IT; asn=30722; asn_org=Fastweb",
      "id": "indicator--d5dcc815-78e3-4f91-9742-9c42ed1eae87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.118.3.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:05:03.000Z",
      "valid_until": "2026-04-11T16:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T15:40:07.661Z",
      "x_nadsec_last_seen": "2026-03-10T15:40:07.661Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30722"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-03-10T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=133255; asn_org=Elxer Communications Private Limited",
      "id": "indicator--e40b8e6b-ba12-4211-91e5-c8b7ee0bc5a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.124.145.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:05:03.000Z",
      "valid_until": "2026-04-11T16:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T15:55:51.648Z",
      "x_nadsec_last_seen": "2026-03-10T15:57:55.818Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133255"
      ],
      "x_nadsec_orgs": [
        "Elxer Communications Private Limited"
      ]
    },
    {
      "created": "2026-03-10T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--1343036e-db10-4d9f-bab5-46b8c73c638d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.162.203.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:05:03.000Z",
      "valid_until": "2026-04-11T16:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T15:28:39.508Z",
      "x_nadsec_last_seen": "2026-03-10T15:30:46.109Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-03-10T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=57737; asn_org=Joint Stock Company Angarsk Electrolysis Chemical Complex",
      "id": "indicator--1b1b1deb-f92e-49b8-9eb5-510d627b7de2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.234.172.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:05:03.000Z",
      "valid_until": "2026-04-11T16:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T15:36:00.802Z",
      "x_nadsec_last_seen": "2026-03-10T15:38:08.798Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57737"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company Angarsk Electrolysis Chemical Complex"
      ]
    },
    {
      "created": "2026-03-10T17:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=28015; asn_org=MERCO COMUNICACIONES",
      "id": "indicator--90cb250f-5ec8-4641-afd1-ad2edd088ef9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.219.168.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:05:30.000Z",
      "valid_until": "2026-04-11T17:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T16:07:31.268Z",
      "x_nadsec_last_seen": "2026-03-10T16:09:38.690Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "28015"
      ],
      "x_nadsec_orgs": [
        "MERCO COMUNICACIONES"
      ]
    },
    {
      "created": "2026-03-10T17:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3100fd8a-32e4-4f1b-a49f-b39bc9e3d112",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:05:30.000Z",
      "valid_until": "2026-04-11T17:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T16:22:25.681Z",
      "x_nadsec_last_seen": "2026-03-10T16:22:25.681Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-10T17:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--81598e0c-a02b-43be-895c-e6df677afd95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:05:30.000Z",
      "valid_until": "2026-04-11T17:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T16:23:59.729Z",
      "x_nadsec_last_seen": "2026-03-10T16:23:59.729Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-10T17:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--2bb41f1e-329a-44b9-b9f9-aabbcb2a8b62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.205.47.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:05:30.000Z",
      "valid_until": "2026-04-11T17:05:13.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T16:31:52.425Z",
      "x_nadsec_last_seen": "2026-03-10T16:34:03.362Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-10T17:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--72209dae-5c1b-4757-87be-0e9c432dbec6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.220.251.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:05:30.000Z",
      "valid_until": "2026-04-11T17:05:13.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-10T16:32:01.986Z",
      "x_nadsec_last_seen": "2026-03-11T00:15:35.059Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-10T17:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3a28b036-040b-48fb-a060-7a509e3ab825",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '68.183.81.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:05:30.000Z",
      "valid_until": "2026-04-11T17:05:13.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T16:24:44.933Z",
      "x_nadsec_last_seen": "2026-03-10T16:24:44.933Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T17:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=215148; asn_org=Delta Telecom Ltd",
      "id": "indicator--e1c74a16-8c84-4668-a8ce-37d2404fd8f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T17:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.20.81.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:05:30.000Z",
      "valid_until": "2026-04-11T17:05:13.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T16:53:41.261Z",
      "x_nadsec_last_seen": "2026-03-10T16:55:48.756Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "215148"
      ],
      "x_nadsec_orgs": [
        "Delta Telecom Ltd"
      ]
    },
    {
      "created": "2026-03-10T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--446a7206-69ce-4e3a-9a4d-9c6ad641ecb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.246.197.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:05:02.000Z",
      "valid_until": "2026-04-11T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T17:48:01.443Z",
      "x_nadsec_last_seen": "2026-03-10T17:50:07.028Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-10T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=mongod; ports=27017; cc=IR; asn=213790; asn_org=Limited Network LTD",
      "id": "indicator--2625fffc-3bf0-41b1-92e5-af1de6e07386",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:05:02.000Z",
      "valid_until": "2026-04-11T18:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-10T17:19:25.176Z",
      "x_nadsec_last_seen": "2026-03-10T18:03:51.130Z",
      "x_nadsec_ports": [
        "27017",
        "1723"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "213790"
      ],
      "x_nadsec_orgs": [
        "Limited Network LTD"
      ]
    },
    {
      "created": "2026-03-10T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=12252; asn_org=America Movil Peru S.A.C.",
      "id": "indicator--5e316052-a2a2-42ba-8ddd-49e5c21535ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.6.107.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:05:02.000Z",
      "valid_until": "2026-04-11T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T17:06:04.158Z",
      "x_nadsec_last_seen": "2026-03-10T17:08:10.526Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "12252"
      ],
      "x_nadsec_orgs": [
        "America Movil Peru S.A.C."
      ]
    },
    {
      "created": "2026-03-10T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--59656fbb-2e85-41b8-b76f-5a278349fb4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.21.255.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:05:02.000Z",
      "valid_until": "2026-04-11T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T17:27:23.903Z",
      "x_nadsec_last_seen": "2026-03-10T17:29:31.548Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-10T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=27879; asn_org=Informatica y Telecomunicaciones S.A.",
      "id": "indicator--af6fe0b0-8cd6-42b5-a33d-b7ddf31601ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.15.204.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:05:02.000Z",
      "valid_until": "2026-04-11T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T18:03:36.896Z",
      "x_nadsec_last_seen": "2026-03-10T18:05:43.519Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27879"
      ],
      "x_nadsec_orgs": [
        "Informatica y Telecomunicaciones S.A."
      ]
    },
    {
      "created": "2026-03-10T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b158640e-a57a-401a-8210-9c5a77f366b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:05:02.000Z",
      "valid_until": "2026-04-11T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T17:23:19.106Z",
      "x_nadsec_last_seen": "2026-03-10T17:23:19.106Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-10T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--ef3214a5-161b-4f82-8b98-cf6fe85e4fff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.218.213.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:05:02.000Z",
      "valid_until": "2026-04-11T18:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T17:59:07.004Z",
      "x_nadsec_last_seen": "2026-03-10T18:03:15.485Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-10T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d2a040a1-7214-4a6c-8eea-5b30439d4d48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:05:02.000Z",
      "valid_until": "2026-04-11T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T17:10:15.019Z",
      "x_nadsec_last_seen": "2026-03-10T17:10:15.019Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-10T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--338cbdd7-7e35-448e-9b18-b985e40006a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:05:02.000Z",
      "valid_until": "2026-04-11T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T17:10:14.754Z",
      "x_nadsec_last_seen": "2026-03-28T23:17:43.838Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-10T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--96913820-ac0c-498c-affe-28b4727305e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:05:02.000Z",
      "valid_until": "2026-04-11T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T17:10:42.325Z",
      "x_nadsec_last_seen": "2026-03-10T17:10:42.325Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-10T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1cf55bfe-229b-4c2a-9677-a313dd3100c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.48.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:05:03.000Z",
      "valid_until": "2026-04-11T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T18:32:46.645Z",
      "x_nadsec_last_seen": "2026-03-10T18:34:52.267Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-10T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d2e7ab9d-e212-4f80-97f1-90a217336bfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.168.26.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:05:03.000Z",
      "valid_until": "2026-04-11T19:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T18:32:43.420Z",
      "x_nadsec_last_seen": "2026-03-10T18:39:48.629Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-10T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--964e44ad-7e28-4404-b5c6-dc9afae3a8b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.193.32.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:05:03.000Z",
      "valid_until": "2026-04-11T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T18:26:16.479Z",
      "x_nadsec_last_seen": "2026-03-10T18:26:46.041Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-10T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=PH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2a0f891a-384a-40b0-a2e8-a86937090313",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.194.238.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:05:03.000Z",
      "valid_until": "2026-04-11T19:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T18:48:56.539Z",
      "x_nadsec_last_seen": "2026-03-10T18:49:20.219Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-10T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=9260; asn_org=Multinet Pakistan Pvt. Ltd.",
      "id": "indicator--4c4b7627-8f4f-4b0c-9caa-0428222b0d2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.209.67.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:05:03.000Z",
      "valid_until": "2026-04-11T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T19:00:21.192Z",
      "x_nadsec_last_seen": "2026-03-10T19:02:30.442Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9260"
      ],
      "x_nadsec_orgs": [
        "Multinet Pakistan Pvt. Ltd."
      ]
    },
    {
      "created": "2026-03-10T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--48d2c30b-dc39-4f48-b339-de9595faa2ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.88.123.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:05:03.000Z",
      "valid_until": "2026-04-11T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T18:20:29.523Z",
      "x_nadsec_last_seen": "2026-03-10T18:20:29.523Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-10T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--c2d9a263-3dd4-49f0-acd2-880e8a7d23b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.250.195.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:05:03.000Z",
      "valid_until": "2026-04-11T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T18:57:42.587Z",
      "x_nadsec_last_seen": "2026-03-10T18:59:47.906Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-10T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--f2d443eb-a333-4d45-ab8e-996864d9981b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.173.41.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:05:03.000Z",
      "valid_until": "2026-04-11T19:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T19:01:27.114Z",
      "x_nadsec_last_seen": "2026-03-10T19:08:41.730Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-10T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CA; asn=16276; asn_org=OVH SAS; user(top)=**",
      "id": "indicator--f1776c5f-4729-4bf7-a392-acd6bc7b35bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '51.161.13.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:05:03.000Z",
      "valid_until": "2026-04-11T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-09T16:28:00.883Z",
      "x_nadsec_last_seen": "2026-03-10T18:33:35.270Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-10T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=34042; asn_org=MT-Telecom LLC",
      "id": "indicator--9a706b4a-a227-452a-a05c-44755eeb25e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.95.28.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:05:03.000Z",
      "valid_until": "2026-04-11T19:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T18:10:05.419Z",
      "x_nadsec_last_seen": "2026-03-10T18:17:51.924Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "34042"
      ],
      "x_nadsec_orgs": [
        "MT-Telecom LLC"
      ]
    },
    {
      "created": "2026-03-10T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--71f33a7d-8b8b-45fb-86c6-e16fe235bf5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.9.227.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:05:03.000Z",
      "valid_until": "2026-04-11T19:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T18:59:05.974Z",
      "x_nadsec_last_seen": "2026-03-10T19:03:15.643Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-10T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=147133; asn_org=PT Jafati Mitra Solusindo",
      "id": "indicator--e358fc81-6acc-4dfb-9cbf-c47e41d8ee29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.176.181.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:05:14.000Z",
      "valid_until": "2026-04-11T20:05:12.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-10T19:09:58.826Z",
      "x_nadsec_last_seen": "2026-03-24T12:40:55.071Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "147133"
      ],
      "x_nadsec_orgs": [
        "PT Jafati Mitra Solusindo"
      ]
    },
    {
      "created": "2026-03-10T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--fd4ac7f1-a18b-4a4e-a27e-0436077013c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.221.82.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:05:14.000Z",
      "valid_until": "2026-04-11T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T19:38:46.038Z",
      "x_nadsec_last_seen": "2026-03-10T19:40:52.350Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-10T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--20cebebe-7796-4568-bc51-295a2a00b523",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.36.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:05:14.000Z",
      "valid_until": "2026-04-11T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T19:16:20.357Z",
      "x_nadsec_last_seen": "2026-03-10T19:16:39.804Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-10T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PY; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--0169029d-6052-4cb5-9d45-f234012e4817",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.117.188.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:05:14.000Z",
      "valid_until": "2026-04-11T20:05:12.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T19:12:41.387Z",
      "x_nadsec_last_seen": "2026-03-10T19:20:15.018Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-03-10T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--be129a9f-4a79-4529-a8e5-197fdd7a0fae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:05:14.000Z",
      "valid_until": "2026-04-11T20:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T19:30:23.179Z",
      "x_nadsec_last_seen": "2026-03-10T19:30:23.179Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-10T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=7738; asn_org=V tal",
      "id": "indicator--b1ad1331-4ff8-4f2f-9f92-465c087fb24b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.216.50.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:05:14.000Z",
      "valid_until": "2026-04-11T20:05:12.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-10T19:08:39.842Z",
      "x_nadsec_last_seen": "2026-03-12T11:07:37.873Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "7738"
      ],
      "x_nadsec_orgs": [
        "V tal"
      ]
    },
    {
      "created": "2026-03-10T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--995982d0-4547-42c0-a5d8-44c27ca58eb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.156.78.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:05:14.000Z",
      "valid_until": "2026-04-11T20:05:12.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T19:28:14.765Z",
      "x_nadsec_last_seen": "2026-03-10T19:30:22.200Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-10T20:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a232169d-2614-49b1-9b32-1a07d9f37a05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T20:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.226.70.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T20:05:14.000Z",
      "valid_until": "2026-04-11T20:05:12.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T19:45:25.678Z",
      "x_nadsec_last_seen": "2026-03-10T19:45:25.678Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--55d8f250-6626-4615-88fe-0f9b62e92ead",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.95.151.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:05:03.000Z",
      "valid_until": "2026-04-11T21:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T21:04:54.215Z",
      "x_nadsec_last_seen": "2026-03-10T21:11:57.765Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-10T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--672c756e-c310-45a6-bcc3-9b9280f34009",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.26.249.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:05:03.000Z",
      "valid_until": "2026-04-11T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T20:31:51.552Z",
      "x_nadsec_last_seen": "2026-03-10T20:33:58.178Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-10T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=264387; asn_org=OZONIO TELECOMUNICACOES LTDA",
      "id": "indicator--1f444884-23fc-4c37-9366-9183657ea076",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '131.161.126.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:05:03.000Z",
      "valid_until": "2026-04-11T21:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T20:35:27.694Z",
      "x_nadsec_last_seen": "2026-03-10T20:43:33.782Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264387"
      ],
      "x_nadsec_orgs": [
        "OZONIO TELECOMUNICACOES LTDA"
      ]
    },
    {
      "created": "2026-03-10T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--aabdc9eb-8394-447e-9f03-5ebb2f0be33a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.209.152.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:05:03.000Z",
      "valid_until": "2026-04-11T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T20:30:19.076Z",
      "x_nadsec_last_seen": "2026-03-10T20:30:19.076Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--cbd15d33-a927-45d3-816e-b7a53a219a81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.96.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:05:03.000Z",
      "valid_until": "2026-04-11T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T20:31:55.711Z",
      "x_nadsec_last_seen": "2026-03-10T20:31:55.711Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--525b1a6e-0aa9-45a9-8ca2-894ae29d3dab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.90.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:05:03.000Z",
      "valid_until": "2026-04-11T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T21:03:04.650Z",
      "x_nadsec_last_seen": "2026-03-10T21:03:07.915Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--689884ac-67a3-4a28-aefb-181844214038",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:05:03.000Z",
      "valid_until": "2026-04-11T21:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T20:13:03.321Z",
      "x_nadsec_last_seen": "2026-03-12T22:33:31.414Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-10T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=4800; asn_org=PT Aplikanusa Lintasarta",
      "id": "indicator--2a09f399-b199-474f-8a88-770c265423c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.23.93.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:05:03.000Z",
      "valid_until": "2026-04-11T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T20:19:55.924Z",
      "x_nadsec_last_seen": "2026-03-10T20:22:00.218Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4800"
      ],
      "x_nadsec_orgs": [
        "PT Aplikanusa Lintasarta"
      ]
    },
    {
      "created": "2026-03-10T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=11844; asn_org=Empresa Catarinense de Tecnologia em Telecom. Ltda",
      "id": "indicator--95842cdd-721e-4052-a46f-8041b3ce2597",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.85.168.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:05:03.000Z",
      "valid_until": "2026-04-11T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T20:44:26.322Z",
      "x_nadsec_last_seen": "2026-03-10T20:46:33.190Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "11844"
      ],
      "x_nadsec_orgs": [
        "Empresa Catarinense de Tecnologia em Telecom. Ltda"
      ]
    },
    {
      "created": "2026-03-10T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=VE; asn=264628; asn_org=CORPORACION FIBEX TELECOM, C.A.",
      "id": "indicator--d277c586-5676-40d0-9525-1c8a4b37f4c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.120.253.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:05:03.000Z",
      "valid_until": "2026-04-11T21:05:01.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-03-10T21:00:44.490Z",
      "x_nadsec_last_seen": "2026-03-10T21:03:25.214Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "264628"
      ],
      "x_nadsec_orgs": [
        "CORPORACION FIBEX TELECOM, C.A."
      ]
    },
    {
      "created": "2026-03-10T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--cdbc9416-f91f-4d58-985b-5eceac442d2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.199.198.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:05:03.000Z",
      "valid_until": "2026-04-11T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T21:01:12.285Z",
      "x_nadsec_last_seen": "2026-03-10T21:03:19.874Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-10T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--301c3910-35ed-44d8-9ffc-d3e4b474786a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.210.71.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:05:03.000Z",
      "valid_until": "2026-04-11T21:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T20:38:42.302Z",
      "x_nadsec_last_seen": "2026-03-10T20:45:48.599Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-03-10T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7717f42a-4a82-4753-9827-3fcf779a8944",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.223.20.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:05:03.000Z",
      "valid_until": "2026-04-11T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T20:20:45.761Z",
      "x_nadsec_last_seen": "2026-03-10T20:20:45.979Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-10T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PE; asn=266732; asn_org=FIBERTEL PERU S.A.",
      "id": "indicator--80ebe8fb-3119-4bf4-b1d3-fb9d11822a33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.231.72.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:05:03.000Z",
      "valid_until": "2026-04-11T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T20:46:40.929Z",
      "x_nadsec_last_seen": "2026-03-10T20:46:41.192Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "266732"
      ],
      "x_nadsec_orgs": [
        "FIBERTEL PERU S.A."
      ]
    },
    {
      "created": "2026-03-10T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--a584109f-86eb-494e-8684-af026abca1ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.144.175.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T22:05:02.000Z",
      "valid_until": "2026-04-11T22:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-10T21:58:26.949Z",
      "x_nadsec_last_seen": "2026-03-11T01:08:07.672Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-03-10T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=9534; asn_org=Binariang Berhad",
      "id": "indicator--5ef31886-d272-4784-8a91-2369c14942d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.123.6.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T22:05:02.000Z",
      "valid_until": "2026-04-11T22:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-10T21:36:58.001Z",
      "x_nadsec_last_seen": "2026-03-18T03:11:55.572Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9534"
      ],
      "x_nadsec_orgs": [
        "Binariang Berhad"
      ]
    },
    {
      "created": "2026-03-10T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=52436; asn_org=Cable Televisora Color",
      "id": "indicator--6cf2b7f1-a982-4faf-a5f4-eb7136cbc1fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.97.177.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T22:05:02.000Z",
      "valid_until": "2026-04-11T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T21:20:42.430Z",
      "x_nadsec_last_seen": "2026-03-10T21:22:49.171Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "52436"
      ],
      "x_nadsec_orgs": [
        "Cable Televisora Color"
      ]
    },
    {
      "created": "2026-03-10T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=VN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--6e1e27d9-465c-4518-93bf-d6268e9bc3d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.250.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T22:05:02.000Z",
      "valid_until": "2026-04-11T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T21:21:49.589Z",
      "x_nadsec_last_seen": "2026-03-10T21:22:08.712Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-10T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f987636a-f354-4677-aecc-d4215080891a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.65.156.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T22:05:02.000Z",
      "valid_until": "2026-04-11T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T21:31:06.967Z",
      "x_nadsec_last_seen": "2026-03-10T21:31:06.967Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--df2eee68-aba6-414a-887d-4c5786ef37e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.105.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T22:05:02.000Z",
      "valid_until": "2026-04-11T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T21:56:50.998Z",
      "x_nadsec_last_seen": "2026-03-10T21:57:01.148Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-10T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--82f51c08-ac64-466e-ab00-cd3015acf316",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.6.103.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T22:05:02.000Z",
      "valid_until": "2026-04-11T22:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T21:35:26.383Z",
      "x_nadsec_last_seen": "2026-03-10T21:42:31.759Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-03-10T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--d0d69d55-4062-4a24-8250-70e73944d1d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.206.214.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T22:05:02.000Z",
      "valid_until": "2026-04-11T22:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T21:40:42.643Z",
      "x_nadsec_last_seen": "2026-03-10T21:47:01.960Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-10T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MK; asn=6821; asn_org=Makedonski Telekom AD-Skopje; user(top)=**",
      "id": "indicator--e38769d9-826a-456e-9d44-352fba0bafe2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.217.111.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T22:05:02.000Z",
      "valid_until": "2026-04-11T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T21:08:29.685Z",
      "x_nadsec_last_seen": "2026-03-10T21:08:29.685Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MK"
      ],
      "x_nadsec_asns": [
        "6821"
      ],
      "x_nadsec_orgs": [
        "Makedonski Telekom AD-Skopje"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-10T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MA; asn=36903; asn_org=MT-MPLS",
      "id": "indicator--76a30736-327d-4264-b31a-dd90fffac10a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.156.166.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:05:04.000Z",
      "valid_until": "2026-04-11T23:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T22:44:12.445Z",
      "x_nadsec_last_seen": "2026-03-10T22:44:12.740Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ]
    },
    {
      "created": "2026-03-10T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MA; asn=36903; asn_org=MT-MPLS",
      "id": "indicator--0b59f52a-fb08-4f4f-8a50-9960a78aefe4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.156.186.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:05:04.000Z",
      "valid_until": "2026-04-11T23:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T22:46:18.979Z",
      "x_nadsec_last_seen": "2026-03-10T22:46:18.979Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ]
    },
    {
      "created": "2026-03-10T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f48dfbf4-1f73-4834-bdaf-f641505caf52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.59.66.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:05:04.000Z",
      "valid_until": "2026-04-11T23:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T22:36:06.886Z",
      "x_nadsec_last_seen": "2026-03-10T22:36:06.886Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6510a178-d671-4a81-a60d-0f0d9a905baa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.108.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:05:04.000Z",
      "valid_until": "2026-04-11T23:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T22:40:53.144Z",
      "x_nadsec_last_seen": "2026-03-10T22:40:53.144Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-10T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=52794; asn_org=Net Flex Ltda ME",
      "id": "indicator--b512398b-6b62-40f0-bbb0-0044ca7e89e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.200.162.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:05:04.000Z",
      "valid_until": "2026-04-11T23:05:02.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-10T22:06:23.869Z",
      "x_nadsec_last_seen": "2026-03-24T19:37:56.461Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52794"
      ],
      "x_nadsec_orgs": [
        "Net Flex Ltda ME"
      ]
    },
    {
      "created": "2026-03-10T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IT; asn=200689; asn_org=Teleimpianti Srl",
      "id": "indicator--528788ae-8417-431f-bd7c-7d0b92a70361",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.98.165.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:05:04.000Z",
      "valid_until": "2026-04-11T23:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T22:26:33.558Z",
      "x_nadsec_last_seen": "2026-03-15T15:27:01.348Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "200689"
      ],
      "x_nadsec_orgs": [
        "Teleimpianti Srl"
      ]
    },
    {
      "created": "2026-03-10T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MA; asn=30983; asn_org=Moroccan Academic Network",
      "id": "indicator--f9c98ef3-79f7-449e-99a1-3b6d2977a923",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.200.159.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:05:04.000Z",
      "valid_until": "2026-04-11T23:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T22:46:17.278Z",
      "x_nadsec_last_seen": "2026-03-10T22:46:17.278Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "30983"
      ],
      "x_nadsec_orgs": [
        "Moroccan Academic Network"
      ]
    },
    {
      "created": "2026-03-10T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--91088b24-1e1f-41b5-b005-a4c609df4ec9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-10T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.98.220.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:05:04.000Z",
      "valid_until": "2026-04-11T23:05:02.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-10T22:39:18.586Z",
      "x_nadsec_last_seen": "2026-03-15T00:17:00.636Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-11T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SG; asn=147181; asn_org=Flarezen Ltd.",
      "id": "indicator--5f198d84-0c1e-4750-9212-629de4a63067",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.191.50.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:05:03.000Z",
      "valid_until": "2026-04-12T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T23:44:19.161Z",
      "x_nadsec_last_seen": "2026-03-10T23:44:19.500Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "147181"
      ],
      "x_nadsec_orgs": [
        "Flarezen Ltd."
      ]
    },
    {
      "created": "2026-03-11T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--c44b28fc-7ce9-4dd5-a416-1d17d7dad3e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.234.46.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:05:03.000Z",
      "valid_until": "2026-04-12T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T23:13:05.786Z",
      "x_nadsec_last_seen": "2026-03-10T23:20:57.209Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-11T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d5c3bcd7-f81e-4d29-91e1-414829f0e695",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.22.1.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:05:03.000Z",
      "valid_until": "2026-04-12T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-10T23:44:34.997Z",
      "x_nadsec_last_seen": "2026-03-10T23:44:46.275Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--12f03950-dac7-4f2f-9aa4-967cf6da985a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:05:03.000Z",
      "valid_until": "2026-04-12T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T23:10:32.536Z",
      "x_nadsec_last_seen": "2026-03-10T23:10:32.536Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-11T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--91b4e12f-cfe9-45dd-a3fb-2f6e589c050d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:05:03.000Z",
      "valid_until": "2026-04-12T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-10T23:35:34.699Z",
      "x_nadsec_last_seen": "2026-03-11T13:36:59.859Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-11T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4f5fb166-0597-4e4a-a78d-df15481f5d40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.62.15.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:05:03.000Z",
      "valid_until": "2026-04-12T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T23:39:55.266Z",
      "x_nadsec_last_seen": "2026-03-10T23:39:55.266Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ec9bf603-c7e7-4c35-b058-331ca6732142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:05:03.000Z",
      "valid_until": "2026-04-12T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T23:33:04.951Z",
      "x_nadsec_last_seen": "2026-03-10T23:33:04.951Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-11T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f85b0e01-869f-4f8c-afac-b33da755847e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:05:03.000Z",
      "valid_until": "2026-04-12T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-10T23:33:05.305Z",
      "x_nadsec_last_seen": "2026-03-10T23:33:05.305Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-11T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CO; asn=18747; asn_org=IFX Corporation",
      "id": "indicator--d86b4e83-d8de-4c13-8dfb-fdb5ed4372d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.62.63.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:05:03.000Z",
      "valid_until": "2026-04-12T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T00:03:09.073Z",
      "x_nadsec_last_seen": "2026-03-11T00:07:06.219Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "18747"
      ],
      "x_nadsec_orgs": [
        "IFX Corporation"
      ]
    },
    {
      "created": "2026-03-11T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--8dbd38ec-ec01-49a6-b9d8-587a879d1211",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.165.127.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:05:03.000Z",
      "valid_until": "2026-04-12T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-10T23:55:50.542Z",
      "x_nadsec_last_seen": "2026-03-11T00:02:56.977Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-03-11T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f50ecfe9-0ee4-4743-9099-e04743e350f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '24.199.94.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:05:03.000Z",
      "valid_until": "2026-04-12T00:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T23:44:47.188Z",
      "x_nadsec_last_seen": "2026-03-11T01:46:09.307Z",
      "x_nadsec_ports": [
        "3306",
        "1433"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=CN; asn=134762; asn_org=CHINANET Liaoning province Dalian MAN network",
      "id": "indicator--e5ea6ef0-39f8-476e-a6ec-2ea2c90d47d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.46.195.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:05:03.000Z",
      "valid_until": "2026-04-12T00:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-10T23:23:13.739Z",
      "x_nadsec_last_seen": "2026-03-10T23:24:47.573Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "134762"
      ],
      "x_nadsec_orgs": [
        "CHINANET Liaoning province Dalian MAN network"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-03-11T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--db81c215-aa54-46a7-991f-e56e29be14b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:05:03.000Z",
      "valid_until": "2026-04-12T00:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-10T23:44:04.617Z",
      "x_nadsec_last_seen": "2026-03-27T13:29:34.658Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-11T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2d782603-ec2a-405e-b887-c56bdb3841b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:05:03.000Z",
      "valid_until": "2026-04-12T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T00:03:22.741Z",
      "x_nadsec_last_seen": "2026-03-11T00:03:22.741Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-11T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d88697a6-386c-4b06-bbf2-d3fb30847576",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T00:05:03.000Z",
      "valid_until": "2026-04-12T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T00:03:12.360Z",
      "x_nadsec_last_seen": "2026-03-21T00:04:12.719Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-11T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=138093; asn_org=PT. LINTASMAYA MULTI MEDIA",
      "id": "indicator--510f85d5-991b-42c1-ac79-53b88628c2a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.130.4.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:05:05.000Z",
      "valid_until": "2026-04-12T01:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T00:57:17.970Z",
      "x_nadsec_last_seen": "2026-03-11T00:59:24.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "138093"
      ],
      "x_nadsec_orgs": [
        "PT. LINTASMAYA MULTI MEDIA"
      ]
    },
    {
      "created": "2026-03-11T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45458; asn_org=SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "id": "indicator--a67d7928-b797-4471-8332-8b2ef3f6a909",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.49.8.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:05:05.000Z",
      "valid_until": "2026-04-12T01:05:02.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-11T00:32:40.152Z",
      "x_nadsec_last_seen": "2026-03-21T08:53:37.036Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45458"
      ],
      "x_nadsec_orgs": [
        "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX"
      ]
    },
    {
      "created": "2026-03-11T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=38841; asn_org=kbro CO. Ltd.",
      "id": "indicator--323e51fa-10dc-41eb-80d2-3cac97bf65a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.192.240.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:05:05.000Z",
      "valid_until": "2026-04-12T01:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T00:06:35.195Z",
      "x_nadsec_last_seen": "2026-03-11T00:13:09.349Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "38841"
      ],
      "x_nadsec_orgs": [
        "kbro CO. Ltd."
      ]
    },
    {
      "created": "2026-03-11T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=18734; asn_org=Operbes, S.A. de C.V.",
      "id": "indicator--4eb2e83a-c5c9-4b17-8503-76f2360b2982",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.204.171.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:05:05.000Z",
      "valid_until": "2026-04-12T01:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T00:49:16.671Z",
      "x_nadsec_last_seen": "2026-03-11T00:51:22.394Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "18734"
      ],
      "x_nadsec_orgs": [
        "Operbes, S.A. de C.V."
      ]
    },
    {
      "created": "2026-03-11T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=18734; asn_org=Operbes, S.A. de C.V.",
      "id": "indicator--26ce1d67-6932-41d6-bccf-4fab64204a05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.148.20.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:05:05.000Z",
      "valid_until": "2026-04-12T01:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T01:01:50.038Z",
      "x_nadsec_last_seen": "2026-03-11T01:01:50.211Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "18734"
      ],
      "x_nadsec_orgs": [
        "Operbes, S.A. de C.V."
      ]
    },
    {
      "created": "2026-03-11T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1b9e5462-4ce4-4f75-944b-070e719ceda3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:05:05.000Z",
      "valid_until": "2026-04-12T01:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T00:07:28.041Z",
      "x_nadsec_last_seen": "2026-03-30T22:16:45.670Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-11T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--805e7329-8c11-45b3-b1a7-58ee9cbc915f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.90.108.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:05:05.000Z",
      "valid_until": "2026-04-12T01:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T00:53:25.434Z",
      "x_nadsec_last_seen": "2026-03-12T00:55:21.387Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-11T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--d9407394-65b3-4c19-96c7-5abcc5b0afc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.65.183.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:05:05.000Z",
      "valid_until": "2026-04-12T01:05:02.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-03-11T00:15:17.578Z",
      "x_nadsec_last_seen": "2026-03-11T00:19:03.054Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-11T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--9ccef0b1-bd2d-4c92-9137-7b3fecb1866d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:05:05.000Z",
      "valid_until": "2026-04-12T01:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T00:33:34.095Z",
      "x_nadsec_last_seen": "2026-03-11T00:33:34.353Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-03-11T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--57ab1f7a-55ab-4ab9-98f8-e74e0a090047",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:05:05.000Z",
      "valid_until": "2026-04-12T01:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T01:01:50.725Z",
      "x_nadsec_last_seen": "2026-03-11T01:01:50.725Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-11T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--490fc743-3048-415d-ab42-09fb19b38b32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:05:05.000Z",
      "valid_until": "2026-04-12T01:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T01:01:40.438Z",
      "x_nadsec_last_seen": "2026-03-11T01:01:40.438Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-11T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=138109; asn_org=PT. Rasi Bintang Perkasa",
      "id": "indicator--d777950c-0048-49fe-bbd3-caaef1800054",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.126.87.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:05:03.000Z",
      "valid_until": "2026-04-12T02:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T01:14:50.571Z",
      "x_nadsec_last_seen": "2026-03-11T01:16:56.139Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "138109"
      ],
      "x_nadsec_orgs": [
        "PT. Rasi Bintang Perkasa"
      ]
    },
    {
      "created": "2026-03-11T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--749d72ad-d6a6-4067-899d-c8508921e4d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.100.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:05:03.000Z",
      "valid_until": "2026-04-12T02:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T01:29:43.612Z",
      "x_nadsec_last_seen": "2026-03-11T01:29:43.612Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d8264224-a1ea-4b80-abf0-aae412a98616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.71.230.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:05:03.000Z",
      "valid_until": "2026-04-12T02:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T01:33:37.213Z",
      "x_nadsec_last_seen": "2026-03-11T01:33:37.213Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--525c6299-8bcf-4dc0-a444-65e8a615df23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.224.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:05:03.000Z",
      "valid_until": "2026-04-12T02:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T01:46:08.228Z",
      "x_nadsec_last_seen": "2026-03-11T01:46:08.228Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8dbac943-1b72-433d-95de-6e8f422f1a5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:05:03.000Z",
      "valid_until": "2026-04-12T02:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T01:32:40.972Z",
      "x_nadsec_last_seen": "2026-03-11T01:32:51.139Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-11T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--c2daf7d3-664a-43c3-8b0f-58c50edf0314",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.216.156.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:05:03.000Z",
      "valid_until": "2026-04-12T02:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T01:08:30.733Z",
      "x_nadsec_last_seen": "2026-03-28T15:01:10.079Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-11T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--26031dd6-fa3b-4b3b-a078-293ece295ebe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.151.167.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:05:03.000Z",
      "valid_until": "2026-04-12T02:05:02.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-11T01:24:39.503Z",
      "x_nadsec_last_seen": "2026-03-11T03:16:27.183Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-11T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--1cd09269-898b-40fa-9c69-9e34bebb864d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.164.19.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:05:03.000Z",
      "valid_until": "2026-04-12T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T02:49:38.168Z",
      "x_nadsec_last_seen": "2026-03-11T02:49:44.521Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-11T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--7c06932e-0038-4043-a3cb-d63cee8ea502",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.108.43.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:05:03.000Z",
      "valid_until": "2026-04-12T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T03:02:35.213Z",
      "x_nadsec_last_seen": "2026-03-11T03:09:06.479Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-11T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ed1e9dc8-900c-47a0-b760-3cad1e18f23c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.243.198.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:05:03.000Z",
      "valid_until": "2026-04-12T03:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-11T02:52:20.498Z",
      "x_nadsec_last_seen": "2026-03-11T03:08:34.808Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--124fc5b8-d790-48dd-a521-e7d91b6ba35c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.71.58.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:05:03.000Z",
      "valid_until": "2026-04-12T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T02:19:12.792Z",
      "x_nadsec_last_seen": "2026-03-11T02:22:18.071Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-11T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=11232; asn_org=Midcontinent Communications",
      "id": "indicator--0e023db2-402a-4ee3-9387-e6fa63dfa56f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '24.124.41.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:05:03.000Z",
      "valid_until": "2026-04-12T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T02:16:40.134Z",
      "x_nadsec_last_seen": "2026-03-11T02:18:45.253Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11232"
      ],
      "x_nadsec_orgs": [
        "Midcontinent Communications"
      ]
    },
    {
      "created": "2026-03-11T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--3e348ae2-cdd7-4c11-864f-88442c815d6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.53.162.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:05:03.000Z",
      "valid_until": "2026-04-12T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T02:50:23.578Z",
      "x_nadsec_last_seen": "2026-03-11T02:50:23.578Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-11T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--ecce6e9d-a116-4bc8-b01d-6b651319d161",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.239.145.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:05:03.000Z",
      "valid_until": "2026-04-12T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T03:01:59.354Z",
      "x_nadsec_last_seen": "2026-03-11T03:04:05.700Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-11T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GR; asn=3329; asn_org=Vodafone-panafon Hellenic Telecommunications Company SA",
      "id": "indicator--6e9f13f6-6845-483b-9340-2a206c8d7279",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.74.143.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:05:03.000Z",
      "valid_until": "2026-04-12T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T02:05:06.565Z",
      "x_nadsec_last_seen": "2026-03-11T02:07:12.975Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GR"
      ],
      "x_nadsec_asns": [
        "3329"
      ],
      "x_nadsec_orgs": [
        "Vodafone-panafon Hellenic Telecommunications Company SA"
      ]
    },
    {
      "created": "2026-03-11T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c73e8381-1b10-4bed-bc94-333646ecb29a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.229.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:05:03.000Z",
      "valid_until": "2026-04-12T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T03:56:01.294Z",
      "x_nadsec_last_seen": "2026-03-11T03:58:05.847Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--cf43a14d-95e3-4f29-bd96-2a623da1f91a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.234.129.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:05:03.000Z",
      "valid_until": "2026-04-12T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T03:56:01.545Z",
      "x_nadsec_last_seen": "2026-03-11T03:58:07.149Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-11T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--8942b857-f684-433f-9a46-daf182b012b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.191.58.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:05:03.000Z",
      "valid_until": "2026-04-12T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T03:11:53.665Z",
      "x_nadsec_last_seen": "2026-03-11T03:14:00.350Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--408ae202-829b-4b88-9c0d-c4501cd37453",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.6.138.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:05:03.000Z",
      "valid_until": "2026-04-12T04:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T03:50:43.905Z",
      "x_nadsec_last_seen": "2026-03-11T03:57:14.968Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-11T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=10139; asn_org=Smart Broadband, Inc.",
      "id": "indicator--282d8010-13d3-48b3-8bd1-8c56c78e227d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '175.176.45.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:05:03.000Z",
      "valid_until": "2026-04-12T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T03:31:44.159Z",
      "x_nadsec_last_seen": "2026-03-11T03:33:48.912Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "10139"
      ],
      "x_nadsec_orgs": [
        "Smart Broadband, Inc."
      ]
    },
    {
      "created": "2026-03-11T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=208413; asn_org=RubyNet LLC",
      "id": "indicator--5f300c2f-bf26-483a-9815-7708b47bbf96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.138.204.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:05:03.000Z",
      "valid_until": "2026-04-12T04:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T03:14:56.646Z",
      "x_nadsec_last_seen": "2026-03-11T03:16:27.873Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "208413"
      ],
      "x_nadsec_orgs": [
        "RubyNet LLC"
      ]
    },
    {
      "created": "2026-03-11T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--261385cd-f14e-4277-b19a-fd20659adf8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.17.213.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:05:03.000Z",
      "valid_until": "2026-04-12T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T03:37:16.749Z",
      "x_nadsec_last_seen": "2026-03-11T03:43:08.270Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-11T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--72cef475-3686-44ad-a870-d1e60c5b097c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.202.19.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:05:03.000Z",
      "valid_until": "2026-04-12T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T03:50:48.214Z",
      "x_nadsec_last_seen": "2026-03-11T03:50:48.489Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-11T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--a913cfa1-c87c-4cb9-8c86-2424f2230167",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.68.184.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:05:03.000Z",
      "valid_until": "2026-04-12T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T03:39:45.360Z",
      "x_nadsec_last_seen": "2026-03-11T03:41:50.773Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-11T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--95ca544e-7e03-4da3-a549-326c95b2096b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '72.85.159.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:05:03.000Z",
      "valid_until": "2026-04-12T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T03:55:41.832Z",
      "x_nadsec_last_seen": "2026-03-11T03:57:47.069Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-03-11T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=134877; asn_org=Sri Vari Network Private Limited",
      "id": "indicator--1a5c7b7f-7b5f-4a82-8e8b-2e62da2791a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.110.236.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:05:03.000Z",
      "valid_until": "2026-04-12T05:05:02.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-03-11T04:57:56.288Z",
      "x_nadsec_last_seen": "2026-03-31T20:25:49.695Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134877"
      ],
      "x_nadsec_orgs": [
        "Sri Vari Network Private Limited"
      ]
    },
    {
      "created": "2026-03-11T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--0ae7d10f-e03b-48ff-a55d-247656dc79da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.195.12.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:05:03.000Z",
      "valid_until": "2026-04-12T05:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T04:40:21.187Z",
      "x_nadsec_last_seen": "2026-03-11T08:14:41.042Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-03-11T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--978dbe1c-f298-4762-b348-58869170b844",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.97.185.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:05:03.000Z",
      "valid_until": "2026-04-12T05:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T04:09:36.641Z",
      "x_nadsec_last_seen": "2026-03-11T04:11:42.419Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-03-11T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--b0efbe83-00e0-4eec-b8a8-5c645337e907",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.88.164.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:05:03.000Z",
      "valid_until": "2026-04-12T05:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T04:18:39.116Z",
      "x_nadsec_last_seen": "2026-03-11T04:20:44.052Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-03-11T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--a986bbfa-a5d7-4e06-9475-2f1e1542fa88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.235.123.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:05:03.000Z",
      "valid_until": "2026-04-12T05:05:02.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-03-11T04:33:03.662Z",
      "x_nadsec_last_seen": "2026-03-19T18:59:01.104Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-11T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited; user(top)=**",
      "id": "indicator--8e7535d8-c752-4baf-acdd-a978d3db3864",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.176.89.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:05:03.000Z",
      "valid_until": "2026-04-12T05:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T04:22:46.967Z",
      "x_nadsec_last_seen": "2026-03-14T05:40:26.720Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-11T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--81751946-f124-45d0-8e5f-467f5169b905",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.19.74.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:05:03.000Z",
      "valid_until": "2026-04-12T05:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T04:55:19.361Z",
      "x_nadsec_last_seen": "2026-03-11T04:57:26.034Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-11T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NO; asn=2116; asn_org=Globalconnect As",
      "id": "indicator--8d346e45-5590-4513-8973-96d3b09d36c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.118.56.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:05:03.000Z",
      "valid_until": "2026-04-12T05:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T04:54:59.159Z",
      "x_nadsec_last_seen": "2026-03-11T04:57:06.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NO"
      ],
      "x_nadsec_asns": [
        "2116"
      ],
      "x_nadsec_orgs": [
        "Globalconnect As"
      ]
    },
    {
      "created": "2026-03-11T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a0721c6f-4b58-4d91-995c-dfa009ff5c65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.126.115.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:05:03.000Z",
      "valid_until": "2026-04-12T05:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T04:39:19.032Z",
      "x_nadsec_last_seen": "2026-03-11T04:47:27.726Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-11T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=48441; asn_org=MagLAN LLC",
      "id": "indicator--0fc4ee3a-5347-4020-8fe7-37bea9ed32b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.247.63.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T05:05:03.000Z",
      "valid_until": "2026-04-12T05:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T04:50:03.815Z",
      "x_nadsec_last_seen": "2026-03-11T04:58:47.895Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48441"
      ],
      "x_nadsec_orgs": [
        "MagLAN LLC"
      ]
    },
    {
      "created": "2026-03-11T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--ed5d2a42-8b60-488d-8c56-73a09ac5e601",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.54.173.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:05:03.000Z",
      "valid_until": "2026-04-12T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T05:25:57.657Z",
      "x_nadsec_last_seen": "2026-03-11T05:32:56.834Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-11T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--625961f7-b92e-4860-8b39-04677511eb45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.236.79.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:05:03.000Z",
      "valid_until": "2026-04-12T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T05:44:13.033Z",
      "x_nadsec_last_seen": "2026-03-11T05:51:26.021Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-11T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--198d28a9-083b-4e65-81ff-87104afd1d4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.197.181.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:05:03.000Z",
      "valid_until": "2026-04-12T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T05:39:36.400Z",
      "x_nadsec_last_seen": "2026-03-11T05:46:46.407Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-11T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TN; asn=37671; asn_org=GLOBALNET-AS",
      "id": "indicator--a506b1d9-df4a-4952-be20-a3928d7d3c29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.15.108.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:05:03.000Z",
      "valid_until": "2026-04-12T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T06:03:42.765Z",
      "x_nadsec_last_seen": "2026-03-11T06:05:49.929Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37671"
      ],
      "x_nadsec_orgs": [
        "GLOBALNET-AS"
      ]
    },
    {
      "created": "2026-03-11T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2dcc92cf-8db4-4323-9e91-a1b04f9f30a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.49.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:05:03.000Z",
      "valid_until": "2026-04-12T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T05:09:52.089Z",
      "x_nadsec_last_seen": "2026-03-11T05:09:52.089Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-11T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--fdd5acfb-46ad-49d8-a97e-2cb61f411201",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.11.230.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:05:03.000Z",
      "valid_until": "2026-04-12T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T05:45:59.504Z",
      "x_nadsec_last_seen": "2026-03-11T05:48:05.841Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-03-11T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NP; asn=4007; asn_org=Subisu Cablenet Pvt Ltd, Baluwatar, Kathmandu, Nepal",
      "id": "indicator--84581add-349a-42a3-95b1-dfea7c244065",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.51.92.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:05:03.000Z",
      "valid_until": "2026-04-12T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T05:53:35.042Z",
      "x_nadsec_last_seen": "2026-03-11T05:55:41.334Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "4007"
      ],
      "x_nadsec_orgs": [
        "Subisu Cablenet Pvt Ltd, Baluwatar, Kathmandu, Nepal"
      ]
    },
    {
      "created": "2026-03-11T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c6737dee-e112-4c44-b89a-2eaf26037a55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.117.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:05:03.000Z",
      "valid_until": "2026-04-12T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T05:51:56.683Z",
      "x_nadsec_last_seen": "2026-03-11T05:51:56.683Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--2ad2c8cb-c82c-4b60-8bb6-929a0967c9fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.249.63.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T06:27:09.223Z",
      "x_nadsec_last_seen": "2026-03-11T06:27:09.223Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=151858; asn_org=INTERDIGI JOINT STOCK COMPANY",
      "id": "indicator--d3430560-7773-4bf2-88fa-435015e5161e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.75.180.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T06:16:25.948Z",
      "x_nadsec_last_seen": "2026-03-28T07:04:21.740Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "151858"
      ],
      "x_nadsec_orgs": [
        "INTERDIGI JOINT STOCK COMPANY"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=55990; asn_org=Huawei Cloud Service data center; user(top)=**; pass(top)=***",
      "id": "indicator--e758931b-682a-415f-9b99-9a480b1339f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.45.48.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T06:11:53.742Z",
      "x_nadsec_last_seen": "2026-03-11T06:11:53.742Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "55990"
      ],
      "x_nadsec_orgs": [
        "Huawei Cloud Service data center"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "***"
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--657eca16-6639-4c8e-b975-75e7b99d6672",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.70.120.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T06:51:50.217Z",
      "x_nadsec_last_seen": "2026-03-11T06:53:56.721Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--8ab10c14-acf7-4666-810c-ebdaaa2dcfe0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.24.21.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T06:14:37.202Z",
      "x_nadsec_last_seen": "2026-03-11T06:16:41.920Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d4d3ae78-4951-4aef-b899-2ff38e89edcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.90.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T06:18:04.141Z",
      "x_nadsec_last_seen": "2026-03-11T06:18:49.812Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e2c86d63-acca-4e7e-98b8-fac997d93e7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.227.153.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T06:35:54.453Z",
      "x_nadsec_last_seen": "2026-03-11T06:35:54.453Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--8a2db97e-f27d-4032-8da4-d9628ee882c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.232.77.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T06:35:41.812Z",
      "x_nadsec_last_seen": "2026-03-11T06:35:53.518Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=43274; asn_org=Teleradiocompany Teleos-1 Ltd",
      "id": "indicator--24a4ec93-603c-4de7-b4b3-f4833e54ca1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.114.188.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T06:31:13.752Z",
      "x_nadsec_last_seen": "2026-03-11T06:33:21.090Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "43274"
      ],
      "x_nadsec_orgs": [
        "Teleradiocompany Teleos-1 Ltd"
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--fa3ea4c4-7b07-4ce9-a073-f7c617a64903",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T06:46:52.133Z",
      "x_nadsec_last_seen": "2026-03-11T06:46:52.133Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--b64049c1-182d-42a4-9c08-92782c077293",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-11T06:08:28.452Z",
      "x_nadsec_last_seen": "2026-03-25T01:48:45.431Z",
      "x_nadsec_ports": [
        "81",
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "httpd",
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--626ac04a-a1d7-4f0c-9e4a-72af6f722cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.48.203.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-11T06:51:20.876Z",
      "x_nadsec_last_seen": "2026-03-14T14:19:02.347Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--aecd1c37-ab8e-4504-ab8c-eed9446eb382",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T06:13:46.923Z",
      "x_nadsec_last_seen": "2026-03-17T03:02:12.339Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=17621; asn_org=China Unicom Shanghai network",
      "id": "indicator--714321b6-6e33-49a8-95b1-1c5427af0eaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.166.22.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T06:26:48.952Z",
      "x_nadsec_last_seen": "2026-03-11T06:26:48.952Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "17621"
      ],
      "x_nadsec_orgs": [
        "China Unicom Shanghai network"
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--1637bc50-e212-43b6-aa31-888397d1f351",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T06:47:43.240Z",
      "x_nadsec_last_seen": "2026-03-11T06:47:43.240Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--add5fb33-0e99-4954-81d8-a2b4bd48c993",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T06:47:32.836Z",
      "x_nadsec_last_seen": "2026-03-11T06:47:32.836Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-11T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--dad0579f-d126-4f8a-8a77-3242ad547269",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T07:05:02.000Z",
      "valid_until": "2026-04-12T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T06:47:09.429Z",
      "x_nadsec_last_seen": "2026-03-11T06:47:09.850Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--95158ebb-87bc-4501-8ec2-b5274d624a5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.180.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T07:10:23.867Z",
      "x_nadsec_last_seen": "2026-03-11T07:12:28.637Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--4936fdb9-e455-4e2b-99b4-0d5b8caf6181",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.232.96.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T07:23:23.611Z",
      "x_nadsec_last_seen": "2026-03-11T07:27:08.366Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45536; asn_org=Readylink Internet Services Limited",
      "id": "indicator--f79e0a28-f34c-4639-8847-a896509ffb10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.255.248.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-11T07:14:04.912Z",
      "x_nadsec_last_seen": "2026-03-22T22:04:25.298Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45536"
      ],
      "x_nadsec_orgs": [
        "Readylink Internet Services Limited"
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--87442ccc-622a-4323-9209-da7b57dc9ee0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.59.231.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T07:16:28.024Z",
      "x_nadsec_last_seen": "2026-03-11T07:41:55.917Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6cd21bd5-4d51-4c4e-bc14-d7f9e2cab4bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.191.41.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T07:19:31.421Z",
      "x_nadsec_last_seen": "2026-03-11T07:21:36.176Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fb9fc491-11cb-4e35-96a8-010050d61c2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.71.45.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T07:13:46.125Z",
      "x_nadsec_last_seen": "2026-03-11T07:13:46.125Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--cbb1ab03-3e1e-4fcc-b9be-aae1634bb550",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.6.9.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T08:00:14.790Z",
      "x_nadsec_last_seen": "2026-03-11T08:02:19.189Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=UA; asn=13188; asn_org=Content Delivery Network Ltd; user(top)=**",
      "id": "indicator--4c06cf14-8da9-4781-a14e-b2c2b98cc2e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.151.142.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T08:02:53.017Z",
      "x_nadsec_last_seen": "2026-03-11T08:02:54.243Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "13188"
      ],
      "x_nadsec_orgs": [
        "Content Delivery Network Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--5d30d105-310a-4cdf-ae2d-3df22a70a853",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.178.80.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T07:30:34.694Z",
      "x_nadsec_last_seen": "2026-03-11T07:32:41.723Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=43321; asn_org=Satelcom-Service Ltd.",
      "id": "indicator--60a44f2a-414e-454c-8d0c-a62d479fa67f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.149.196.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T07:15:54.675Z",
      "x_nadsec_last_seen": "2026-03-11T07:15:55.007Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "43321"
      ],
      "x_nadsec_orgs": [
        "Satelcom-Service Ltd."
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--b2238cf4-5e78-40c4-98c1-4f0434b730e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.189.58.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-11T07:31:25.572Z",
      "x_nadsec_last_seen": "2026-03-15T07:27:23.363Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--db713fa9-f38f-49db-a1f0-10be71522e52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.105.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T07:37:31.164Z",
      "x_nadsec_last_seen": "2026-03-11T07:37:31.164Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=39232; asn_org=Uninet LLC",
      "id": "indicator--25da4489-8add-4376-937b-e255d8c71830",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.25.30.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T07:13:46.665Z",
      "x_nadsec_last_seen": "2026-03-11T07:15:54.008Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "39232"
      ],
      "x_nadsec_orgs": [
        "Uninet LLC"
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--922ab6c7-d977-46b8-8716-613a8d2ac6e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.65.90.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T07:07:52.724Z",
      "x_nadsec_last_seen": "2026-03-11T07:07:52.953Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=55423; asn_org=JasTel Network",
      "id": "indicator--7a810400-3a29-4991-913f-ab5f6df2f942",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.82.133.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T07:20:06.347Z",
      "x_nadsec_last_seen": "2026-03-11T07:20:06.347Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "55423"
      ],
      "x_nadsec_orgs": [
        "JasTel Network"
      ]
    },
    {
      "created": "2026-03-11T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--5d9f34a8-c784-489d-9695-7de1b4f02102",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T08:05:04.000Z",
      "valid_until": "2026-04-12T08:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T07:50:45.285Z",
      "x_nadsec_last_seen": "2026-03-12T12:45:21.775Z",
      "x_nadsec_ports": [
        "445",
        "81"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--6cfb3a0a-53a1-499d-b779-8a76da597ac2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.98.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T08:52:05.182Z",
      "x_nadsec_last_seen": "2026-03-11T08:54:13.883Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=150008; asn_org=Pioneer Elabs Ltd.",
      "id": "indicator--890999a2-0bde-4ab0-8075-59162c47e123",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.236.193.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T08:15:27.132Z",
      "x_nadsec_last_seen": "2026-03-11T08:15:27.132Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "150008"
      ],
      "x_nadsec_orgs": [
        "Pioneer Elabs Ltd."
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--dfe23c38-cb56-42bc-ba7b-484a79fbb50d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.18.207.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T08:14:15.967Z",
      "x_nadsec_last_seen": "2026-03-11T08:16:20.836Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--41c0762c-cabe-481a-8156-316f3cef8374",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.25.83.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T08:39:45.715Z",
      "x_nadsec_last_seen": "2026-03-11T08:39:50.748Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--23d05474-5ca2-49c0-9b3b-9d3a0f24f2ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.209.86.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T08:20:54.305Z",
      "x_nadsec_last_seen": "2026-03-11T08:20:54.305Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b01b8994-66d8-4c5b-ac07-ec2353a935cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.163.22.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T08:11:21.174Z",
      "x_nadsec_last_seen": "2026-03-11T08:13:25.156Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6e40000f-b2bf-48da-ad35-35e52cbba35e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.65.229.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T08:11:30.448Z",
      "x_nadsec_last_seen": "2026-03-11T09:43:38.738Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--1861f74f-9487-46e3-b18d-99e2440cb955",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T08:32:09.153Z",
      "x_nadsec_last_seen": "2026-03-11T08:32:09.427Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--50fa8c54-6196-4e46-8e79-dc8f7a168a37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.228.164.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T08:39:16.341Z",
      "x_nadsec_last_seen": "2026-03-11T08:46:38.051Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--53f9a07b-dba2-4595-963a-22c1b8db0e24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T09:03:26.223Z",
      "x_nadsec_last_seen": "2026-03-11T09:03:26.223Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=11432; asn_org=Telium Telecomunicacoes Ltda",
      "id": "indicator--0836008b-d448-489a-a54b-e668bedda1f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.170.249.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-11T08:23:10.797Z",
      "x_nadsec_last_seen": "2026-03-31T10:26:17.389Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "11432"
      ],
      "x_nadsec_orgs": [
        "Telium Telecomunicacoes Ltda"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--976ed7fb-565b-4a36-be45-ccddbe4eff22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.210.71.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-11T08:51:07.824Z",
      "x_nadsec_last_seen": "2026-03-15T11:30:42.102Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--ddf61c6a-6a51-432a-9d72-4013f306075e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.130.84.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-11T08:51:13.442Z",
      "x_nadsec_last_seen": "2026-03-21T04:01:53.875Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--709e0d1b-dcd4-4f31-b767-f85f260754e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.48.83.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T08:47:38.757Z",
      "x_nadsec_last_seen": "2026-03-11T08:47:39.030Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--db7007bf-9549-4101-9a40-ba53fa1985d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T08:10:19.712Z",
      "x_nadsec_last_seen": "2026-03-11T08:10:20.030Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--ee2de3a3-2a4c-4d89-bb39-b2d05fac3195",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.33.190.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T09:00:20.480Z",
      "x_nadsec_last_seen": "2026-03-11T09:01:09.994Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-11T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--481aee3d-98f4-41eb-99a8-ddab3bb22e3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.74.4.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T09:05:02.000Z",
      "valid_until": "2026-04-12T09:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T08:54:06.480Z",
      "x_nadsec_last_seen": "2026-03-11T08:54:30.244Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-11T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=CN; asn=4808; asn_org=China Unicom Beijing Province Network; user(top)=**",
      "id": "indicator--cf96931b-1133-45ab-9109-bf10507122e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.242.42.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:05:02.000Z",
      "valid_until": "2026-04-12T10:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-11T09:10:36.340Z",
      "x_nadsec_last_seen": "2026-03-11T09:12:40.760Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4808"
      ],
      "x_nadsec_orgs": [
        "China Unicom Beijing Province Network"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-11T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--6cdef90f-9f8b-48f9-8b44-70b9d82bc2cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.250.172.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:05:02.000Z",
      "valid_until": "2026-04-12T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T09:27:35.278Z",
      "x_nadsec_last_seen": "2026-03-11T09:34:04.910Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-11T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--79f2653f-4f0f-4ff7-8238-a184b6b65a73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.163.39.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:05:02.000Z",
      "valid_until": "2026-04-12T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T10:04:39.109Z",
      "x_nadsec_last_seen": "2026-03-11T10:06:45.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-11T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--e65f4b0d-25f0-4934-a05f-61ef5551144e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.255.20.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:05:02.000Z",
      "valid_until": "2026-04-12T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T09:59:04.622Z",
      "x_nadsec_last_seen": "2026-03-11T10:01:11.521Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-11T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=140475; asn_org=PT Citra Celebas Multimedia",
      "id": "indicator--a160ec3c-1106-452a-8ec5-f6113b24eb96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.230.20.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:05:02.000Z",
      "valid_until": "2026-04-12T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T09:49:44.625Z",
      "x_nadsec_last_seen": "2026-03-11T09:57:47.271Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "140475"
      ],
      "x_nadsec_orgs": [
        "PT Citra Celebas Multimedia"
      ]
    },
    {
      "created": "2026-03-11T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d8644a6a-5279-4927-8b52-66fe0c083ac0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.223.112.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:05:02.000Z",
      "valid_until": "2026-04-12T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T09:43:31.057Z",
      "x_nadsec_last_seen": "2026-03-11T09:43:31.057Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1cd12ab1-5af5-4775-9c43-09dd8a95a5cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.242.157.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:05:02.000Z",
      "valid_until": "2026-04-12T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T09:12:02.145Z",
      "x_nadsec_last_seen": "2026-03-11T09:18:31.979Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-11T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--2a1b6318-1d31-4355-8d12-1959b9c51f79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.219.0.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:05:02.000Z",
      "valid_until": "2026-04-12T10:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-11T09:42:05.030Z",
      "x_nadsec_last_seen": "2026-03-30T19:12:29.548Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-11T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--39c8d329-0745-4e30-931a-a0b21d57c969",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:05:02.000Z",
      "valid_until": "2026-04-12T10:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T09:52:48.493Z",
      "x_nadsec_last_seen": "2026-03-30T03:48:49.748Z",
      "x_nadsec_ports": [
        "1723",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-11T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--61a5989a-32c5-4085-a1bc-a594c37b52ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:05:02.000Z",
      "valid_until": "2026-04-12T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T09:26:27.121Z",
      "x_nadsec_last_seen": "2026-03-11T09:26:27.121Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-11T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d8e9165b-5736-4aac-ac9a-66e94afc6ac0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.210.157.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:05:02.000Z",
      "valid_until": "2026-04-12T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T09:36:38.002Z",
      "x_nadsec_last_seen": "2026-03-11T09:36:43.016Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--e479a962-6e02-4b74-b560-0b665b0baf4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.145.92.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:05:02.000Z",
      "valid_until": "2026-04-12T10:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T09:07:16.940Z",
      "x_nadsec_last_seen": "2026-03-11T09:07:50.054Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-11T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MK; asn=6821; asn_org=Makedonski Telekom AD-Skopje",
      "id": "indicator--f0a28f38-82ec-4fc6-b2b1-507258847046",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.28.190.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:05:02.000Z",
      "valid_until": "2026-04-12T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T09:23:19.871Z",
      "x_nadsec_last_seen": "2026-03-11T09:25:26.260Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MK"
      ],
      "x_nadsec_asns": [
        "6821"
      ],
      "x_nadsec_orgs": [
        "Makedonski Telekom AD-Skopje"
      ]
    },
    {
      "created": "2026-03-11T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--7bb5d84c-1c95-4ae5-93ec-5041f5c12abe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.91.93.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:05:02.000Z",
      "valid_until": "2026-04-12T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T10:47:48.101Z",
      "x_nadsec_last_seen": "2026-03-11T10:50:14.708Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-11T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134299; asn_org=Gstech Software Systems Pvt Ltd",
      "id": "indicator--a2c2ed99-ef08-4c2d-9c31-3b7db6a5c973",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.143.51.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:05:02.000Z",
      "valid_until": "2026-04-12T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T10:47:39.450Z",
      "x_nadsec_last_seen": "2026-03-11T10:49:45.144Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134299"
      ],
      "x_nadsec_orgs": [
        "Gstech Software Systems Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-11T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c2cda5a4-c71b-432d-98d6-837af0c6b684",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.174.171.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:05:02.000Z",
      "valid_until": "2026-04-12T11:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-11T10:51:43.525Z",
      "x_nadsec_last_seen": "2026-03-11T11:52:57.828Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--d3315be6-4dbb-4ad8-9bae-0b36298efcbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.168.173.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:05:02.000Z",
      "valid_until": "2026-04-12T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T10:12:46.898Z",
      "x_nadsec_last_seen": "2026-03-11T10:14:51.509Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-11T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--1c1f9635-d716-4c2a-8cf9-4eacba2ad388",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.211.53.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:05:02.000Z",
      "valid_until": "2026-04-12T11:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T10:50:27.244Z",
      "x_nadsec_last_seen": "2026-03-16T07:21:34.336Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-11T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--ca7394e3-945a-4b08-90be-387578de9e85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.242.174.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:05:02.000Z",
      "valid_until": "2026-04-12T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T10:49:29.188Z",
      "x_nadsec_last_seen": "2026-03-11T10:51:35.388Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-11T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=141834; asn_org=Neolog Online Services Private Limited",
      "id": "indicator--c9d1b60f-29d4-4a5c-9389-45f581656f95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.101.134.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:05:02.000Z",
      "valid_until": "2026-04-12T11:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T10:20:04.406Z",
      "x_nadsec_last_seen": "2026-03-11T10:20:29.657Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141834"
      ],
      "x_nadsec_orgs": [
        "Neolog Online Services Private Limited"
      ]
    },
    {
      "created": "2026-03-11T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1138; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--8490c861-8136-4aba-909d-442afa97b4d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.202.44.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:05:02.000Z",
      "valid_until": "2026-04-12T11:05:01.000Z",
      "x_nadsec_event_count": 3151,
      "x_nadsec_first_seen": "2026-03-11T10:40:37.759Z",
      "x_nadsec_last_seen": "2026-03-11T11:40:03.640Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-11T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--04874bdc-25d2-4696-abea-1cd3c647c6b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:05:02.000Z",
      "valid_until": "2026-04-12T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T10:57:03.374Z",
      "x_nadsec_last_seen": "2026-03-11T10:57:03.374Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-11T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--cf376c66-5478-40a4-a421-1e5dbfe51fff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.160.168.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:05:02.000Z",
      "valid_until": "2026-04-12T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T10:30:21.894Z",
      "x_nadsec_last_seen": "2026-03-11T10:32:27.642Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-03-11T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--324f513a-6b00-4c1a-894c-c21174ffed0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.62.151.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:05:02.000Z",
      "valid_until": "2026-04-12T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T10:50:26.620Z",
      "x_nadsec_last_seen": "2026-03-11T10:50:26.620Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-11T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=31208; asn_org=PJSC MegaFon",
      "id": "indicator--c0cdcaa6-d7c3-4470-b869-ed1269f02db0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.28.186.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:05:02.000Z",
      "valid_until": "2026-04-12T11:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T10:51:23.601Z",
      "x_nadsec_last_seen": "2026-03-11T10:52:37.549Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31208"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-11T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e3608d66-f07b-403b-aa7c-ec18f61f39cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.106.5.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:05:02.000Z",
      "valid_until": "2026-04-12T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T10:47:53.791Z",
      "x_nadsec_last_seen": "2026-03-11T10:48:00.464Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-11T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=134841; asn_org=Rana Javed Kabir ta Interpid Broadband Communication Company Ltd.",
      "id": "indicator--325af008-451e-4f76-a730-8fb3b012b2ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.203.92.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:05:03.000Z",
      "valid_until": "2026-04-12T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T11:11:10.076Z",
      "x_nadsec_last_seen": "2026-03-11T11:13:14.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "134841"
      ],
      "x_nadsec_orgs": [
        "Rana Javed Kabir ta Interpid Broadband Communication Company Ltd."
      ]
    },
    {
      "created": "2026-03-11T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135777; asn_org=Shreenortheast Connect And Services Pvt Ltd",
      "id": "indicator--344dd4b7-c1ac-4c36-80c7-96982966e346",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.68.52.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:05:03.000Z",
      "valid_until": "2026-04-12T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T11:38:00.692Z",
      "x_nadsec_last_seen": "2026-03-11T11:40:05.700Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135777"
      ],
      "x_nadsec_orgs": [
        "Shreenortheast Connect And Services Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-11T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RS; asn=15958; asn_org=CETIN Ltd. Belgrade",
      "id": "indicator--9271933b-b039-4fe7-8d49-7709d5c2dd7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.106.238.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:05:03.000Z",
      "valid_until": "2026-04-12T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T11:55:46.277Z",
      "x_nadsec_last_seen": "2026-03-11T11:57:53.070Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "15958"
      ],
      "x_nadsec_orgs": [
        "CETIN Ltd. Belgrade"
      ]
    },
    {
      "created": "2026-03-11T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e8032cb7-eeea-4fd5-bba2-21cc9403d0d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.40.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:05:03.000Z",
      "valid_until": "2026-04-12T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T11:10:41.933Z",
      "x_nadsec_last_seen": "2026-03-11T11:12:48.209Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--e64bd98a-7664-402e-bf08-fb2aaea85f1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.148.122.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:05:03.000Z",
      "valid_until": "2026-04-12T12:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T11:57:20.147Z",
      "x_nadsec_last_seen": "2026-03-25T02:15:27.021Z",
      "x_nadsec_ports": [
        "3306",
        "445"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-11T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BE; asn=5432; asn_org=Proximus NV",
      "id": "indicator--84a47eda-ac42-4ce6-9f71-27af7bef8e47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.78.185.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:05:03.000Z",
      "valid_until": "2026-04-12T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T11:46:08.526Z",
      "x_nadsec_last_seen": "2026-03-11T11:53:03.054Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "5432"
      ],
      "x_nadsec_orgs": [
        "Proximus NV"
      ]
    },
    {
      "created": "2026-03-11T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--976004f3-ed7a-446a-bff6-49a899b26f6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.91.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:05:03.000Z",
      "valid_until": "2026-04-12T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T11:36:36.292Z",
      "x_nadsec_last_seen": "2026-03-11T11:36:36.292Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-11T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--e475b9e1-ace8-43c0-b43a-8be587b2581c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.70.36.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:05:03.000Z",
      "valid_until": "2026-04-12T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T11:11:04.571Z",
      "x_nadsec_last_seen": "2026-03-11T11:11:12.177Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-03-11T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=35104; asn_org=Jusan Mobile JSC",
      "id": "indicator--96b31a2d-5da6-4099-aab6-cacbe42132fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.196.22.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:05:03.000Z",
      "valid_until": "2026-04-12T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T11:17:57.757Z",
      "x_nadsec_last_seen": "2026-03-11T11:20:04.764Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "35104"
      ],
      "x_nadsec_orgs": [
        "Jusan Mobile JSC"
      ]
    },
    {
      "created": "2026-03-11T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TN; asn=37705; asn_org=TOPNET",
      "id": "indicator--28e7d3df-eb96-4ec5-b8b3-cd42398c8165",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.230.60.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:05:03.000Z",
      "valid_until": "2026-04-12T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T11:20:55.692Z",
      "x_nadsec_last_seen": "2026-03-30T22:12:20.601Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37705"
      ],
      "x_nadsec_orgs": [
        "TOPNET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-11T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--7afca4b9-df73-462a-a9a3-00d31b28c7ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.77.230.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:05:03.000Z",
      "valid_until": "2026-04-12T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T11:38:47.654Z",
      "x_nadsec_last_seen": "2026-03-11T11:38:47.654Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-11T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IL; asn=12400; asn_org=Partner Communications Ltd.; user(top)=**",
      "id": "indicator--c4518a82-936a-44ad-a7f6-c33434dd32b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.179.17.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:05:03.000Z",
      "valid_until": "2026-04-12T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T11:21:07.271Z",
      "x_nadsec_last_seen": "2026-03-11T11:21:07.271Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "12400"
      ],
      "x_nadsec_orgs": [
        "Partner Communications Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-11T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KW; asn=21050; asn_org=Fast Communication Company Ltd",
      "id": "indicator--019b4100-d7f5-4bee-89d0-f2579383baf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.96.40.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:05:03.000Z",
      "valid_until": "2026-04-12T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T11:27:35.447Z",
      "x_nadsec_last_seen": "2026-03-11T11:35:08.354Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KW"
      ],
      "x_nadsec_asns": [
        "21050"
      ],
      "x_nadsec_orgs": [
        "Fast Communication Company Ltd"
      ]
    },
    {
      "created": "2026-03-11T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25531; asn_org=Rostelecom",
      "id": "indicator--5c6ebf13-fb48-4b02-90f5-126c207a577c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.17.36.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:05:03.000Z",
      "valid_until": "2026-04-12T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T11:06:47.682Z",
      "x_nadsec_last_seen": "2026-03-11T11:15:39.344Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25531"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-11T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--1a083d9c-2d88-462b-827e-e41c9a7c06cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.156.104.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:05:03.000Z",
      "valid_until": "2026-04-12T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T11:37:08.028Z",
      "x_nadsec_last_seen": "2026-03-11T11:45:09.172Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-11T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--e41cc27b-6843-47e6-85cb-ccc5bcc7358d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.241.99.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:05:02.000Z",
      "valid_until": "2026-04-12T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T12:07:59.311Z",
      "x_nadsec_last_seen": "2026-03-11T12:10:05.721Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-11T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--4dd89e05-950c-4d4b-b1a7-83c3917f546a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.176.86.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:05:02.000Z",
      "valid_until": "2026-04-12T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T13:02:31.397Z",
      "x_nadsec_last_seen": "2026-03-11T13:04:38.806Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-11T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--e76cc576-3651-4782-90c8-13ea60df80ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.178.246.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:05:02.000Z",
      "valid_until": "2026-04-12T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T12:27:28.987Z",
      "x_nadsec_last_seen": "2026-03-11T12:35:50.540Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-11T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=UA; asn=42014; asn_org=Chumachenko Dmytro Stepanovych",
      "id": "indicator--5988ff9d-b49a-4b01-b680-5802f1e7521e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.174.21.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:05:02.000Z",
      "valid_until": "2026-04-12T13:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-11T12:15:24.852Z",
      "x_nadsec_last_seen": "2026-03-11T12:40:40.184Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "42014"
      ],
      "x_nadsec_orgs": [
        "Chumachenko Dmytro Stepanovych"
      ]
    },
    {
      "created": "2026-03-11T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--65dc382e-1517-4c84-93e5-5ab16d59e95e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.45.183.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:05:02.000Z",
      "valid_until": "2026-04-12T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T12:52:42.396Z",
      "x_nadsec_last_seen": "2026-03-11T12:54:48.808Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-03-11T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=36914; asn_org=Kenya Education Network",
      "id": "indicator--bfae2fa0-768a-433e-be6c-1e589dbaafd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.89.163.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:05:02.000Z",
      "valid_until": "2026-04-12T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T12:13:24.146Z",
      "x_nadsec_last_seen": "2026-03-11T12:15:32.418Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "36914"
      ],
      "x_nadsec_orgs": [
        "Kenya Education Network"
      ]
    },
    {
      "created": "2026-03-11T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--732130d5-9674-4f7a-b6ff-4dd2a3e1d21b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.118.42.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:05:02.000Z",
      "valid_until": "2026-04-12T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T12:45:22.186Z",
      "x_nadsec_last_seen": "2026-03-11T12:45:22.186Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-11T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--c9c0d3af-6d0f-47f9-a581-577311e84e9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:05:02.000Z",
      "valid_until": "2026-04-12T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T12:25:01.136Z",
      "x_nadsec_last_seen": "2026-03-11T12:25:01.136Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-11T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=268437; asn_org=BRAXTEL TELECOM E TI",
      "id": "indicator--d14616e2-f901-4f37-a55b-aa0810f4ff70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.160.21.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:05:02.000Z",
      "valid_until": "2026-04-12T13:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-11T12:14:32.898Z",
      "x_nadsec_last_seen": "2026-03-22T18:35:43.195Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "268437"
      ],
      "x_nadsec_orgs": [
        "BRAXTEL TELECOM E TI"
      ]
    },
    {
      "created": "2026-03-11T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DE; asn=3320; asn_org=Deutsche Telekom AG",
      "id": "indicator--f91ce1fc-e1e3-47e0-8c12-a13904ac7fa3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.157.18.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:05:02.000Z",
      "valid_until": "2026-04-12T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T12:12:19.589Z",
      "x_nadsec_last_seen": "2026-03-11T12:14:25.830Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "3320"
      ],
      "x_nadsec_orgs": [
        "Deutsche Telekom AG"
      ]
    },
    {
      "created": "2026-03-11T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--aa66f4ca-b1fd-4dc3-91e2-8bfcbbb0abce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.40.3.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:05:02.000Z",
      "valid_until": "2026-04-12T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T12:38:19.120Z",
      "x_nadsec_last_seen": "2026-03-11T12:45:57.105Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-11T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TM; asn=20661; asn_org=State Company of Electro Communications Turkmentelecom",
      "id": "indicator--b16aed80-fbd7-4a83-b824-20a665dbe9f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.85.114.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:05:02.000Z",
      "valid_until": "2026-04-12T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T12:52:36.967Z",
      "x_nadsec_last_seen": "2026-03-11T12:54:42.573Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TM"
      ],
      "x_nadsec_asns": [
        "20661"
      ],
      "x_nadsec_orgs": [
        "State Company of Electro Communications Turkmentelecom"
      ]
    },
    {
      "created": "2026-03-11T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e9e7b1ad-8ce5-46d0-9268-6f95507abea2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.188.155.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:05:02.000Z",
      "valid_until": "2026-04-12T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T13:28:09.044Z",
      "x_nadsec_last_seen": "2026-03-11T13:30:13.668Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b7bdd2d3-efc7-4cbb-86a9-18f2ae188698",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.25.239.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:05:02.000Z",
      "valid_until": "2026-04-12T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T13:28:34.933Z",
      "x_nadsec_last_seen": "2026-03-11T16:26:17.554Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--428b941b-4ed3-4290-83bb-81971a59efdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.186.202.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:05:02.000Z",
      "valid_until": "2026-04-12T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T13:42:43.019Z",
      "x_nadsec_last_seen": "2026-03-11T13:44:48.936Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--4c29051c-ab8f-46c5-94c4-8bdf66fdfe7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.177.214.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:05:02.000Z",
      "valid_until": "2026-04-12T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T13:39:21.726Z",
      "x_nadsec_last_seen": "2026-03-11T13:41:28.055Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-11T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--207ab1dd-982c-4464-8a93-cd5d0b6693c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.10.19.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:05:02.000Z",
      "valid_until": "2026-04-12T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T13:47:19.456Z",
      "x_nadsec_last_seen": "2026-03-11T13:54:30.426Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-11T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--586772c5-dfb7-4695-9433-f515686d684c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.249.45.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:05:02.000Z",
      "valid_until": "2026-04-12T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T13:31:25.639Z",
      "x_nadsec_last_seen": "2026-03-11T13:38:34.295Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--89bd707f-3642-41d0-bef0-c00e013d0ea9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.71.226.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T14:36:43.135Z",
      "x_nadsec_last_seen": "2026-03-11T14:36:43.135Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--defa62bb-b67b-48ba-92ea-590d0a3bc75a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.168.135.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T14:33:28.359Z",
      "x_nadsec_last_seen": "2026-03-11T14:35:35.672Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--ff2dab89-71d3-4fec-a097-a561851b1e90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.191.79.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T15:00:35.812Z",
      "x_nadsec_last_seen": "2026-03-11T15:00:35.812Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--11051d6b-2c20-4da8-80eb-b4206a1f2b10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T14:19:20.259Z",
      "x_nadsec_last_seen": "2026-03-11T14:19:20.259Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--74ea515e-c79f-4b79-b7d1-8939ad912759",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T14:19:19.578Z",
      "x_nadsec_last_seen": "2026-03-11T14:19:19.578Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--886a7a37-4445-49d2-9024-011e77966e40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T14:36:20.015Z",
      "x_nadsec_last_seen": "2026-03-11T14:36:20.015Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=18734; asn_org=Operbes, S.A. de C.V.",
      "id": "indicator--da566040-5ec9-4158-9567-ba86e8661e5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.148.64.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T15:01:07.833Z",
      "x_nadsec_last_seen": "2026-03-11T15:03:13.638Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "18734"
      ],
      "x_nadsec_orgs": [
        "Operbes, S.A. de C.V."
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--465fc089-67b1-4f1f-9d8f-e5a6a1bc600c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.243.252.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T14:56:22.480Z",
      "x_nadsec_last_seen": "2026-03-11T14:58:34.440Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RS; asn=8400; asn_org=TELEKOM SRBIJA a.d.",
      "id": "indicator--92eebc11-ef87-426b-bdc0-f101cda1d4d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.200.162.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-11T14:16:39.837Z",
      "x_nadsec_last_seen": "2026-03-24T05:47:16.606Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "8400"
      ],
      "x_nadsec_orgs": [
        "TELEKOM SRBIJA a.d."
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=269876; asn_org=SUMINISTROS PCWESTERN, CA WestNet",
      "id": "indicator--1411dc02-5772-4300-b42e-2565dc345d0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.168.174.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T14:47:39.023Z",
      "x_nadsec_last_seen": "2026-03-11T14:49:45.169Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "269876"
      ],
      "x_nadsec_orgs": [
        "SUMINISTROS PCWESTERN, CA WestNet"
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NP; asn=23752; asn_org=Nepal Telecommunications Corporation, Internet Services",
      "id": "indicator--80363844-d396-47fe-ac6b-d883d319be81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.244.93.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T14:49:36.291Z",
      "x_nadsec_last_seen": "2026-03-11T14:49:36.291Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "23752"
      ],
      "x_nadsec_orgs": [
        "Nepal Telecommunications Corporation, Internet Services"
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bceee6c7-2843-4540-8b30-14ac8e5f2563",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '68.183.93.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T14:36:46.261Z",
      "x_nadsec_last_seen": "2026-03-11T14:36:46.261Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--c2a72d23-68f6-4162-a036-364d38f7e05c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.189.218.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T14:09:58.006Z",
      "x_nadsec_last_seen": "2026-03-11T14:12:04.642Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=25249; asn_org=Magticom Ltd.",
      "id": "indicator--76a55ed7-daf1-403e-8ca6-85d673afcea3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.95.162.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T14:49:02.250Z",
      "x_nadsec_last_seen": "2026-03-11T14:51:15.949Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "25249"
      ],
      "x_nadsec_orgs": [
        "Magticom Ltd."
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e4731af6-be8c-4b94-94c7-bc96ec42e51e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T14:39:32.678Z",
      "x_nadsec_last_seen": "2026-03-11T14:39:32.678Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--59cff2fa-9f35-459d-933b-13eb9d0eccc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T14:39:33.119Z",
      "x_nadsec_last_seen": "2026-03-11T14:39:33.119Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-11T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=44894; asn_org=Ukrchermetavtomatika LLC",
      "id": "indicator--10b1e698-4e41-412c-b68f-2b9fe48f1ee2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.247.76.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:05:04.000Z",
      "valid_until": "2026-04-12T15:05:02.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-11T14:20:29.550Z",
      "x_nadsec_last_seen": "2026-03-20T16:15:02.451Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "44894"
      ],
      "x_nadsec_orgs": [
        "Ukrchermetavtomatika LLC"
      ]
    },
    {
      "created": "2026-03-11T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3bae8785-be9e-4157-aa70-bf90866d476e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.199.165.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:05:02.000Z",
      "valid_until": "2026-04-12T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T16:50:48.217Z",
      "x_nadsec_last_seen": "2026-03-11T16:50:48.217Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--8f7f7905-6f08-4a38-be8d-2a7daa703557",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.174.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:05:02.000Z",
      "valid_until": "2026-04-12T17:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-11T16:32:42.473Z",
      "x_nadsec_last_seen": "2026-03-11T16:33:35.624Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-11T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--e8e3ad8a-1edd-409e-ace9-a868cd0ba694",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.115.185.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:05:02.000Z",
      "valid_until": "2026-04-12T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T17:02:58.223Z",
      "x_nadsec_last_seen": "2026-03-11T17:05:04.579Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-11T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CO; asn=13489; asn_org=UNE EPM TELECOMUNICACIONES S.A.",
      "id": "indicator--1e817110-e11b-4306-9f4e-7a56d08b08e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.143.215.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:05:02.000Z",
      "valid_until": "2026-04-12T17:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T16:37:10.218Z",
      "x_nadsec_last_seen": "2026-03-11T16:44:09.809Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "13489"
      ],
      "x_nadsec_orgs": [
        "UNE EPM TELECOMUNICACIONES S.A."
      ]
    },
    {
      "created": "2026-03-11T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--e66be9c6-1abe-402b-92ae-5b9e246b7cbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.156.209.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:05:02.000Z",
      "valid_until": "2026-04-12T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T16:51:57.315Z",
      "x_nadsec_last_seen": "2026-03-11T16:51:57.315Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-11T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--1eabc001-abe0-4b23-8055-532bea2628b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.156.42.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:05:02.000Z",
      "valid_until": "2026-04-12T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T16:49:53.100Z",
      "x_nadsec_last_seen": "2026-03-11T16:49:53.100Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-11T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--0cd350ba-0f74-4a0d-bb5d-6dcd0c2a53ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.203.25.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:05:02.000Z",
      "valid_until": "2026-04-12T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T17:03:42.989Z",
      "x_nadsec_last_seen": "2026-03-11T17:05:49.514Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-03-11T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=138886; asn_org=PT Data Buana Nusantara",
      "id": "indicator--3c0cad22-dc09-43c8-a994-c7ec6827f73e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.58.72.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:05:02.000Z",
      "valid_until": "2026-04-12T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T16:13:23.696Z",
      "x_nadsec_last_seen": "2026-03-11T16:15:28.086Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "138886"
      ],
      "x_nadsec_orgs": [
        "PT Data Buana Nusantara"
      ]
    },
    {
      "created": "2026-03-11T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5c66b249-56e1-424d-9a8a-a54d127c3641",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:05:02.000Z",
      "valid_until": "2026-04-12T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T16:34:10.845Z",
      "x_nadsec_last_seen": "2026-03-11T16:34:10.845Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-11T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--00abe1fb-a476-451d-9c8c-d6c691d41e10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:05:02.000Z",
      "valid_until": "2026-04-12T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T16:08:58.706Z",
      "x_nadsec_last_seen": "2026-03-11T16:08:58.706Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-11T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--bce95130-0f8d-43e3-af98-e9c9b7b91876",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.253.253.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:05:02.000Z",
      "valid_until": "2026-04-12T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T16:31:08.753Z",
      "x_nadsec_last_seen": "2026-03-11T16:33:15.150Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=15924; asn_org=Vodafone Net Iletisim Hizmetler AS",
      "id": "indicator--c5c53ae3-f830-4a63-95e3-e418b83a50b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.145.56.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:05:02.000Z",
      "valid_until": "2026-04-12T17:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T16:05:32.876Z",
      "x_nadsec_last_seen": "2026-03-11T16:07:38.070Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "15924"
      ],
      "x_nadsec_orgs": [
        "Vodafone Net Iletisim Hizmetler AS"
      ]
    },
    {
      "created": "2026-03-11T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--23f9834d-218c-4bf4-9fda-836e627dde3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.169.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:05:02.000Z",
      "valid_until": "2026-04-12T17:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T16:45:48.531Z",
      "x_nadsec_last_seen": "2026-03-18T04:53:03.934Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-11T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--ff3b874b-c534-43aa-a469-61f1aa7798d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.149.19.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:05:02.000Z",
      "valid_until": "2026-04-12T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T16:09:08.893Z",
      "x_nadsec_last_seen": "2026-03-11T16:11:16.198Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-11T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=60246; asn_org=Consumer Internet Cooperative PG-19",
      "id": "indicator--e0835a71-a575-4f39-af2f-808ef78e3cad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.174.98.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:05:02.000Z",
      "valid_until": "2026-04-12T17:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-11T15:05:44.366Z",
      "x_nadsec_last_seen": "2026-03-11T16:13:17.862Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "60246"
      ],
      "x_nadsec_orgs": [
        "Consumer Internet Cooperative PG-19"
      ]
    },
    {
      "created": "2026-03-11T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--753c01bc-7d19-403a-bd72-9d081caf1116",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.89.75.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:05:02.000Z",
      "valid_until": "2026-04-12T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T17:41:26.956Z",
      "x_nadsec_last_seen": "2026-03-11T17:43:34.604Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-11T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=138277; asn_org=Radinet Info Solutions Private Limited",
      "id": "indicator--0e98f9d3-7021-4664-9538-561a31d2b790",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.158.140.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:05:02.000Z",
      "valid_until": "2026-04-12T18:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T17:12:07.520Z",
      "x_nadsec_last_seen": "2026-03-11T17:18:39.679Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138277"
      ],
      "x_nadsec_orgs": [
        "Radinet Info Solutions Private Limited"
      ]
    },
    {
      "created": "2026-03-11T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--215846dd-1a20-41d9-8e85-638e656c08d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.236.121.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:05:02.000Z",
      "valid_until": "2026-04-12T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T17:45:40.564Z",
      "x_nadsec_last_seen": "2026-03-11T17:45:40.564Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1b4ab715-155c-438b-a6c9-dbf3cddfc88e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:05:02.000Z",
      "valid_until": "2026-04-12T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T17:32:37.356Z",
      "x_nadsec_last_seen": "2026-03-11T17:32:47.529Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-11T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--3338227e-095c-4a91-a1f1-2a280a692126",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.188.53.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:05:02.000Z",
      "valid_until": "2026-04-12T18:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-11T17:27:24.896Z",
      "x_nadsec_last_seen": "2026-03-11T17:27:25.565Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-11T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones",
      "id": "indicator--1b84dd48-0b9c-469f-a124-3bae17096b7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.50.228.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:05:02.000Z",
      "valid_until": "2026-04-12T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T17:59:39.171Z",
      "x_nadsec_last_seen": "2026-03-11T17:59:39.457Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UY"
      ],
      "x_nadsec_asns": [
        "6057"
      ],
      "x_nadsec_orgs": [
        "Administracion Nacional de Telecomunicaciones"
      ]
    },
    {
      "created": "2026-03-11T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--8f7fd3b0-8041-48ae-8b2b-539dda3e6d40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.137.45.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:05:02.000Z",
      "valid_until": "2026-04-12T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T17:23:17.643Z",
      "x_nadsec_last_seen": "2026-03-11T17:25:23.297Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-11T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--10c785ad-b1aa-40d9-8c3b-01ccc59f1c6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:05:02.000Z",
      "valid_until": "2026-04-12T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T17:08:00.207Z",
      "x_nadsec_last_seen": "2026-03-11T17:08:00.207Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-11T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=LB; asn=9051; asn_org=IncoNet Data Management sal",
      "id": "indicator--fb97da81-623d-4fdb-b2d8-0a869d9429c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.77.185.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:05:02.000Z",
      "valid_until": "2026-04-12T18:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T17:11:50.287Z",
      "x_nadsec_last_seen": "2026-03-11T17:12:39.431Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LB"
      ],
      "x_nadsec_asns": [
        "9051"
      ],
      "x_nadsec_orgs": [
        "IncoNet Data Management sal"
      ]
    },
    {
      "created": "2026-03-11T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--aee4ad8d-8a91-44b1-950e-32fe47d44579",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.105.46.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:05:02.000Z",
      "valid_until": "2026-04-12T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T17:56:05.494Z",
      "x_nadsec_last_seen": "2026-03-13T02:23:16.465Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-11T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=24378; asn_org=Total Access Communication PLC.",
      "id": "indicator--eaa8565e-68af-40d3-b370-48bf7bd8d9e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.47.25.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:05:03.000Z",
      "valid_until": "2026-04-12T19:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T19:03:43.818Z",
      "x_nadsec_last_seen": "2026-03-11T19:10:26.118Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "24378"
      ],
      "x_nadsec_orgs": [
        "Total Access Communication PLC."
      ]
    },
    {
      "created": "2026-03-11T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e2a557fe-2cc2-40bd-afdf-d0e768adeb25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.193.47.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:05:03.000Z",
      "valid_until": "2026-04-12T19:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-11T18:33:12.398Z",
      "x_nadsec_last_seen": "2026-03-21T22:05:53.042Z",
      "x_nadsec_ports": [
        "27017",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-11T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--10e640e5-de14-4049-a678-80131c952cba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.44.162.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:05:03.000Z",
      "valid_until": "2026-04-12T19:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T18:40:27.729Z",
      "x_nadsec_last_seen": "2026-03-11T18:42:33.226Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-03-11T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--8ab95c19-19e4-4d4f-8231-ee9bbae0d123",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.119.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:05:03.000Z",
      "valid_until": "2026-04-12T19:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-11T18:23:18.227Z",
      "x_nadsec_last_seen": "2026-03-31T17:37:49.113Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "pptpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-11T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ed0a506b-c46f-41e4-a5a6-0671d9499e2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:05:03.000Z",
      "valid_until": "2026-04-12T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T18:23:59.208Z",
      "x_nadsec_last_seen": "2026-03-11T18:23:59.208Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-11T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--a7f292fc-ed81-45fc-81b8-14be8bd1c4d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.124.131.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:05:03.000Z",
      "valid_until": "2026-04-12T19:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T18:05:57.927Z",
      "x_nadsec_last_seen": "2026-03-11T18:13:16.599Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-11T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PH; asn=4775; asn_org=Globe Telecoms",
      "id": "indicator--564be129-336d-4b60-b29e-c02a58cdc0cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.177.11.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:05:03.000Z",
      "valid_until": "2026-04-12T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T18:40:28.033Z",
      "x_nadsec_last_seen": "2026-03-11T18:40:28.033Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "4775"
      ],
      "x_nadsec_orgs": [
        "Globe Telecoms"
      ]
    },
    {
      "created": "2026-03-11T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=50060; asn_org=Annet Ltd.",
      "id": "indicator--d9375467-1019-4230-b7d7-f3084047f17b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.42.234.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:05:03.000Z",
      "valid_until": "2026-04-12T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T19:04:53.676Z",
      "x_nadsec_last_seen": "2026-03-11T19:09:35.944Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50060"
      ],
      "x_nadsec_orgs": [
        "Annet Ltd."
      ]
    },
    {
      "created": "2026-03-11T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--b05af8c2-d39c-46eb-8831-def9134ed819",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.73.108.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:05:03.000Z",
      "valid_until": "2026-04-12T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T18:50:45.374Z",
      "x_nadsec_last_seen": "2026-03-11T18:52:52.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-11T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--75144338-260c-4330-b046-7b03e62120d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:05:03.000Z",
      "valid_until": "2026-04-12T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T18:36:23.454Z",
      "x_nadsec_last_seen": "2026-03-11T18:36:23.454Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--8c1b5dde-f505-4b62-b9e2-1827cbc968c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.226.178.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:05:02.000Z",
      "valid_until": "2026-04-12T20:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T19:13:48.304Z",
      "x_nadsec_last_seen": "2026-03-11T19:13:53.262Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IT; asn=30722; asn_org=Fastweb",
      "id": "indicator--434b4373-35ea-4397-a287-24b08f1fc4df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.117.222.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:05:02.000Z",
      "valid_until": "2026-04-12T20:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-11T19:22:44.768Z",
      "x_nadsec_last_seen": "2026-03-27T21:41:51.994Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30722"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--0b5d4f3c-463f-488b-8604-d52304fdfcce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.196.194.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:05:02.000Z",
      "valid_until": "2026-04-12T20:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T19:40:54.435Z",
      "x_nadsec_last_seen": "2026-03-11T19:49:03.245Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-03-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--36d81279-c337-4dde-ba92-5a03c9d0c7f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.163.102.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:05:02.000Z",
      "valid_until": "2026-04-12T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T20:04:38.253Z",
      "x_nadsec_last_seen": "2026-03-11T20:06:43.005Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--1b795a3e-89a2-4e1e-b8c2-56817c4b656c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.178.128.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:05:02.000Z",
      "valid_until": "2026-04-12T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T19:41:26.389Z",
      "x_nadsec_last_seen": "2026-03-11T19:41:26.389Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=AE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--17e69e09-2666-4491-99dd-5038e3f1d08b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.181.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:05:02.000Z",
      "valid_until": "2026-04-12T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T19:31:13.330Z",
      "x_nadsec_last_seen": "2026-03-11T19:31:33.317Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--21504122-28ce-4699-8c86-61d3168596e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.35.236.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:05:02.000Z",
      "valid_until": "2026-04-12T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T19:29:12.101Z",
      "x_nadsec_last_seen": "2026-03-20T23:31:38.154Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--bbe86c77-1fb2-42dd-ab6f-a7123293eaad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.115.146.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:05:02.000Z",
      "valid_until": "2026-04-12T20:05:01.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-11T19:15:55.702Z",
      "x_nadsec_last_seen": "2026-03-22T21:47:57.029Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=266181; asn_org=GOLDEN LINK",
      "id": "indicator--9bf5cc91-166e-4a3f-bc5b-fa20248cec36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.120.22.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:05:02.000Z",
      "valid_until": "2026-04-12T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T19:07:15.812Z",
      "x_nadsec_last_seen": "2026-03-11T19:07:16.576Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "266181"
      ],
      "x_nadsec_orgs": [
        "GOLDEN LINK"
      ]
    },
    {
      "created": "2026-03-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--c5a482ee-82d8-4257-8c8c-9a75a954a774",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.14.29.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:05:02.000Z",
      "valid_until": "2026-04-12T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T19:16:10.875Z",
      "x_nadsec_last_seen": "2026-03-11T19:18:17.327Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NL; asn=57043; asn_org=Hostkey B.v.",
      "id": "indicator--c115655b-57c0-43c9-b41c-a746a4570d2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.39.222.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:05:02.000Z",
      "valid_until": "2026-04-12T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T19:20:22.711Z",
      "x_nadsec_last_seen": "2026-03-11T19:20:22.976Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "57043"
      ],
      "x_nadsec_orgs": [
        "Hostkey B.v."
      ]
    },
    {
      "created": "2026-03-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=271791; asn_org=CABLE NORTE CA.",
      "id": "indicator--94376f46-be09-4cbf-a3fc-eaaa8693e682",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.86.168.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:05:02.000Z",
      "valid_until": "2026-04-12T20:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T19:35:22.807Z",
      "x_nadsec_last_seen": "2026-03-11T19:40:52.108Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "271791"
      ],
      "x_nadsec_orgs": [
        "CABLE NORTE CA."
      ]
    },
    {
      "created": "2026-03-11T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=IT; asn=30722; asn_org=Fastweb",
      "id": "indicator--7ae1145d-1b41-4a58-82e3-2b76e497a7bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.81.148.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:05:02.000Z",
      "valid_until": "2026-04-12T20:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-11T19:19:23.575Z",
      "x_nadsec_last_seen": "2026-03-11T19:46:13.181Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30722"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-03-11T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=138277; asn_org=Radinet Info Solutions Private Limited",
      "id": "indicator--048db06e-a9e0-4a69-8702-163d25a6b638",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.133.120.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T21:05:03.000Z",
      "valid_until": "2026-04-12T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T20:28:36.157Z",
      "x_nadsec_last_seen": "2026-03-11T20:30:41.540Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138277"
      ],
      "x_nadsec_orgs": [
        "Radinet Info Solutions Private Limited"
      ]
    },
    {
      "created": "2026-03-11T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--75a00076-8522-4224-a572-253b2723dd90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T21:05:03.000Z",
      "valid_until": "2026-04-12T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T20:38:47.724Z",
      "x_nadsec_last_seen": "2026-03-12T02:37:37.707Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-11T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--b7d5c06b-2a0c-46f8-b3cd-9d89386f66c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.165.29.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T21:05:03.000Z",
      "valid_until": "2026-04-12T21:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-11T20:16:38.624Z",
      "x_nadsec_last_seen": "2026-03-11T21:16:58.010Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-11T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--420c4abe-37f1-4428-86c1-12fb791c55b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T21:05:03.000Z",
      "valid_until": "2026-04-12T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T20:25:33.148Z",
      "x_nadsec_last_seen": "2026-03-11T20:25:33.148Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-11T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--b85044a7-0716-41fb-91f9-2f15f39303cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.110.179.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T21:05:03.000Z",
      "valid_until": "2026-04-12T21:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T20:17:24.947Z",
      "x_nadsec_last_seen": "2026-03-11T20:24:45.918Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-11T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=UA; asn=15377; asn_org=Traditional LLC",
      "id": "indicator--81a88e6f-8bef-4a43-9fa9-ddec170f1f64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.98.156.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T21:05:03.000Z",
      "valid_until": "2026-04-12T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T20:38:20.439Z",
      "x_nadsec_last_seen": "2026-03-11T20:38:20.439Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "15377"
      ],
      "x_nadsec_orgs": [
        "Traditional LLC"
      ]
    },
    {
      "created": "2026-03-11T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--bbeab9d3-8afd-4367-9d6d-d7a79a4b3d76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.10.54.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T21:05:03.000Z",
      "valid_until": "2026-04-12T21:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T20:53:12.230Z",
      "x_nadsec_last_seen": "2026-03-11T21:00:20.706Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-11T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25490; asn_org=Rostelecom",
      "id": "indicator--70533472-75c7-406b-9a84-709d60c02c8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.239.62.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T21:05:03.000Z",
      "valid_until": "2026-04-12T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T20:56:16.963Z",
      "x_nadsec_last_seen": "2026-03-11T20:58:24.569Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25490"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-11T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--531c9759-9594-470c-866e-6ca8cd7f0c9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.80.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T22:05:02.000Z",
      "valid_until": "2026-04-12T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T21:25:58.661Z",
      "x_nadsec_last_seen": "2026-03-11T21:28:03.438Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-11T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3def49e6-22df-4471-afd7-26ca26cc8557",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T22:05:02.000Z",
      "valid_until": "2026-04-12T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T21:13:43.506Z",
      "x_nadsec_last_seen": "2026-03-11T21:13:43.506Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-11T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--a84cb977-515d-4a1d-b277-9f0414c17e0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T22:05:02.000Z",
      "valid_until": "2026-04-12T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T21:15:35.729Z",
      "x_nadsec_last_seen": "2026-03-11T21:15:35.729Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-11T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--f7bc8e13-68a4-4eb8-8613-b36dee61c943",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.250.195.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T22:05:02.000Z",
      "valid_until": "2026-04-12T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T21:48:28.183Z",
      "x_nadsec_last_seen": "2026-03-11T21:50:33.575Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-11T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--44b664ae-ce5d-40ec-aab5-e975508a21ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.104.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T22:05:02.000Z",
      "valid_until": "2026-04-12T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T21:39:42.239Z",
      "x_nadsec_last_seen": "2026-03-11T21:39:52.524Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-11T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MY; asn=9534; asn_org=Binariang Berhad",
      "id": "indicator--809c0d6d-ed63-4a6f-8a56-2177c0f57851",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.121.200.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:05:02.000Z",
      "valid_until": "2026-04-12T23:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T22:37:03.227Z",
      "x_nadsec_last_seen": "2026-03-11T22:43:43.359Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9534"
      ],
      "x_nadsec_orgs": [
        "Binariang Berhad"
      ]
    },
    {
      "created": "2026-03-11T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--74252049-e145-405e-aba0-2e16a75e0b8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:05:02.000Z",
      "valid_until": "2026-04-12T23:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T22:27:50.443Z",
      "x_nadsec_last_seen": "2026-03-11T22:27:50.937Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-11T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--15f021ed-dea6-40e6-868b-e250be57416d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:05:02.000Z",
      "valid_until": "2026-04-12T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T23:02:59.912Z",
      "x_nadsec_last_seen": "2026-03-11T23:02:59.912Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-11T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--57e3cfb7-2b5c-44da-8c08-685284ffb7fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.250.195.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:05:02.000Z",
      "valid_until": "2026-04-12T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T22:11:50.778Z",
      "x_nadsec_last_seen": "2026-03-11T22:13:56.155Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-11T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--900218a6-1599-4bd0-80ed-5de6e0a7168b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.254.252.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:05:02.000Z",
      "valid_until": "2026-04-12T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T22:34:33.023Z",
      "x_nadsec_last_seen": "2026-03-11T22:36:38.549Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-11T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=28656; asn_org=BTT TELECOMUNICACOES S.A.",
      "id": "indicator--a677a9b7-01c4-4663-ba64-7457fe890ddb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.52.73.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:05:02.000Z",
      "valid_until": "2026-04-12T23:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T22:48:44.319Z",
      "x_nadsec_last_seen": "2026-03-11T22:48:44.399Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28656"
      ],
      "x_nadsec_orgs": [
        "BTT TELECOMUNICACOES S.A."
      ]
    },
    {
      "created": "2026-03-11T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6d9b7be4-0d43-4979-8217-b215bb80e8ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.165.82.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:05:02.000Z",
      "valid_until": "2026-04-12T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T22:17:17.523Z",
      "x_nadsec_last_seen": "2026-03-11T22:17:17.523Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-11T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--c2115497-cd4e-4ebb-8215-15d5b0a14c0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.227.122.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:05:02.000Z",
      "valid_until": "2026-04-12T23:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-11T22:27:04.939Z",
      "x_nadsec_last_seen": "2026-03-11T23:18:29.405Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-11T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=SE; asn=12552; asn_org=GlobalConnect AB",
      "id": "indicator--cb5d3e11-a83e-47e9-bda9-bd15f30ca0af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.181.214.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:05:02.000Z",
      "valid_until": "2026-04-12T23:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T22:47:12.506Z",
      "x_nadsec_last_seen": "2026-03-11T22:54:15.285Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "12552"
      ],
      "x_nadsec_orgs": [
        "GlobalConnect AB"
      ]
    },
    {
      "created": "2026-03-11T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KZ; asn=39824; asn_org=JSC Alma Telecommunications",
      "id": "indicator--cb7cf653-bc1d-4564-9d9d-68c5c6e564d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.134.47.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:05:02.000Z",
      "valid_until": "2026-04-12T23:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T22:27:50.706Z",
      "x_nadsec_last_seen": "2026-03-11T22:35:04.971Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "39824"
      ],
      "x_nadsec_orgs": [
        "JSC Alma Telecommunications"
      ]
    },
    {
      "created": "2026-03-11T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=22773; asn_org=Cox Communications Inc.",
      "id": "indicator--bd1e7a55-8495-4e2e-824c-607810eb44b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-11T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.172.67.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T23:05:02.000Z",
      "valid_until": "2026-04-12T23:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T22:09:19.291Z",
      "x_nadsec_last_seen": "2026-03-11T22:16:18.857Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "22773"
      ],
      "x_nadsec_orgs": [
        "Cox Communications Inc."
      ]
    },
    {
      "created": "2026-03-12T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--4da4c68d-37d4-4707-9311-31c355dfed88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.174.41.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:05:03.000Z",
      "valid_until": "2026-04-13T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T23:40:09.496Z",
      "x_nadsec_last_seen": "2026-03-11T23:47:07.611Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-12T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--9714f03f-61ef-4c9c-9a87-0f4dab7d68c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.16.168.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:05:03.000Z",
      "valid_until": "2026-04-13T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T23:31:11.134Z",
      "x_nadsec_last_seen": "2026-03-11T23:37:38.903Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-03-12T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=134420; asn_org=Chongqing Telecom; user(top)=**",
      "id": "indicator--515967bb-88ea-468d-8b42-f535f7ee64fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.249.101.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:05:03.000Z",
      "valid_until": "2026-04-13T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T23:37:36.534Z",
      "x_nadsec_last_seen": "2026-03-11T23:37:36.534Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "134420"
      ],
      "x_nadsec_orgs": [
        "Chongqing Telecom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-12T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=4761; asn_org=INDOSAT Internet Network Provider",
      "id": "indicator--15fa4e33-d5b2-42c4-bfdf-98fbee2bf71e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.10.47.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:05:03.000Z",
      "valid_until": "2026-04-13T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T23:11:29.501Z",
      "x_nadsec_last_seen": "2026-03-11T23:17:47.081Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4761"
      ],
      "x_nadsec_orgs": [
        "INDOSAT Internet Network Provider"
      ]
    },
    {
      "created": "2026-03-12T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services; user(top)=**",
      "id": "indicator--c82f0d09-ff5d-4eaf-9add-1126b3ade369",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.176.87.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:05:03.000Z",
      "valid_until": "2026-04-13T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T23:12:13.804Z",
      "x_nadsec_last_seen": "2026-03-11T23:12:13.804Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-12T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e773aa2d-58e5-4ac3-9e2c-fcbdebcaed37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.229.211.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:05:03.000Z",
      "valid_until": "2026-04-13T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-11T23:50:39.039Z",
      "x_nadsec_last_seen": "2026-03-11T23:52:44.360Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-12T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=4755; asn_org=TATA Communications formerly VSNL is Leading ISP",
      "id": "indicator--5aaa5741-cb96-443a-a677-39b255415c70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.142.19.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:05:03.000Z",
      "valid_until": "2026-04-13T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-11T23:52:39.967Z",
      "x_nadsec_last_seen": "2026-03-11T23:59:52.583Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "4755"
      ],
      "x_nadsec_orgs": [
        "TATA Communications formerly VSNL is Leading ISP"
      ]
    },
    {
      "created": "2026-03-12T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS; user(top)=**",
      "id": "indicator--9ea72ef1-9d51-474d-b378-3e5447de4db4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.96.160.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:05:03.000Z",
      "valid_until": "2026-04-13T00:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-12T00:01:12.836Z",
      "x_nadsec_last_seen": "2026-03-17T00:37:30.822Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-12T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9ee2871d-ebf5-4444-9d98-039773224d74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.13.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:05:03.000Z",
      "valid_until": "2026-04-13T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T23:49:41.133Z",
      "x_nadsec_last_seen": "2026-03-11T23:49:41.133Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-12T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ce8c7477-f50b-4afe-ab74-4b4f97013e9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.245.186.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:05:03.000Z",
      "valid_until": "2026-04-13T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T23:16:26.398Z",
      "x_nadsec_last_seen": "2026-03-11T23:16:26.398Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-12T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1065d414-90ec-465a-8348-dd99cd033475",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.96.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:05:03.000Z",
      "valid_until": "2026-04-13T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T23:10:22.277Z",
      "x_nadsec_last_seen": "2026-03-11T23:10:32.436Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-12T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--a3c624a8-533e-4250-88c2-b76b202c3a89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.165.157.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:05:03.000Z",
      "valid_until": "2026-04-13T00:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-11T23:43:10.742Z",
      "x_nadsec_last_seen": "2026-03-12T01:18:14.321Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-03-12T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f073fc9a-0dfa-4f73-95bb-25aaa9f30226",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '221.132.29.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:05:03.000Z",
      "valid_until": "2026-04-13T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T23:42:55.317Z",
      "x_nadsec_last_seen": "2026-03-11T23:42:55.603Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-12T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--97adae0c-7777-4773-a4bd-5a3dc4afb282",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.165.80.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:05:03.000Z",
      "valid_until": "2026-04-13T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-11T23:55:41.901Z",
      "x_nadsec_last_seen": "2026-03-11T23:55:52.077Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-12T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--41245666-fe83-4d0f-a491-fee5aaa9dcf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T00:05:03.000Z",
      "valid_until": "2026-04-13T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-11T23:31:15.306Z",
      "x_nadsec_last_seen": "2026-03-11T23:31:15.306Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-12T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=328333; asn_org=FixedMobileTelco-AS",
      "id": "indicator--ce2046e1-b8ee-4c90-a7fd-eef4b0b62382",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.207.101.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:05:02.000Z",
      "valid_until": "2026-04-13T01:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-12T00:22:36.805Z",
      "x_nadsec_last_seen": "2026-03-12T00:24:42.598Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "328333"
      ],
      "x_nadsec_orgs": [
        "FixedMobileTelco-AS"
      ]
    },
    {
      "created": "2026-03-12T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--67f4226b-02d2-4490-8663-2e68948d4c3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '150.107.38.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:05:02.000Z",
      "valid_until": "2026-04-13T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T00:26:01.518Z",
      "x_nadsec_last_seen": "2026-03-12T00:26:01.518Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-12T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--a90b56dd-d802-4d5c-b7ae-fd8666a7634f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.168.8.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:05:02.000Z",
      "valid_until": "2026-04-13T01:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T00:19:56.733Z",
      "x_nadsec_last_seen": "2026-03-12T00:27:10.736Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-12T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--c84beaf6-0524-48f0-9976-fab220df7ffd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.153.91.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:05:02.000Z",
      "valid_until": "2026-04-13T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T00:10:38.076Z",
      "x_nadsec_last_seen": "2026-03-12T00:12:44.087Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-03-12T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a031bcbb-869d-4da3-8846-2d29f1ee4e87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:05:02.000Z",
      "valid_until": "2026-04-13T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T00:25:14.310Z",
      "x_nadsec_last_seen": "2026-03-25T15:43:49.050Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-12T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--707e12ac-fcc1-4273-8052-f115446d1826",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:05:02.000Z",
      "valid_until": "2026-04-13T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T00:25:38.754Z",
      "x_nadsec_last_seen": "2026-03-25T15:43:23.081Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-12T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5eb3457e-aaf1-4b05-be55-aef6e046df8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:05:02.000Z",
      "valid_until": "2026-04-13T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T00:25:39.435Z",
      "x_nadsec_last_seen": "2026-03-25T15:43:23.418Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-12T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37705; asn_org=TOPNET",
      "id": "indicator--55a6aefa-a124-4f4f-b456-b38450658a2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.3.6.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:05:02.000Z",
      "valid_until": "2026-04-13T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T00:28:20.030Z",
      "x_nadsec_last_seen": "2026-03-12T00:30:27.109Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37705"
      ],
      "x_nadsec_orgs": [
        "TOPNET"
      ]
    },
    {
      "created": "2026-03-12T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--f2a8d6b4-f5ff-4c26-8348-371ce199761b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.34.140.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:05:02.000Z",
      "valid_until": "2026-04-13T01:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T00:54:14.515Z",
      "x_nadsec_last_seen": "2026-03-12T01:01:57.958Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-12T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=UA; asn=31725; asn_org=ISP Shtorm LTD",
      "id": "indicator--9ad7c314-1ddb-46ef-a539-c3e7537ca6f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.201.244.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:05:02.000Z",
      "valid_until": "2026-04-13T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T01:04:15.156Z",
      "x_nadsec_last_seen": "2026-03-12T01:06:24.693Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "31725"
      ],
      "x_nadsec_orgs": [
        "ISP Shtorm LTD"
      ]
    },
    {
      "created": "2026-03-12T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--11e30392-8641-4e0f-ac80-50e0e45f0299",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.240.121.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T02:05:03.000Z",
      "valid_until": "2026-04-13T02:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-12T01:06:24.362Z",
      "x_nadsec_last_seen": "2026-03-22T08:09:50.558Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-03-12T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b21b920a-5979-48f0-afc4-3b416fb111a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.211.8.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T02:05:03.000Z",
      "valid_until": "2026-04-13T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T01:07:12.358Z",
      "x_nadsec_last_seen": "2026-03-13T12:22:34.444Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-12T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--7aae0c9e-f019-4e00-b0be-bd37f799f58f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.22.6.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T02:05:03.000Z",
      "valid_until": "2026-04-13T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T01:31:10.130Z",
      "x_nadsec_last_seen": "2026-03-12T01:33:14.659Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-03-12T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e46d1877-f6ed-4b39-9beb-6606d491a0a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.118.217.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T02:05:03.000Z",
      "valid_until": "2026-04-13T02:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T01:10:43.683Z",
      "x_nadsec_last_seen": "2026-03-14T23:55:23.827Z",
      "x_nadsec_ports": [
        "445",
        "81"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-12T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8372a4c7-6a22-48e8-9ede-1646e10adc45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T02:05:03.000Z",
      "valid_until": "2026-04-13T02:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-12T02:00:36.638Z",
      "x_nadsec_last_seen": "2026-03-12T02:00:37.320Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-12T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AT; asn=31543; asn_org=myNet GmbH",
      "id": "indicator--f0f4aeda-d74d-4c64-9e8c-ff7f7a94ca88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.218.168.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T02:05:03.000Z",
      "valid_until": "2026-04-13T02:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-12T01:14:50.034Z",
      "x_nadsec_last_seen": "2026-03-12T01:15:36.569Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AT"
      ],
      "x_nadsec_asns": [
        "31543"
      ],
      "x_nadsec_orgs": [
        "myNet GmbH"
      ]
    },
    {
      "created": "2026-03-12T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=141607; asn_org=PT Gayatri Lintas Nusantara",
      "id": "indicator--416a40a5-0ed1-4faf-8e7e-40812d51e9e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.160.69.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:05:02.000Z",
      "valid_until": "2026-04-13T03:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-12T02:42:23.184Z",
      "x_nadsec_last_seen": "2026-03-12T03:13:13.624Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "141607"
      ],
      "x_nadsec_orgs": [
        "PT Gayatri Lintas Nusantara"
      ]
    },
    {
      "created": "2026-03-12T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--ad6c6bb3-8afd-4e23-b33e-84a8cff5080e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.161.134.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:05:02.000Z",
      "valid_until": "2026-04-13T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T02:19:43.597Z",
      "x_nadsec_last_seen": "2026-03-12T02:21:48.012Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-12T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--c19d54c7-23d9-4f9e-ab75-613046320fd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '169.148.68.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:05:02.000Z",
      "valid_until": "2026-04-13T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T02:08:23.077Z",
      "x_nadsec_last_seen": "2026-03-12T02:08:26.148Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-12T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--299c9132-ce7f-4cb9-8728-21eb823ce1e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.9.35.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:05:02.000Z",
      "valid_until": "2026-04-13T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T03:02:16.499Z",
      "x_nadsec_last_seen": "2026-03-12T03:04:21.480Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-03-12T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones; user(top)=**",
      "id": "indicator--d2c4fe97-8133-4e34-966d-c9b49d962abe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.50.253.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:05:02.000Z",
      "valid_until": "2026-04-13T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T02:11:14.169Z",
      "x_nadsec_last_seen": "2026-03-12T02:11:14.169Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UY"
      ],
      "x_nadsec_asns": [
        "6057"
      ],
      "x_nadsec_orgs": [
        "Administracion Nacional de Telecomunicaciones"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-12T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7bd204c6-57da-443a-8648-c86587f02b72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.107.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:05:02.000Z",
      "valid_until": "2026-04-13T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T02:28:26.672Z",
      "x_nadsec_last_seen": "2026-03-12T02:28:26.672Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-12T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--b9c24dfc-7fae-4a66-b76f-cefa672139f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.164.178.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:05:02.000Z",
      "valid_until": "2026-04-13T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T02:39:09.473Z",
      "x_nadsec_last_seen": "2026-03-12T02:39:09.473Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-03-12T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a89a0a3e-4286-4200-9b8d-f529b5b10e70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.173.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:05:02.000Z",
      "valid_until": "2026-04-13T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T02:32:46.879Z",
      "x_nadsec_last_seen": "2026-03-12T02:32:46.879Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-12T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--cf8256a7-a8e0-4f58-b746-eede9a5bb1a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.119.182.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:05:02.000Z",
      "valid_until": "2026-04-13T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T02:47:50.107Z",
      "x_nadsec_last_seen": "2026-03-12T02:54:29.429Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-12T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=24534; asn_org=PT. Transhybrid Communication",
      "id": "indicator--f15d4387-fee0-4e05-93c5-886e51a50c75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.147.190.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:05:02.000Z",
      "valid_until": "2026-04-13T03:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-12T02:27:26.471Z",
      "x_nadsec_last_seen": "2026-03-15T07:20:03.265Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "24534"
      ],
      "x_nadsec_orgs": [
        "PT. Transhybrid Communication"
      ]
    },
    {
      "created": "2026-03-12T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=32098; asn_org=Transtelco Inc",
      "id": "indicator--8eecf478-1103-42c1-9caf-46013778d802",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.68.212.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:05:02.000Z",
      "valid_until": "2026-04-13T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T02:39:09.608Z",
      "x_nadsec_last_seen": "2026-03-12T02:39:46.928Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32098"
      ],
      "x_nadsec_orgs": [
        "Transtelco Inc"
      ]
    },
    {
      "created": "2026-03-12T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--319ce4b7-886a-4114-a432-e2afd1358db3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '90.151.105.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T03:05:02.000Z",
      "valid_until": "2026-04-13T03:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-12T02:56:35.521Z",
      "x_nadsec_last_seen": "2026-03-23T04:29:23.992Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-12T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--fc20cb40-b1fe-41e2-86d2-479c607a2f7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.134.137.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:05:02.000Z",
      "valid_until": "2026-04-13T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T03:18:01.082Z",
      "x_nadsec_last_seen": "2026-03-12T03:20:07.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-03-12T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--a9bfd5f3-b2c8-490d-a19c-d4c0644a9cd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.54.127.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:05:02.000Z",
      "valid_until": "2026-04-13T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T03:21:43.931Z",
      "x_nadsec_last_seen": "2026-03-12T03:23:50.746Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-12T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=45536; asn_org=Readylink Internet Services Limited",
      "id": "indicator--3829a947-59f0-401b-a37a-1be6ca8022e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.255.249.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:05:02.000Z",
      "valid_until": "2026-04-13T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T03:53:21.459Z",
      "x_nadsec_last_seen": "2026-03-12T03:53:22.161Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45536"
      ],
      "x_nadsec_orgs": [
        "Readylink Internet Services Limited"
      ]
    },
    {
      "created": "2026-03-12T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=epmapper; ports=135; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a42f2a43-b41a-4f51-a680-5a4e08dc1cba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.252.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:05:02.000Z",
      "valid_until": "2026-04-13T04:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-12T03:41:46.136Z",
      "x_nadsec_last_seen": "2026-03-12T03:43:58.876Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "27017",
        "42237"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-12T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=37130; asn_org=SITA-AS",
      "id": "indicator--3b41e358-ba7e-4339-bb63-933db3f26417",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '164.151.136.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:05:02.000Z",
      "valid_until": "2026-04-13T04:05:01.000Z",
      "x_nadsec_event_count": 30,
      "x_nadsec_first_seen": "2026-03-12T03:18:19.859Z",
      "x_nadsec_last_seen": "2026-03-28T17:25:16.621Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37130"
      ],
      "x_nadsec_orgs": [
        "SITA-AS"
      ]
    },
    {
      "created": "2026-03-12T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f36f08f4-dae9-4351-8ff3-3a5cb2ad0250",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:05:02.000Z",
      "valid_until": "2026-04-13T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T03:08:59.119Z",
      "x_nadsec_last_seen": "2026-03-12T09:25:11.646Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-12T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PA; asn=265867; asn_org=Trans Ocean Network",
      "id": "indicator--4b74fb34-8a3b-420b-b853-607e111299a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.214.137.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:05:02.000Z",
      "valid_until": "2026-04-13T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T03:27:47.383Z",
      "x_nadsec_last_seen": "2026-03-12T03:27:47.383Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PA"
      ],
      "x_nadsec_asns": [
        "265867"
      ],
      "x_nadsec_orgs": [
        "Trans Ocean Network"
      ]
    },
    {
      "created": "2026-03-12T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7d56687f-fcd8-49ab-9237-9dce1d59e924",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:05:02.000Z",
      "valid_until": "2026-04-13T04:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-12T03:47:47.691Z",
      "x_nadsec_last_seen": "2026-03-12T03:47:48.222Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-12T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PA; asn=18809; asn_org=Cable Onda",
      "id": "indicator--c6295672-91d7-4075-a9d4-b66512814a87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.218.215.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:05:02.000Z",
      "valid_until": "2026-04-13T04:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-12T03:27:47.751Z",
      "x_nadsec_last_seen": "2026-03-12T03:29:54.315Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PA"
      ],
      "x_nadsec_asns": [
        "18809"
      ],
      "x_nadsec_orgs": [
        "Cable Onda"
      ]
    },
    {
      "created": "2026-03-12T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--5d1c434b-9a22-4b7b-99a1-5499cccbb67d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.158.25.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:05:02.000Z",
      "valid_until": "2026-04-13T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T03:22:02.366Z",
      "x_nadsec_last_seen": "2026-03-12T03:23:16.100Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-12T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--74420766-c936-484b-bc4b-a918827e5545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.152.89.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:05:02.000Z",
      "valid_until": "2026-04-13T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T03:44:46.459Z",
      "x_nadsec_last_seen": "2026-03-12T03:44:52.831Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-12T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2e9cf22a-f9c4-41aa-ac57-6e4f6e56a0cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:05:02.000Z",
      "valid_until": "2026-04-13T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T03:19:10.794Z",
      "x_nadsec_last_seen": "2026-03-24T22:03:09.162Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-12T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--cbd93c93-ab83-410e-b2db-c26e3b8f7c6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:05:02.000Z",
      "valid_until": "2026-04-13T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T03:19:21.296Z",
      "x_nadsec_last_seen": "2026-03-12T03:19:21.296Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-12T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4fe7e189-0150-4b4b-9ba9-44c31e5c587b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.144.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:05:03.000Z",
      "valid_until": "2026-04-13T05:05:01.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-03-12T04:48:48.020Z",
      "x_nadsec_last_seen": "2026-03-21T16:34:06.442Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-12T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JP; asn=4713; asn_org=NTT DOCOMO BUSINESS,Inc.",
      "id": "indicator--c8126f52-179d-4301-8387-afc94407074d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.149.13.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:05:03.000Z",
      "valid_until": "2026-04-13T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T04:51:07.407Z",
      "x_nadsec_last_seen": "2026-03-12T04:53:13.107Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "4713"
      ],
      "x_nadsec_orgs": [
        "NTT DOCOMO BUSINESS,Inc."
      ]
    },
    {
      "created": "2026-03-12T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--233ca87c-3cd1-4471-900a-eee4958f9ba3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.174.219.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:05:03.000Z",
      "valid_until": "2026-04-13T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T04:45:16.337Z",
      "x_nadsec_last_seen": "2026-03-12T04:47:21.035Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-12T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--efd90182-7a47-4dd9-a9cf-26f9bf4a6098",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.175.252.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:05:03.000Z",
      "valid_until": "2026-04-13T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T04:11:11.327Z",
      "x_nadsec_last_seen": "2026-03-12T04:17:58.143Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-12T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=60042; asn_org=OnTelecom LLC",
      "id": "indicator--6b752fe5-74a3-4e8b-a7a6-dd0549ce5579",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.118.217.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:05:03.000Z",
      "valid_until": "2026-04-13T05:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-12T05:03:07.146Z",
      "x_nadsec_last_seen": "2026-03-12T05:04:21.079Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "60042"
      ],
      "x_nadsec_orgs": [
        "OnTelecom LLC"
      ]
    },
    {
      "created": "2026-03-12T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--971fefe0-1fcd-4f70-9eb3-3aea1efee82d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.202.110.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:05:03.000Z",
      "valid_until": "2026-04-13T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T04:22:36.063Z",
      "x_nadsec_last_seen": "2026-03-12T04:24:43.815Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-12T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--e1135711-4b84-4fd7-91a4-25e6cc33461d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.119.39.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:05:03.000Z",
      "valid_until": "2026-04-13T05:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-12T04:46:48.269Z",
      "x_nadsec_last_seen": "2026-03-12T06:18:05.585Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-12T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--d75debf7-57f1-43a2-9fd2-98addaed91cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:05:03.000Z",
      "valid_until": "2026-04-13T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T05:03:16.790Z",
      "x_nadsec_last_seen": "2026-03-28T22:05:44.266Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-12T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--7e4f13b1-e14a-4d0b-9629-76dcc84505a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '86.57.211.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:05:03.000Z",
      "valid_until": "2026-04-13T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T04:31:00.460Z",
      "x_nadsec_last_seen": "2026-03-12T04:31:06.845Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-03-12T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e73069d4-d048-4fdb-82f7-b57e7066f8ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.223.108.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:05:03.000Z",
      "valid_until": "2026-04-13T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T04:19:24.943Z",
      "x_nadsec_last_seen": "2026-03-12T04:21:31.771Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-12T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--a5ef2dc5-dd1b-4762-8792-c378a0ae3ef9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.23.56.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:05:02.000Z",
      "valid_until": "2026-04-13T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T06:01:01.413Z",
      "x_nadsec_last_seen": "2026-03-12T06:03:06.493Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-12T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--e8d6a4c7-2b0e-4994-ae6e-a9787f58e4a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.97.108.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:05:02.000Z",
      "valid_until": "2026-04-13T06:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-12T05:40:41.788Z",
      "x_nadsec_last_seen": "2026-03-12T05:42:46.496Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-03-12T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=EG; asn=8452; asn_org=TE Data; user(top)=**",
      "id": "indicator--ad183881-dbfb-4276-8574-c65c0c6e1b29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.178.80.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:05:02.000Z",
      "valid_until": "2026-04-13T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T05:57:59.043Z",
      "x_nadsec_last_seen": "2026-03-12T05:57:59.043Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-12T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f63bc621-c378-4f7e-95d0-795fac4bdf6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.203.115.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:05:02.000Z",
      "valid_until": "2026-04-13T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T05:15:06.843Z",
      "x_nadsec_last_seen": "2026-03-12T05:15:06.843Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-12T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--4e2ec6db-caf0-4204-80bf-22ebc7d800d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.19.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:05:02.000Z",
      "valid_until": "2026-04-13T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T05:10:08.383Z",
      "x_nadsec_last_seen": "2026-03-12T05:12:16.097Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-12T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--10c30cd6-69a7-4fbc-9fe0-a6dd933a3e8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.253.148.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:05:02.000Z",
      "valid_until": "2026-04-13T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T05:57:19.809Z",
      "x_nadsec_last_seen": "2026-03-12T05:57:19.947Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-03-12T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=25620; asn_org=COTAS LTDA.",
      "id": "indicator--6c88d86b-983d-4eb1-96e1-b18ee893a82b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.186.32.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:05:02.000Z",
      "valid_until": "2026-04-13T06:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-12T05:25:21.385Z",
      "x_nadsec_last_seen": "2026-03-27T02:53:09.976Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "25620"
      ],
      "x_nadsec_orgs": [
        "COTAS LTDA."
      ]
    },
    {
      "created": "2026-03-12T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5b5c7b65-2ef0-4fd4-8cee-249ed54ba896",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:05:02.000Z",
      "valid_until": "2026-04-13T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T05:08:52.557Z",
      "x_nadsec_last_seen": "2026-03-21T11:03:18.204Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-12T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--e6a04bbc-8641-4dc6-b6ac-6c227318e08c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '221.195.208.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:05:02.000Z",
      "valid_until": "2026-04-13T06:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-12T05:56:28.334Z",
      "x_nadsec_last_seen": "2026-03-12T05:56:46.591Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-03-12T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MY; asn=4818; asn_org=DiGi Telecommunications Sdn. Bhd.",
      "id": "indicator--9b2549d1-1d37-44a6-979a-a5b9ab8a3d0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.124.205.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:05:02.000Z",
      "valid_until": "2026-04-13T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T05:07:04.566Z",
      "x_nadsec_last_seen": "2026-03-12T05:14:27.014Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "4818"
      ],
      "x_nadsec_orgs": [
        "DiGi Telecommunications Sdn. Bhd."
      ]
    },
    {
      "created": "2026-03-12T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--223f238c-e998-442e-983d-5dd76de2196e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.109.142.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:05:03.000Z",
      "valid_until": "2026-04-13T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T06:11:04.717Z",
      "x_nadsec_last_seen": "2026-03-12T06:17:41.495Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-12T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BD; asn=136556; asn_org=MS BD ONLINE SYSTEMS",
      "id": "indicator--60e5fd34-8bc7-45e6-8d2f-b94974fe5014",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.92.160.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:05:03.000Z",
      "valid_until": "2026-04-13T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T07:03:43.131Z",
      "x_nadsec_last_seen": "2026-03-12T07:11:02.068Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "136556"
      ],
      "x_nadsec_orgs": [
        "MS BD ONLINE SYSTEMS"
      ]
    },
    {
      "created": "2026-03-12T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--42ab5399-a5e1-4dc8-887d-6fb44bfa134d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.69.109.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:05:03.000Z",
      "valid_until": "2026-04-13T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T06:20:36.124Z",
      "x_nadsec_last_seen": "2026-03-12T06:27:14.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-12T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c2af7b28-fac7-4340-b6af-2f256c993777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.16.186.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:05:03.000Z",
      "valid_until": "2026-04-13T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T06:56:59.201Z",
      "x_nadsec_last_seen": "2026-03-12T06:59:03.995Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-12T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f898de0b-cd48-4e00-8962-404e6793c006",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:05:03.000Z",
      "valid_until": "2026-04-13T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T06:51:58.864Z",
      "x_nadsec_last_seen": "2026-03-12T06:51:58.864Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-12T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--39c26929-bb42-4ef2-8dbd-8ba871f6cfdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:05:03.000Z",
      "valid_until": "2026-04-13T07:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-12T06:13:07.990Z",
      "x_nadsec_last_seen": "2026-03-12T06:13:43.997Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-12T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--f2d0f1ca-7bd4-42b2-93f7-b027f775268a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.83.134.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:05:03.000Z",
      "valid_until": "2026-04-13T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T06:56:41.323Z",
      "x_nadsec_last_seen": "2026-03-12T06:58:46.265Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-12T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--4323713b-3e65-4fe2-8fa7-03275d5fbd55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:05:03.000Z",
      "valid_until": "2026-04-13T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T06:20:56.520Z",
      "x_nadsec_last_seen": "2026-03-12T06:20:56.520Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-12T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--3c0b2e82-1560-454c-baad-cf15cbd97fbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.36.243.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:05:03.000Z",
      "valid_until": "2026-04-13T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T06:56:12.613Z",
      "x_nadsec_last_seen": "2026-03-12T06:58:18.640Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-12T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TN; asn=37492; asn_org=ORANGE",
      "id": "indicator--61109bab-db34-46ef-a41a-ded8dc6c8491",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.228.162.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:05:03.000Z",
      "valid_until": "2026-04-13T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T06:51:53.041Z",
      "x_nadsec_last_seen": "2026-03-12T06:51:53.377Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37492"
      ],
      "x_nadsec_orgs": [
        "ORANGE"
      ]
    },
    {
      "created": "2026-03-12T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132215; asn_org=Powergrid Teleservices Limited",
      "id": "indicator--be56dcd5-821b-4a5c-83bb-ff40d6264519",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.127.211.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:05:03.000Z",
      "valid_until": "2026-04-13T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T06:55:38.447Z",
      "x_nadsec_last_seen": "2026-03-12T07:02:08.472Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132215"
      ],
      "x_nadsec_orgs": [
        "Powergrid Teleservices Limited"
      ]
    },
    {
      "created": "2026-03-12T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=TW; asn=9416; asn_org=Hoshin Multimedia Center Inc.",
      "id": "indicator--9f389905-1cc8-4cf6-91af-6b09f25b07e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.114.238.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:05:03.000Z",
      "valid_until": "2026-04-13T07:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-12T06:40:53.954Z",
      "x_nadsec_last_seen": "2026-03-12T06:44:42.778Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "9416"
      ],
      "x_nadsec_orgs": [
        "Hoshin Multimedia Center Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1***5"
      ]
    },
    {
      "created": "2026-03-12T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--57b554cc-c9ef-40ff-a77f-d0a066143741",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:05:03.000Z",
      "valid_until": "2026-04-13T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T06:33:48.158Z",
      "x_nadsec_last_seen": "2026-03-12T06:33:58.473Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-12T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--00d9e17e-ec1c-497c-9992-820ebd654df3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.0.225.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:05:02.000Z",
      "valid_until": "2026-04-13T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T07:55:01.438Z",
      "x_nadsec_last_seen": "2026-03-12T07:57:06.523Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-12T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=132445; asn_org=Khetan Cable Network Pvt. Limited",
      "id": "indicator--5ac49cdc-2c6e-4320-8d36-5979b9934997",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.21.55.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:05:02.000Z",
      "valid_until": "2026-04-13T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T07:09:57.536Z",
      "x_nadsec_last_seen": "2026-03-12T07:16:55.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132445"
      ],
      "x_nadsec_orgs": [
        "Khetan Cable Network Pvt. Limited"
      ]
    },
    {
      "created": "2026-03-12T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--3f467f41-d44d-4517-a9f3-2d657fdfe4ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.225.13.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:05:02.000Z",
      "valid_until": "2026-04-13T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T07:05:38.948Z",
      "x_nadsec_last_seen": "2026-03-12T07:07:45.123Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-12T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=58765; asn_org=B TEL INTERNET PRIVATE LIMITED",
      "id": "indicator--b8fa6973-757b-40d7-9e1c-4249fff0db7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.124.42.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:05:02.000Z",
      "valid_until": "2026-04-13T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T07:56:15.473Z",
      "x_nadsec_last_seen": "2026-03-12T08:02:41.208Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "58765"
      ],
      "x_nadsec_orgs": [
        "B TEL INTERNET PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-12T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=38511; asn_org=PT Remala Abadi",
      "id": "indicator--9ae8e8e2-e817-4b11-8f1d-28b407a6e4e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.124.75.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:05:02.000Z",
      "valid_until": "2026-04-13T08:05:01.000Z",
      "x_nadsec_event_count": 25,
      "x_nadsec_first_seen": "2026-03-12T07:13:28.060Z",
      "x_nadsec_last_seen": "2026-03-27T19:58:34.986Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "38511"
      ],
      "x_nadsec_orgs": [
        "PT Remala Abadi"
      ]
    },
    {
      "created": "2026-03-12T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4be7adf1-b49e-44dd-aa0e-4125cdffb269",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.216.150.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:05:02.000Z",
      "valid_until": "2026-04-13T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T07:14:44.837Z",
      "x_nadsec_last_seen": "2026-03-12T07:14:44.837Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-12T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=15; services=epmapper; ports=135; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--7fe2ec60-bed8-48c6-a54e-3a24f13936a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.129.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:05:02.000Z",
      "valid_until": "2026-04-13T08:05:01.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-12T07:43:49.086Z",
      "x_nadsec_last_seen": "2026-03-12T07:53:09.470Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-12T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--12777119-2b0b-4b4d-bffb-a2dd38d95855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:05:02.000Z",
      "valid_until": "2026-04-13T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T07:47:21.771Z",
      "x_nadsec_last_seen": "2026-03-19T01:34:09.705Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-12T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--ac0e57d6-de9b-4dfc-9a56-cd403111afa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:05:02.000Z",
      "valid_until": "2026-04-13T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T07:14:10.675Z",
      "x_nadsec_last_seen": "2026-03-12T07:14:10.675Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-12T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=8595; asn_org=OOO WestCall Ltd.",
      "id": "indicator--b5b1f47a-3837-40cc-be08-21602853e4c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.249.0.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:05:02.000Z",
      "valid_until": "2026-04-13T08:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-12T07:54:33.576Z",
      "x_nadsec_last_seen": "2026-03-21T06:51:58.665Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8595"
      ],
      "x_nadsec_orgs": [
        "OOO WestCall Ltd."
      ]
    },
    {
      "created": "2026-03-12T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--cb617b3a-aa62-4185-aab4-0e8c920284fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:05:02.000Z",
      "valid_until": "2026-04-13T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T07:14:41.560Z",
      "x_nadsec_last_seen": "2026-03-12T07:14:41.560Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-12T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--35d4394b-a21f-4845-a563-5651d7a403f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:05:02.000Z",
      "valid_until": "2026-04-13T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T07:14:41.159Z",
      "x_nadsec_last_seen": "2026-03-12T07:14:41.159Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-12T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=24378; asn_org=Total Access Communication PLC.",
      "id": "indicator--9afac327-1f57-4305-af17-781537a15674",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.47.88.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:05:02.000Z",
      "valid_until": "2026-04-13T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T08:19:52.830Z",
      "x_nadsec_last_seen": "2026-03-12T08:26:30.371Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "24378"
      ],
      "x_nadsec_orgs": [
        "Total Access Communication PLC."
      ]
    },
    {
      "created": "2026-03-12T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--f8c755cd-46e3-4ed7-ba45-732c92d2b037",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.133.238.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:05:02.000Z",
      "valid_until": "2026-04-13T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T09:02:04.616Z",
      "x_nadsec_last_seen": "2026-03-12T09:04:10.197Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24186"
      ],
      "x_nadsec_orgs": [
        "RailTel Corporation of India Ltd"
      ]
    },
    {
      "created": "2026-03-12T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--cc8be515-4d9f-49a3-8cc5-40d2757bffca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.174.41.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:05:02.000Z",
      "valid_until": "2026-04-13T09:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-12T08:37:58.520Z",
      "x_nadsec_last_seen": "2026-03-16T04:45:53.644Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-12T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--39938a7c-bbdb-47cc-a66d-0fdbed1354c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.193.162.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:05:02.000Z",
      "valid_until": "2026-04-13T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T09:00:20.056Z",
      "x_nadsec_last_seen": "2026-03-12T09:02:24.684Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-12T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--c13c52a2-0cd8-4de4-835b-0c10f4f49d24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.94.180.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:05:02.000Z",
      "valid_until": "2026-04-13T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T08:12:15.747Z",
      "x_nadsec_last_seen": "2026-03-12T08:18:54.047Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-12T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--44dfd1bf-9153-41ed-81cf-4c1012600dfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.231.152.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:05:02.000Z",
      "valid_until": "2026-04-13T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T08:59:50.991Z",
      "x_nadsec_last_seen": "2026-03-12T09:01:55.787Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-12T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--90670556-e247-4b70-bc5d-7d18025d5446",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:05:02.000Z",
      "valid_until": "2026-04-13T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T08:23:22.167Z",
      "x_nadsec_last_seen": "2026-03-12T08:25:29.923Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-03-12T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--d3e94005-35e3-4f99-a28f-4d90cd04a88b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.188.4.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:05:02.000Z",
      "valid_until": "2026-04-13T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T08:14:14.077Z",
      "x_nadsec_last_seen": "2026-03-12T08:16:22.134Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-12T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f41b67e4-0775-4284-97c8-dd16a90826c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:05:02.000Z",
      "valid_until": "2026-04-13T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T08:45:10.578Z",
      "x_nadsec_last_seen": "2026-03-12T08:45:11.216Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-12T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--e2c7db9e-ed5a-48f5-9352-dca4e3fb57df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '86.98.17.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:05:02.000Z",
      "valid_until": "2026-04-13T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T08:29:59.445Z",
      "x_nadsec_last_seen": "2026-03-12T08:32:04.488Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-03-12T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=25513; asn_org=PJSC Moscow city telephone network",
      "id": "indicator--961f29d8-14b5-49f2-9ae3-bd4b1bd83e71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.29.126.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:05:02.000Z",
      "valid_until": "2026-04-13T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T08:44:38.908Z",
      "x_nadsec_last_seen": "2026-03-12T08:53:22.519Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25513"
      ],
      "x_nadsec_orgs": [
        "PJSC Moscow city telephone network"
      ]
    },
    {
      "created": "2026-03-12T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--24edcb65-a42d-4efd-9285-7922ae3564c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.7.219.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T09:05:02.000Z",
      "valid_until": "2026-04-13T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T08:06:30.520Z",
      "x_nadsec_last_seen": "2026-03-12T08:14:21.733Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-12T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=135715; asn_org=INet Services Pvt Ltd",
      "id": "indicator--23a58fb2-e889-429f-95d7-4e3625d665e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.134.108.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:05:02.000Z",
      "valid_until": "2026-04-13T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T09:59:28.755Z",
      "x_nadsec_last_seen": "2026-03-12T09:59:28.755Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135715"
      ],
      "x_nadsec_orgs": [
        "INet Services Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-12T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=135715; asn_org=INet Services Pvt Ltd",
      "id": "indicator--2bcfb5e7-3088-4b75-8f5e-9f565e6973be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.134.108.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:05:02.000Z",
      "valid_until": "2026-04-13T10:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-12T09:59:28.934Z",
      "x_nadsec_last_seen": "2026-03-12T10:01:33.649Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135715"
      ],
      "x_nadsec_orgs": [
        "INet Services Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-12T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d89890aa-b3f7-440e-a161-89e23668e885",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.31.170.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:05:02.000Z",
      "valid_until": "2026-04-13T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T09:44:25.218Z",
      "x_nadsec_last_seen": "2026-03-12T09:51:32.330Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-12T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1c495197-0176-4cc6-802f-ef446de4db19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.226.234.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:05:02.000Z",
      "valid_until": "2026-04-13T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T09:07:11.723Z",
      "x_nadsec_last_seen": "2026-03-12T09:09:18.559Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-12T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c86b86f3-f650-40de-bc61-e7d8b0055c80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:05:02.000Z",
      "valid_until": "2026-04-13T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T09:11:22.635Z",
      "x_nadsec_last_seen": "2026-03-12T09:11:22.635Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-12T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--66e3c1c3-b1aa-4f93-b440-b215ea23d7dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:05:02.000Z",
      "valid_until": "2026-04-13T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T09:13:35.106Z",
      "x_nadsec_last_seen": "2026-03-12T09:13:35.106Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-12T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=9930; asn_org=TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "id": "indicator--7e062507-de93-4f1a-8514-e00b2f99042e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.184.115.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:05:02.000Z",
      "valid_until": "2026-04-13T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T09:41:53.811Z",
      "x_nadsec_last_seen": "2026-03-12T09:43:58.649Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9930"
      ],
      "x_nadsec_orgs": [
        "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al"
      ]
    },
    {
      "created": "2026-03-12T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=OM; asn=28885; asn_org=Oman Telecommunications Company (S.A.O.G)",
      "id": "indicator--dde9b4df-7cb4-4dea-85b9-956fae8ef921",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.41.84.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:05:02.000Z",
      "valid_until": "2026-04-13T10:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-12T09:40:25.269Z",
      "x_nadsec_last_seen": "2026-03-12T11:46:38.331Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "OM"
      ],
      "x_nadsec_asns": [
        "28885"
      ],
      "x_nadsec_orgs": [
        "Oman Telecommunications Company (S.A.O.G)"
      ]
    },
    {
      "created": "2026-03-12T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--a07d04e2-6784-4f62-b05d-6843aa522d70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.125.194.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:05:02.000Z",
      "valid_until": "2026-04-13T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T09:33:01.390Z",
      "x_nadsec_last_seen": "2026-03-12T09:35:07.566Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-12T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--58abcf98-d4b1-4996-b0cf-b8e57bc34acf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.249.45.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T10:05:02.000Z",
      "valid_until": "2026-04-13T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T09:19:01.948Z",
      "x_nadsec_last_seen": "2026-03-12T09:21:08.897Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-12T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--f5abdf4b-d5d5-480f-b5ec-1a1137ae4b54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.96.44.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:05:02.000Z",
      "valid_until": "2026-04-13T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T10:19:52.208Z",
      "x_nadsec_last_seen": "2026-03-12T10:21:59.651Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-12T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=24173; asn_org=Netnam Company",
      "id": "indicator--2dbcef77-f556-4c93-92d8-f5278e1ed1b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.15.169.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:05:02.000Z",
      "valid_until": "2026-04-13T11:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-12T10:30:47.531Z",
      "x_nadsec_last_seen": "2026-03-23T07:37:20.315Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24173"
      ],
      "x_nadsec_orgs": [
        "Netnam Company"
      ]
    },
    {
      "created": "2026-03-12T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b1a85032-554a-4cfb-8f5a-0c8fc3962365",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.117.12.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:05:02.000Z",
      "valid_until": "2026-04-13T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T10:38:31.162Z",
      "x_nadsec_last_seen": "2026-03-12T10:40:35.884Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-12T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--7ca77ec9-e2d5-4824-8596-30d2955e5f31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.242.159.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:05:02.000Z",
      "valid_until": "2026-04-13T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T10:55:17.829Z",
      "x_nadsec_last_seen": "2026-03-12T10:57:24.263Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-12T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--92449b22-b8dd-465b-930a-a448109e0ec3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.203.230.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:05:02.000Z",
      "valid_until": "2026-04-13T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T10:30:42.200Z",
      "x_nadsec_last_seen": "2026-03-12T10:37:44.414Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-03-12T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=37018; asn_org=Galaxy Backbone",
      "id": "indicator--9a28f7f6-c04c-46b8-ae5c-d741568db9b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.159.65.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:05:02.000Z",
      "valid_until": "2026-04-13T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T10:26:34.949Z",
      "x_nadsec_last_seen": "2026-03-12T10:28:42.169Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37018"
      ],
      "x_nadsec_orgs": [
        "Galaxy Backbone"
      ]
    },
    {
      "created": "2026-03-12T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--4cda05ad-7151-40af-8784-63aa800a6592",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.120.235.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:05:02.000Z",
      "valid_until": "2026-04-13T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T10:15:13.879Z",
      "x_nadsec_last_seen": "2026-03-12T10:17:21.677Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4538"
      ],
      "x_nadsec_orgs": [
        "China Education and Research Network Center"
      ]
    },
    {
      "created": "2026-03-12T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=137085; asn_org=ANO Broadband Service Pvt Ltd",
      "id": "indicator--86cf4e15-ded4-4969-9ff8-bcfeb9ebaec7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.4.169.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:05:02.000Z",
      "valid_until": "2026-04-13T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T10:06:05.969Z",
      "x_nadsec_last_seen": "2026-03-12T10:06:05.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "137085"
      ],
      "x_nadsec_orgs": [
        "ANO Broadband Service Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-12T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=137085; asn_org=ANO Broadband Service Pvt Ltd",
      "id": "indicator--3b9905b5-80c9-40d7-8be2-f3149f9d5ce2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.4.169.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:05:02.000Z",
      "valid_until": "2026-04-13T11:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-12T10:06:06.267Z",
      "x_nadsec_last_seen": "2026-03-12T10:08:12.266Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "137085"
      ],
      "x_nadsec_orgs": [
        "ANO Broadband Service Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-12T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--8bf4f5d7-90a2-4781-91ed-d7a9a78e4ff3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.245.117.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:05:02.000Z",
      "valid_until": "2026-04-13T11:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T10:18:14.929Z",
      "x_nadsec_last_seen": "2026-03-12T10:18:15.159Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-12T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--0f7110e4-97c9-46d5-83d7-ec5f9b27eb68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.250.143.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:05:02.000Z",
      "valid_until": "2026-04-13T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T10:59:34.362Z",
      "x_nadsec_last_seen": "2026-03-12T10:59:40.717Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-12T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=197015; asn_org=Individual Entrepreneur Antipov Andrey Vyacheslavovich",
      "id": "indicator--d34c4a2d-7644-4904-9260-0ce063a13950",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.221.6.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T11:05:02.000Z",
      "valid_until": "2026-04-13T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T10:18:55.262Z",
      "x_nadsec_last_seen": "2026-03-12T10:26:12.544Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "197015"
      ],
      "x_nadsec_orgs": [
        "Individual Entrepreneur Antipov Andrey Vyacheslavovich"
      ]
    },
    {
      "created": "2026-03-12T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=132774; asn_org=Niss Internet services private limited",
      "id": "indicator--ae4f87a2-ac18-407e-a52d-42b7cad5ab4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.26.108.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:05:02.000Z",
      "valid_until": "2026-04-13T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T11:11:55.814Z",
      "x_nadsec_last_seen": "2026-03-12T11:16:08.828Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132774"
      ],
      "x_nadsec_orgs": [
        "Niss Internet services private limited"
      ]
    },
    {
      "created": "2026-03-12T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fe97b5f3-46d7-4106-afa4-250006a0e8ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.175.237.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:05:02.000Z",
      "valid_until": "2026-04-13T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T11:36:12.827Z",
      "x_nadsec_last_seen": "2026-03-12T11:42:34.809Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-12T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--a7b80ae8-e0a0-46da-be1b-d6ebb400bdae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.15.0.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:05:02.000Z",
      "valid_until": "2026-04-13T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T11:05:21.445Z",
      "x_nadsec_last_seen": "2026-03-12T11:05:22.370Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-12T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--87f5d282-dca2-4a51-9e10-5887938cce9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.146.103.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:05:02.000Z",
      "valid_until": "2026-04-13T12:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-12T11:30:55.909Z",
      "x_nadsec_last_seen": "2026-03-12T15:02:22.093Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-12T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PK; asn=135523; asn_org=Multinet Broadband; user(top)=**",
      "id": "indicator--255a1bb6-2f9a-44e9-9375-ec57e93eaec5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.141.251.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:05:02.000Z",
      "valid_until": "2026-04-13T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T11:17:06.764Z",
      "x_nadsec_last_seen": "2026-03-12T11:17:06.764Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "135523"
      ],
      "x_nadsec_orgs": [
        "Multinet Broadband"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-12T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JO; asn=9038; asn_org=Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co",
      "id": "indicator--e42dd931-fdb5-49ac-898c-92a7b92d2e25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.118.18.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:05:02.000Z",
      "valid_until": "2026-04-13T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T11:57:20.423Z",
      "x_nadsec_last_seen": "2026-03-12T12:01:48.200Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "9038"
      ],
      "x_nadsec_orgs": [
        "Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co"
      ]
    },
    {
      "created": "2026-03-12T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--2d440d19-3d39-4163-bc43-5f3163259b32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.171.45.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:05:02.000Z",
      "valid_until": "2026-04-13T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T11:47:18.440Z",
      "x_nadsec_last_seen": "2026-03-12T11:47:19.906Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-12T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=272102; asn_org=BESSER SOLUTIONS C.A.",
      "id": "indicator--b8ba774f-90dc-4bdb-a559-bfb4c05c1fc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.51.121.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:05:02.000Z",
      "valid_until": "2026-04-13T12:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-12T11:30:09.285Z",
      "x_nadsec_last_seen": "2026-03-24T23:04:27.218Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "272102"
      ],
      "x_nadsec_orgs": [
        "BESSER SOLUTIONS C.A."
      ]
    },
    {
      "created": "2026-03-12T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=268145; asn_org=IPV7 SERVICOS DE TELECOMUNICACOES BRASIL LTDA",
      "id": "indicator--36fd6e8d-68e2-4bee-9962-e2dac0f6b038",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.170.17.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:05:02.000Z",
      "valid_until": "2026-04-13T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T11:54:33.391Z",
      "x_nadsec_last_seen": "2026-03-12T12:01:34.692Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "268145"
      ],
      "x_nadsec_orgs": [
        "IPV7 SERVICOS DE TELECOMUNICACOES BRASIL LTDA"
      ]
    },
    {
      "created": "2026-03-12T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--65c5ab61-d35a-4bb4-811f-989de4592722",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.26.233.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:05:02.000Z",
      "valid_until": "2026-04-13T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T12:02:52.002Z",
      "x_nadsec_last_seen": "2026-03-12T12:11:03.783Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-12T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=44327; asn_org=Delta Comm LLC",
      "id": "indicator--d1e610b9-9123-40ae-a748-4404a69819f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.51.75.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:05:02.000Z",
      "valid_until": "2026-04-13T12:05:01.000Z",
      "x_nadsec_event_count": 30,
      "x_nadsec_first_seen": "2026-03-12T11:36:42.431Z",
      "x_nadsec_last_seen": "2026-03-20T05:08:57.947Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "44327"
      ],
      "x_nadsec_orgs": [
        "Delta Comm LLC"
      ]
    },
    {
      "created": "2026-03-12T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132924; asn_org=Ero Wide Comm Private Limited",
      "id": "indicator--32f0a8a4-e388-4ebd-8a40-629b203d4eb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.59.135.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:05:02.000Z",
      "valid_until": "2026-04-13T13:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-12T12:22:27.492Z",
      "x_nadsec_last_seen": "2026-03-26T10:46:04.520Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132924"
      ],
      "x_nadsec_orgs": [
        "Ero Wide Comm Private Limited"
      ]
    },
    {
      "created": "2026-03-12T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ee04cf3f-939e-4e0f-bb9f-888506a803fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '144.126.195.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:05:02.000Z",
      "valid_until": "2026-04-13T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T12:57:38.472Z",
      "x_nadsec_last_seen": "2026-03-12T12:57:38.472Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-12T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=ftpd; ports=21; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--cb5c86cc-71b1-473c-bd31-df0ccd806634",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.222.201.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:05:02.000Z",
      "valid_until": "2026-04-13T13:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-12T12:44:38.222Z",
      "x_nadsec_last_seen": "2026-03-12T12:44:39.126Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-12T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--ca6ad6f1-299b-4676-9274-c41672ebdd47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.45.102.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:05:02.000Z",
      "valid_until": "2026-04-13T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T12:14:03.010Z",
      "x_nadsec_last_seen": "2026-03-12T12:18:57.242Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-12T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--9a992da8-0669-40c0-9ada-304d14552518",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:05:02.000Z",
      "valid_until": "2026-04-13T13:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-12T12:11:51.543Z",
      "x_nadsec_last_seen": "2026-03-25T05:54:36.212Z",
      "x_nadsec_ports": [
        "1723",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-12T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=12989; asn_org=Black HOST Ltd",
      "id": "indicator--63ea2fe5-3504-4c42-91d1-bb2cfb1521fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:05:02.000Z",
      "valid_until": "2026-04-13T13:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-12T12:57:59.323Z",
      "x_nadsec_last_seen": "2026-03-30T14:39:17.892Z",
      "x_nadsec_ports": [
        "3306",
        "1723"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "12989"
      ],
      "x_nadsec_orgs": [
        "Black HOST Ltd"
      ]
    },
    {
      "created": "2026-03-12T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--406ccc66-5572-420f-a0e5-ef28ff6ca8a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:05:02.000Z",
      "valid_until": "2026-04-13T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T12:41:19.223Z",
      "x_nadsec_last_seen": "2026-03-12T12:41:19.223Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-12T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b2dc72f7-eb47-4830-be60-5aaf236a9d2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:05:02.000Z",
      "valid_until": "2026-04-13T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T12:41:18.483Z",
      "x_nadsec_last_seen": "2026-03-12T12:41:18.483Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-12T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--18bba2c8-ad7a-4095-b39a-6161505dd21b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:05:02.000Z",
      "valid_until": "2026-04-13T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T12:07:37.665Z",
      "x_nadsec_last_seen": "2026-03-12T12:07:37.665Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-12T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--67990007-465a-453e-ac52-5dce586e762c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:05:02.000Z",
      "valid_until": "2026-04-13T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T12:08:11.821Z",
      "x_nadsec_last_seen": "2026-03-12T12:08:11.821Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-12T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--31fc53a2-c87f-405e-97ea-9b6941c22ce5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:05:02.000Z",
      "valid_until": "2026-04-13T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T12:07:37.207Z",
      "x_nadsec_last_seen": "2026-03-12T12:08:01.462Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-12T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ac34cbd1-db60-4a54-a7b8-3a7620675808",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:05:02.000Z",
      "valid_until": "2026-04-13T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T12:46:35.208Z",
      "x_nadsec_last_seen": "2026-03-12T12:46:35.208Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-12T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--933a8451-e14f-4b1c-ad40-2fbba72f831c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:05:02.000Z",
      "valid_until": "2026-04-13T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T12:46:34.789Z",
      "x_nadsec_last_seen": "2026-03-24T14:56:00.804Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-12T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=48642; asn_org=Joint stock company For",
      "id": "indicator--da24ee09-9cab-4f86-8ad2-6601de8315a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.74.163.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:05:02.000Z",
      "valid_until": "2026-04-13T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T13:47:06.709Z",
      "x_nadsec_last_seen": "2026-03-12T13:49:14.024Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48642"
      ],
      "x_nadsec_orgs": [
        "Joint stock company For"
      ]
    },
    {
      "created": "2026-03-12T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--82cc622f-371f-41d5-851b-22a273809c4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.64.194.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:05:02.000Z",
      "valid_until": "2026-04-13T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T13:09:23.325Z",
      "x_nadsec_last_seen": "2026-03-12T13:09:23.325Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-12T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--48861b80-2455-458f-81ff-c2946c953bfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:05:02.000Z",
      "valid_until": "2026-04-13T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T13:46:19.119Z",
      "x_nadsec_last_seen": "2026-03-30T02:45:44.617Z",
      "x_nadsec_ports": [
        "445",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-12T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SE; asn=209896; asn_org=Contrust Solutions S.R.L.; user(top)=**; pass(top)=p******d",
      "id": "indicator--e8bb8e4a-fef3-4d63-8b83-c6dfaa75ae8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.239.146.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:05:02.000Z",
      "valid_until": "2026-04-13T14:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-12T13:46:22.873Z",
      "x_nadsec_last_seen": "2026-03-17T06:01:37.041Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "209896"
      ],
      "x_nadsec_orgs": [
        "Contrust Solutions S.R.L."
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "***",
        "s******t"
      ],
      "x_nadsec_passwords_attempted": [
        "L*****T",
        "H**********0",
        "T***********8",
        "T******1",
        "p******d"
      ]
    },
    {
      "created": "2026-03-12T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--c323b4ea-6f50-4b8e-aaac-eb1384cd8862",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.254.8.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:05:02.000Z",
      "valid_until": "2026-04-13T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T13:57:17.618Z",
      "x_nadsec_last_seen": "2026-03-12T13:59:24.222Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-12T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HU; asn=5483; asn_org=Magyar Telekom Plc.",
      "id": "indicator--2fa8eda3-d82b-441b-84a5-8d2de3a1f47b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.147.233.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:05:02.000Z",
      "valid_until": "2026-04-13T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T13:53:20.790Z",
      "x_nadsec_last_seen": "2026-03-12T13:55:27.702Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HU"
      ],
      "x_nadsec_asns": [
        "5483"
      ],
      "x_nadsec_orgs": [
        "Magyar Telekom Plc."
      ]
    },
    {
      "created": "2026-03-12T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=38511; asn_org=PT Remala Abadi",
      "id": "indicator--30362538-7260-4ce5-ad9a-c575cda0bd52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.255.157.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:05:02.000Z",
      "valid_until": "2026-04-13T15:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-12T14:17:27.042Z",
      "x_nadsec_last_seen": "2026-03-12T15:21:34.519Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "38511"
      ],
      "x_nadsec_orgs": [
        "PT Remala Abadi"
      ]
    },
    {
      "created": "2026-03-12T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=56042; asn_org=China Mobile communications corporation",
      "id": "indicator--f6ec95b9-2cd1-4c59-b1b2-6daad4a7add0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.53.182.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:05:02.000Z",
      "valid_until": "2026-04-13T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T15:00:41.136Z",
      "x_nadsec_last_seen": "2026-03-12T15:00:41.356Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56042"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-03-12T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MO; asn=4609; asn_org=Companhia de Telecomunicacoes de Macau SARL",
      "id": "indicator--8b7fb87e-e5e5-40f5-8063-3e0ef4e23709",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.31.41.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:05:02.000Z",
      "valid_until": "2026-04-13T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T14:55:06.580Z",
      "x_nadsec_last_seen": "2026-03-12T14:55:06.781Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MO"
      ],
      "x_nadsec_asns": [
        "4609"
      ],
      "x_nadsec_orgs": [
        "Companhia de Telecomunicacoes de Macau SARL"
      ]
    },
    {
      "created": "2026-03-12T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=48687; asn_org=Aleksandr Bobrichenko",
      "id": "indicator--08e12397-50a1-4c90-8542-caee0b33c958",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '151.0.53.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:05:02.000Z",
      "valid_until": "2026-04-13T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T14:45:33.657Z",
      "x_nadsec_last_seen": "2026-03-12T14:47:41.079Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48687"
      ],
      "x_nadsec_orgs": [
        "Aleksandr Bobrichenko"
      ]
    },
    {
      "created": "2026-03-12T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=24812; asn_org=RPC HomeNet Ltd.",
      "id": "indicator--d7f841a1-9c3d-4b8b-b2fb-485e8f2e6319",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.105.206.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:05:02.000Z",
      "valid_until": "2026-04-13T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T14:57:03.090Z",
      "x_nadsec_last_seen": "2026-03-12T14:59:09.126Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "24812"
      ],
      "x_nadsec_orgs": [
        "RPC HomeNet Ltd."
      ]
    },
    {
      "created": "2026-03-12T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--31f8a10d-11ee-42f4-b823-67bcd1aaee2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.136.119.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:05:02.000Z",
      "valid_until": "2026-04-13T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T14:35:52.674Z",
      "x_nadsec_last_seen": "2026-03-12T14:37:58.182Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-12T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28573; asn_org=Claro NXT Telecomunicacoes Ltda",
      "id": "indicator--00415676-0d2c-4691-a172-df1f2cc64b15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.7.126.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:05:02.000Z",
      "valid_until": "2026-04-13T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T14:05:27.654Z",
      "x_nadsec_last_seen": "2026-03-12T14:07:34.778Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28573"
      ],
      "x_nadsec_orgs": [
        "Claro NXT Telecomunicacoes Ltda"
      ]
    },
    {
      "created": "2026-03-12T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=5429; asn_org=Telecommunications center UMOS, LLC",
      "id": "indicator--7ee2eeb2-5281-456b-be4f-858856d87b06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.178.216.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:05:02.000Z",
      "valid_until": "2026-04-13T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T14:36:18.501Z",
      "x_nadsec_last_seen": "2026-03-12T14:38:24.989Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "5429"
      ],
      "x_nadsec_orgs": [
        "Telecommunications center UMOS, LLC"
      ]
    },
    {
      "created": "2026-03-12T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--bad611bf-1181-4b47-acc6-3d73955b0507",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.210.52.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T15:05:02.000Z",
      "valid_until": "2026-04-13T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T14:57:04.373Z",
      "x_nadsec_last_seen": "2026-03-12T14:59:14.975Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-12T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--33b47e3f-1dfb-4702-9165-b187d4f6429e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.39.98.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:05:02.000Z",
      "valid_until": "2026-04-13T16:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-12T15:41:29.950Z",
      "x_nadsec_last_seen": "2026-03-12T17:59:48.986Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-12T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=9658; asn_org=Eastern Telecoms Phils., Inc.",
      "id": "indicator--0f86822c-1932-44a5-a424-4a7efa050eea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.50.235.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:05:02.000Z",
      "valid_until": "2026-04-13T16:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-12T15:33:54.854Z",
      "x_nadsec_last_seen": "2026-03-15T04:25:03.924Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9658"
      ],
      "x_nadsec_orgs": [
        "Eastern Telecoms Phils., Inc."
      ]
    },
    {
      "created": "2026-03-12T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2b017970-4caf-4b39-8e5d-c60e6847c85f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.172.90.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:05:02.000Z",
      "valid_until": "2026-04-13T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T15:21:15.164Z",
      "x_nadsec_last_seen": "2026-03-12T15:21:15.164Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-12T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=270678; asn_org=W.B.G INFORMATICA E TELECOMUNICACOES EIRELI",
      "id": "indicator--620f70f8-bdff-417a-af11-5d32a087d35f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.221.189.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:05:02.000Z",
      "valid_until": "2026-04-13T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T15:34:18.668Z",
      "x_nadsec_last_seen": "2026-03-12T15:41:21.131Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "270678"
      ],
      "x_nadsec_orgs": [
        "W.B.G INFORMATICA E TELECOMUNICACOES EIRELI"
      ]
    },
    {
      "created": "2026-03-12T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=28573; asn_org=Claro NXT Telecomunicacoes Ltda",
      "id": "indicator--a59c77d9-af0b-4cca-bf0b-025ebe455113",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.32.27.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:05:02.000Z",
      "valid_until": "2026-04-13T16:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-12T15:33:38.827Z",
      "x_nadsec_last_seen": "2026-03-12T16:17:54.105Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28573"
      ],
      "x_nadsec_orgs": [
        "Claro NXT Telecomunicacoes Ltda"
      ]
    },
    {
      "created": "2026-03-12T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c4a1998a-c763-4996-80b0-31f5aac1ad6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:05:02.000Z",
      "valid_until": "2026-04-13T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T15:21:17.173Z",
      "x_nadsec_last_seen": "2026-03-29T17:32:10.557Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-12T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--4639261c-4ce4-4195-8da0-1ac26b272dc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.180.55.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:05:02.000Z",
      "valid_until": "2026-04-13T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T15:56:59.512Z",
      "x_nadsec_last_seen": "2026-03-12T15:59:06.430Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-12T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--a890ea9d-abb8-4430-b21c-12bbb949c2a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.232.157.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T17:05:04.000Z",
      "valid_until": "2026-04-13T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T16:35:52.159Z",
      "x_nadsec_last_seen": "2026-03-12T16:35:58.586Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-12T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--dee185cb-1ba3-4e6f-b7c6-f79ba4772131",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T17:05:04.000Z",
      "valid_until": "2026-04-13T17:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-12T16:27:52.311Z",
      "x_nadsec_last_seen": "2026-03-20T15:19:37.453Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-12T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25159; asn_org=PJSC MegaFon",
      "id": "indicator--c2de82f0-2c39-4165-aa21-a62596770480",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.173.84.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T17:05:04.000Z",
      "valid_until": "2026-04-13T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T16:30:15.537Z",
      "x_nadsec_last_seen": "2026-03-12T16:32:22.675Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25159"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-12T17:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--ba544025-1fd6-49d1-b810-dde8363986ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T17:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.99.138.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T17:05:04.000Z",
      "valid_until": "2026-04-13T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T16:28:30.292Z",
      "x_nadsec_last_seen": "2026-03-12T16:30:36.835Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-03-12T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--2c61a222-c470-4a8b-9fce-daa9d49e5f5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.144.170.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T18:05:17.000Z",
      "valid_until": "2026-04-13T18:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T17:11:59.833Z",
      "x_nadsec_last_seen": "2026-03-12T17:14:05.863Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-03-12T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--4db76c70-58e2-4008-8cc6-0e94421dbd15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.203.77.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T18:05:17.000Z",
      "valid_until": "2026-04-13T18:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T17:30:23.560Z",
      "x_nadsec_last_seen": "2026-03-12T17:32:29.092Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-12T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=52858; asn_org=A & G Servicos em TI",
      "id": "indicator--277d8f07-cea0-497c-8f2e-15cb00827a18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.59.248.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T18:05:17.000Z",
      "valid_until": "2026-04-13T18:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T17:48:02.094Z",
      "x_nadsec_last_seen": "2026-03-12T17:55:14.883Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52858"
      ],
      "x_nadsec_orgs": [
        "A & G Servicos em TI"
      ]
    },
    {
      "created": "2026-03-12T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--415ce6da-1a72-4500-b963-8930515a0681",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.215.99.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T18:05:17.000Z",
      "valid_until": "2026-04-13T18:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T17:17:25.186Z",
      "x_nadsec_last_seen": "2026-03-12T17:19:32.483Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-12T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ce5317c3-1bf5-42c7-9b8b-ac3c0a220f75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T18:05:17.000Z",
      "valid_until": "2026-04-13T18:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T17:47:42.907Z",
      "x_nadsec_last_seen": "2026-03-12T17:47:42.907Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-12T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=273490; asn_org=FIBRION INTERNET LTDA",
      "id": "indicator--e793213d-28c6-4e8d-a745-eb42af1e4c5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.229.238.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T18:05:17.000Z",
      "valid_until": "2026-04-13T18:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T17:56:10.367Z",
      "x_nadsec_last_seen": "2026-03-12T17:56:16.913Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "273490"
      ],
      "x_nadsec_orgs": [
        "FIBRION INTERNET LTDA"
      ]
    },
    {
      "created": "2026-03-12T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mongod; ports=27017; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--8ff9a662-1b4f-4146-8903-ae3e6c8fb669",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.145.23.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T18:05:17.000Z",
      "valid_until": "2026-04-13T18:05:02.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-12T17:11:23.262Z",
      "x_nadsec_last_seen": "2026-03-12T17:24:46.085Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-12T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=AU; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--ebf369a2-1be8-482f-81f1-07236a807e6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.66.73.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T18:05:17.000Z",
      "valid_until": "2026-04-13T18:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T17:33:04.600Z",
      "x_nadsec_last_seen": "2026-03-12T17:33:04.600Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-12T18:05:17.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T18:05:17.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T18:05:17.000Z",
      "valid_until": "2026-04-13T18:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T18:02:06.179Z",
      "x_nadsec_last_seen": "2026-03-26T01:35:44.173Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-03-12T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--c094baea-f47f-4e5c-86fd-250247786ce3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.82.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:05:05.000Z",
      "valid_until": "2026-04-13T20:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T19:13:51.793Z",
      "x_nadsec_last_seen": "2026-03-12T19:22:05.644Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-12T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=55990; asn_org=Huawei Cloud Service data center",
      "id": "indicator--bf4841c0-6f85-4bd5-9b59-1402fc86b5df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.175.227.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:05:05.000Z",
      "valid_until": "2026-04-13T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T19:56:45.738Z",
      "x_nadsec_last_seen": "2026-03-12T19:58:51.589Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "55990"
      ],
      "x_nadsec_orgs": [
        "Huawei Cloud Service data center"
      ]
    },
    {
      "created": "2026-03-12T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--388a2a48-fffd-4c99-acab-dd06ecd412e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.36.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:05:05.000Z",
      "valid_until": "2026-04-13T20:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-12T19:41:42.916Z",
      "x_nadsec_last_seen": "2026-03-30T19:24:20.513Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-12T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28295; asn_org=Diagnosticos da America S.A.",
      "id": "indicator--c6bb1f16-f944-49d5-b6e2-a02fbe578f43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.39.66.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:05:05.000Z",
      "valid_until": "2026-04-13T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T19:45:51.468Z",
      "x_nadsec_last_seen": "2026-03-12T19:47:57.949Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28295"
      ],
      "x_nadsec_orgs": [
        "Diagnosticos da America S.A."
      ]
    },
    {
      "created": "2026-03-12T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7b7974de-6889-4790-801e-b18cffda12e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:05:05.000Z",
      "valid_until": "2026-04-13T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T19:18:01.296Z",
      "x_nadsec_last_seen": "2026-03-27T03:31:30.005Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-12T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KW; asn=42961; asn_org=Mobile Telecommunications Company K.S.C.P.",
      "id": "indicator--5033c490-d393-4637-a037-520802312357",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.39.185.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:05:05.000Z",
      "valid_until": "2026-04-13T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T19:40:45.503Z",
      "x_nadsec_last_seen": "2026-03-12T19:42:52.857Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KW"
      ],
      "x_nadsec_asns": [
        "42961"
      ],
      "x_nadsec_orgs": [
        "Mobile Telecommunications Company K.S.C.P."
      ]
    },
    {
      "created": "2026-03-12T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=10796; asn_org=Charter Communications Inc",
      "id": "indicator--80f0ee45-82c8-47e9-a1f6-f4b8637f0a17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '70.62.243.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:05:05.000Z",
      "valid_until": "2026-04-13T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T19:29:30.649Z",
      "x_nadsec_last_seen": "2026-03-12T19:31:36.240Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10796"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-03-12T20:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--f4a19e9a-3c93-4463-ad13-b408524e259b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T20:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.122.149.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T20:05:05.000Z",
      "valid_until": "2026-04-13T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-12T19:59:14.149Z",
      "x_nadsec_last_seen": "2026-03-12T19:59:14.442Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-12T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--b38b22e4-9962-4607-8999-c55602eaa719",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.4.171.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T23:05:14.000Z",
      "valid_until": "2026-04-13T23:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-12T22:40:13.767Z",
      "x_nadsec_last_seen": "2026-03-12T22:42:18.376Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-12T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134319; asn_org=Elyzium Technologies Pvt. Ltd.",
      "id": "indicator--07210257-fd94-4fb5-a803-52424e133199",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.206.129.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T23:05:14.000Z",
      "valid_until": "2026-04-13T23:05:06.000Z",
      "x_nadsec_event_count": 25,
      "x_nadsec_first_seen": "2026-03-12T22:36:56.798Z",
      "x_nadsec_last_seen": "2026-03-21T00:50:37.230Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134319"
      ],
      "x_nadsec_orgs": [
        "Elyzium Technologies Pvt. Ltd."
      ]
    },
    {
      "created": "2026-03-12T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=61944; asn_org=FFA SOLUCOES TECNOLOGICAS LTDA - ME",
      "id": "indicator--53ae047f-14ca-45cd-9f08-4cd46df64d36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.131.95.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T23:05:14.000Z",
      "valid_until": "2026-04-13T23:05:06.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-12T22:36:17.500Z",
      "x_nadsec_last_seen": "2026-03-13T10:28:01.120Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "61944"
      ],
      "x_nadsec_orgs": [
        "FFA SOLUCOES TECNOLOGICAS LTDA - ME"
      ]
    },
    {
      "created": "2026-03-12T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CO; asn=19429; asn_org=Colombia",
      "id": "indicator--19a4f6ec-c2d7-4e97-8cfe-806b2ae28adb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.244.17.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T23:05:14.000Z",
      "valid_until": "2026-04-13T23:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-12T22:49:57.314Z",
      "x_nadsec_last_seen": "2026-03-12T22:49:57.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "19429"
      ],
      "x_nadsec_orgs": [
        "Colombia"
      ]
    },
    {
      "created": "2026-03-12T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PL; asn=201814; asn_org=MEVSPACE sp. z o.o.",
      "id": "indicator--bf1bab8a-3e1d-4f78-b72c-64c0ae495e76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.23.222.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T23:05:14.000Z",
      "valid_until": "2026-04-13T23:05:06.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-12T22:58:01.607Z",
      "x_nadsec_last_seen": "2026-03-15T04:49:39.502Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "201814"
      ],
      "x_nadsec_orgs": [
        "MEVSPACE sp. z o.o."
      ]
    },
    {
      "created": "2026-03-12T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=52318; asn_org=Agencia de Sistemas de Informacion, Gobierno de la Ciudad Autonoma de Buenos Aires",
      "id": "indicator--5f459f8e-3966-4b20-938a-37b985d5eab4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.237.52.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T23:05:14.000Z",
      "valid_until": "2026-04-13T23:05:06.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T22:15:40.136Z",
      "x_nadsec_last_seen": "2026-03-12T22:25:03.315Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "52318"
      ],
      "x_nadsec_orgs": [
        "Agencia de Sistemas de Informacion, Gobierno de la Ciudad Autonoma de Buenos Aires"
      ]
    },
    {
      "created": "2026-03-12T23:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--42695438-7475-4010-b786-6e66e785ad7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-12T23:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.50.136.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T23:05:14.000Z",
      "valid_until": "2026-04-13T23:05:06.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-12T22:28:56.153Z",
      "x_nadsec_last_seen": "2026-03-12T22:37:10.070Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-03-13T05:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=17665; asn_org=ONEOTT INTERTAINMENT LIMITED",
      "id": "indicator--259d3fe3-461d-4046-9c24-dc20adf37ebc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T05:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.136.172.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T05:05:20.000Z",
      "valid_until": "2026-04-14T05:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T04:12:42.121Z",
      "x_nadsec_last_seen": "2026-03-13T04:12:42.121Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17665"
      ],
      "x_nadsec_orgs": [
        "ONEOTT INTERTAINMENT LIMITED"
      ]
    },
    {
      "created": "2026-03-13T05:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PH; asn=134788; asn_org=Parasat Cable TV, Inc",
      "id": "indicator--f02d1cda-dc24-472c-a230-17bcb7e5f2d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T05:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.187.245.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T05:05:20.000Z",
      "valid_until": "2026-04-14T05:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T04:56:31.529Z",
      "x_nadsec_last_seen": "2026-03-13T04:56:31.529Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "134788"
      ],
      "x_nadsec_orgs": [
        "Parasat Cable TV, Inc"
      ]
    },
    {
      "created": "2026-03-13T05:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LA; asn=9873; asn_org=Lao Telecom Communication, LTC",
      "id": "indicator--87b76479-e1e8-42fa-89a8-db7a59542f03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T05:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.84.87.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T05:05:20.000Z",
      "valid_until": "2026-04-14T05:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T04:23:29.516Z",
      "x_nadsec_last_seen": "2026-03-13T04:23:34.192Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "9873"
      ],
      "x_nadsec_orgs": [
        "Lao Telecom Communication, LTC"
      ]
    },
    {
      "created": "2026-03-13T05:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--7ea89bef-99bb-48dd-a90b-a29394836f41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T05:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.68.174.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T05:05:20.000Z",
      "valid_until": "2026-04-14T05:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T04:48:25.719Z",
      "x_nadsec_last_seen": "2026-03-13T04:50:30.927Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-13T05:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262318; asn_org=AS262318",
      "id": "indicator--b3b524b4-ef93-4752-8ca3-d966a2b47287",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T05:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.124.57.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T05:05:20.000Z",
      "valid_until": "2026-04-14T05:05:06.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-13T04:16:25.068Z",
      "x_nadsec_last_seen": "2026-03-19T20:16:49.861Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262318"
      ],
      "x_nadsec_orgs": [
        "AS262318"
      ]
    },
    {
      "created": "2026-03-13T05:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PY; asn=27768; asn_org=COMPANIA PARAGUAYA DE COMUNICACIONES S.A. COPACO S.A.",
      "id": "indicator--c3178270-7848-43e7-9b77-f6a809b86b7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T05:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.217.24.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T05:05:20.000Z",
      "valid_until": "2026-04-14T05:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T04:30:26.991Z",
      "x_nadsec_last_seen": "2026-03-13T04:32:34.653Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "27768"
      ],
      "x_nadsec_orgs": [
        "COMPANIA PARAGUAYA DE COMUNICACIONES S.A. COPACO S.A."
      ]
    },
    {
      "created": "2026-03-13T05:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=38758; asn_org=PT. HIPERNET INDODATA",
      "id": "indicator--5bbea19a-b9b1-4bb6-8f61-21a0731e8765",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T05:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.180.17.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T05:05:20.000Z",
      "valid_until": "2026-04-14T05:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T04:55:34.618Z",
      "x_nadsec_last_seen": "2026-03-13T04:55:34.618Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "38758"
      ],
      "x_nadsec_orgs": [
        "PT. HIPERNET INDODATA"
      ]
    },
    {
      "created": "2026-03-13T05:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f07d1bea-166c-4efe-8903-2865407cf9ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T05:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T05:05:20.000Z",
      "valid_until": "2026-04-14T05:05:06.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T05:01:50.599Z",
      "x_nadsec_last_seen": "2026-03-13T05:01:50.599Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-13T05:05:20.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=12322; asn_org=Free SAS",
      "id": "indicator--533c7972-3555-4a07-a6e5-ab5f58b12698",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T05:05:20.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.65.165.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T05:05:20.000Z",
      "valid_until": "2026-04-14T05:05:06.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-13T05:04:10.052Z",
      "x_nadsec_last_seen": "2026-03-13T05:27:43.543Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "12322"
      ],
      "x_nadsec_orgs": [
        "Free SAS"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--6af1dbdc-e171-4d88-9a28-8992564855c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.52.111.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T09:13:58.194Z",
      "x_nadsec_last_seen": "2026-03-13T09:16:03.547Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--9b8ff0f0-232d-494f-8f38-38806791c990",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.188.245.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-13T09:28:51.858Z",
      "x_nadsec_last_seen": "2026-03-13T09:28:52.170Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--6beb4854-05b1-4550-9905-65bb1a9fee14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.69.67.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-13T08:42:37.559Z",
      "x_nadsec_last_seen": "2026-03-13T09:39:26.196Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--d9a758fb-c6a5-4e44-aaaa-5fff53ac0938",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.165.66.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-13T09:33:37.286Z",
      "x_nadsec_last_seen": "2026-03-13T09:40:15.032Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--28ccd618-0eaa-4937-87d9-25713cc70c83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-13T07:32:57.524Z",
      "x_nadsec_last_seen": "2026-03-17T14:28:28.987Z",
      "x_nadsec_ports": [
        "21",
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2bdb8ad3-cc9a-4b94-8a48-24442c3d7167",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-13T09:29:14.672Z",
      "x_nadsec_last_seen": "2026-03-14T10:32:37.955Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4811; asn_org=China Telecom Group",
      "id": "indicator--fc09f173-f0e1-4026-a53e-c3bdb0513148",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '175.102.15.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T09:12:06.951Z",
      "x_nadsec_last_seen": "2026-03-13T09:14:13.618Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4811"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=RO; asn=42397; asn_org=Bunea TELECOM SRL",
      "id": "indicator--91240d29-83aa-408b-9079-13541ec20fc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.29.13.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-13T09:14:50.165Z",
      "x_nadsec_last_seen": "2026-03-13T12:34:56.617Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "42397"
      ],
      "x_nadsec_orgs": [
        "Bunea TELECOM SRL"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CK; asn=14593; asn_org=Space Exploration Technologies Corporation; user(top)=r**t; pass(top)=0****9",
      "id": "indicator--f12d0454-2e4e-4f4b-b5b4-04b774bb6b13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.83.127.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T09:43:32.101Z",
      "x_nadsec_last_seen": "2026-03-13T09:43:32.101Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CK"
      ],
      "x_nadsec_asns": [
        "14593"
      ],
      "x_nadsec_orgs": [
        "Space Exploration Technologies Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "0****9"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KR; asn=3786; asn_org=LG DACOM Corporation",
      "id": "indicator--32158894-1c29-4c6a-b485-d8732a392c5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.118.203.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T09:10:09.375Z",
      "x_nadsec_last_seen": "2026-03-13T09:12:14.146Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "3786"
      ],
      "x_nadsec_orgs": [
        "LG DACOM Corporation"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=53; services=ftpd; ports=21; cc=JP; asn=9600; asn_org=So-net Corporation; user(top)=A***n; pass(top)=a*******s",
      "id": "indicator--bca8683d-230f-4096-b3f5-60999f1b5043",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.9.57.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 464,
      "x_nadsec_first_seen": "2026-03-13T08:24:30.440Z",
      "x_nadsec_last_seen": "2026-03-13T16:26:08.318Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "9600"
      ],
      "x_nadsec_orgs": [
        "So-net Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**",
        "d**a",
        "t**t",
        "w******a",
        "A***n"
      ],
      "x_nadsec_passwords_attempted": [
        "r**t",
        "1****3",
        "***",
        "1*******9",
        "1*****0"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=60; services=ftpd; ports=21; cc=JP; asn=9600; asn_org=So-net Corporation; user(top)=A***n; pass(top)=1****6",
      "id": "indicator--9fd6b568-736b-4e61-9cf6-69265f43e61f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.9.57.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 467,
      "x_nadsec_first_seen": "2026-03-13T08:25:22.493Z",
      "x_nadsec_last_seen": "2026-03-13T16:27:42.852Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "9600"
      ],
      "x_nadsec_orgs": [
        "So-net Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "***",
        "w*****t",
        "a*******s",
        "a***********r",
        "u**r"
      ],
      "x_nadsec_passwords_attempted": [
        "q****3",
        "r**t",
        "1**4",
        "a*******6",
        "d***y"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--dbb101ee-21de-43e2-8ce9-818453bf279d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.137.2.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T09:15:16.910Z",
      "x_nadsec_last_seen": "2026-03-13T09:17:22.466Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=136384; asn_org=Optix Pakistan Pvt. Limited",
      "id": "indicator--c1e09898-a73a-44db-8647-ed4551e09cb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.251.255.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T09:46:06.133Z",
      "x_nadsec_last_seen": "2026-03-13T09:48:12.513Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "136384"
      ],
      "x_nadsec_orgs": [
        "Optix Pakistan Pvt. Limited"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=16637; asn_org=MTN Business Solutions",
      "id": "indicator--cad97166-1815-465c-b40f-439bb75959e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.8.6.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-13T09:59:54.145Z",
      "x_nadsec_last_seen": "2026-03-14T21:12:01.124Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "16637"
      ],
      "x_nadsec_orgs": [
        "MTN Business Solutions"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--acd877eb-4c8b-4138-98c2-70d52b947eef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.189.91.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T09:27:54.692Z",
      "x_nadsec_last_seen": "2026-03-13T09:30:01.649Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AT; asn=8447; asn_org=Telekom Austria",
      "id": "indicator--b21059f6-2773-491d-a18d-0db8dc6a1851",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.120.30.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-13T09:51:29.956Z",
      "x_nadsec_last_seen": "2026-03-13T09:51:30.366Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AT"
      ],
      "x_nadsec_asns": [
        "8447"
      ],
      "x_nadsec_orgs": [
        "Telekom Austria"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--6ea87418-cb8f-443c-af06-c9ba93010e0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.105.200.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-13T09:39:59.554Z",
      "x_nadsec_last_seen": "2026-03-13T11:16:42.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-13T10:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=41134; asn_org=Rostelecom",
      "id": "indicator--6a230bbd-5f6e-4d58-b7d7-e21227f86b1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T10:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.107.1.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T10:05:56.000Z",
      "valid_until": "2026-04-14T10:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-13T09:51:16.939Z",
      "x_nadsec_last_seen": "2026-03-13T09:52:33.095Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "41134"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-13T13:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--4d1b3ee1-b8d0-408c-b16d-148951dd2a06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T13:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.41.105.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T13:05:29.000Z",
      "valid_until": "2026-04-14T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T12:30:13.080Z",
      "x_nadsec_last_seen": "2026-03-13T12:32:19.981Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-13T13:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=138625; asn_org=Dreams Network & Technology Pvt Ltd",
      "id": "indicator--4a64ac30-59bb-4a6d-8218-99a2ec842773",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T13:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.162.91.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T13:05:29.000Z",
      "valid_until": "2026-04-14T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T12:46:53.806Z",
      "x_nadsec_last_seen": "2026-03-13T12:46:53.806Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "138625"
      ],
      "x_nadsec_orgs": [
        "Dreams Network & Technology Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-13T13:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=132165; asn_org=Connect Communications",
      "id": "indicator--c3e14c80-4e5b-4874-bf5c-09228117c9c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T13:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.246.108.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T13:05:29.000Z",
      "valid_until": "2026-04-14T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T12:08:17.230Z",
      "x_nadsec_last_seen": "2026-03-13T12:10:23.436Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "132165"
      ],
      "x_nadsec_orgs": [
        "Connect Communications"
      ]
    },
    {
      "created": "2026-03-13T13:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45804; asn_org=MEGHBELA BROADBAND",
      "id": "indicator--2b958250-a37f-4a13-9010-9d1da03ca83f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T13:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.70.45.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T13:05:29.000Z",
      "valid_until": "2026-04-14T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T12:44:05.224Z",
      "x_nadsec_last_seen": "2026-03-13T12:46:10.096Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45804"
      ],
      "x_nadsec_orgs": [
        "MEGHBELA BROADBAND"
      ]
    },
    {
      "created": "2026-03-13T13:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=4761; asn_org=INDOSAT Internet Network Provider",
      "id": "indicator--d9b721fd-e92a-4537-87a9-86f06931dbbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T13:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.9.50.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T13:05:29.000Z",
      "valid_until": "2026-04-14T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-13T12:42:06.709Z",
      "x_nadsec_last_seen": "2026-03-13T12:48:56.202Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4761"
      ],
      "x_nadsec_orgs": [
        "INDOSAT Internet Network Provider"
      ]
    },
    {
      "created": "2026-03-13T13:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--22522415-409e-46b1-895a-ac035057924b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T13:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.174.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T13:05:29.000Z",
      "valid_until": "2026-04-14T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T12:19:28.491Z",
      "x_nadsec_last_seen": "2026-03-13T12:19:28.491Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-13T13:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=LK; asn=18001; asn_org=Dialog Axiata PLC.",
      "id": "indicator--355a8382-7bb8-4c45-8a4a-76f6faf4bd69",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T13:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '175.157.157.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T13:05:29.000Z",
      "valid_until": "2026-04-14T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T12:26:17.774Z",
      "x_nadsec_last_seen": "2026-03-13T12:26:17.774Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "18001"
      ],
      "x_nadsec_orgs": [
        "Dialog Axiata PLC."
      ]
    },
    {
      "created": "2026-03-13T13:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=28618; asn_org=Linktel Telecom do Brasil Ltda",
      "id": "indicator--20002a64-5f3b-41b7-93b0-b4d8d66c8fe8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T13:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.152.130.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T13:05:29.000Z",
      "valid_until": "2026-04-14T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-13T12:11:28.996Z",
      "x_nadsec_last_seen": "2026-03-13T12:18:57.001Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28618"
      ],
      "x_nadsec_orgs": [
        "Linktel Telecom do Brasil Ltda"
      ]
    },
    {
      "created": "2026-03-13T13:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--3e1d841e-350c-4f2b-928b-4ab036068978",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T13:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.218.94.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T13:05:29.000Z",
      "valid_until": "2026-04-14T13:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-13T12:05:08.140Z",
      "x_nadsec_last_seen": "2026-03-13T12:05:08.705Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-13T13:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--921816bf-290a-4046-834c-7181a977503e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T13:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.155.87.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T13:05:29.000Z",
      "valid_until": "2026-04-14T13:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-13T12:49:25.496Z",
      "x_nadsec_last_seen": "2026-03-14T08:32:06.531Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-13T13:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KE; asn=36866; asn_org=JTL",
      "id": "indicator--c43823d6-4789-4dbd-b130-42787e92937d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T13:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.232.109.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T13:05:29.000Z",
      "valid_until": "2026-04-14T13:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-13T12:54:31.796Z",
      "x_nadsec_last_seen": "2026-03-13T12:55:35.915Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "36866"
      ],
      "x_nadsec_orgs": [
        "JTL"
      ]
    },
    {
      "created": "2026-03-13T13:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=16135; asn_org=Turkcell Iletisim Hizmetleri A.s.",
      "id": "indicator--adc4aa87-9bef-4d0f-bc5b-7c5432791c25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T13:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.141.253.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T13:05:29.000Z",
      "valid_until": "2026-04-14T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-13T12:52:43.893Z",
      "x_nadsec_last_seen": "2026-03-13T13:00:23.413Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "16135"
      ],
      "x_nadsec_orgs": [
        "Turkcell Iletisim Hizmetleri A.s."
      ]
    },
    {
      "created": "2026-03-13T13:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MA; asn=36903; asn_org=MT-MPLS; user(top)=**",
      "id": "indicator--a1eb049d-cd75-4047-80fc-3689149707b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T13:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.143.68.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T13:05:29.000Z",
      "valid_until": "2026-04-14T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T12:31:44.437Z",
      "x_nadsec_last_seen": "2026-03-13T12:31:44.437Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-13T13:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KZ; asn=41798; asn_org=JSC Transtelecom",
      "id": "indicator--3c10557a-8181-4b08-9be7-fb9f68757d32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T13:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.255.208.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T13:05:29.000Z",
      "valid_until": "2026-04-14T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-13T12:24:36.763Z",
      "x_nadsec_last_seen": "2026-03-13T12:31:49.267Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "41798"
      ],
      "x_nadsec_orgs": [
        "JSC Transtelecom"
      ]
    },
    {
      "created": "2026-03-13T13:05:29.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PL; asn=201814; asn_org=MEVSPACE sp. z o.o.",
      "id": "indicator--c174dbca-90c0-44f3-b7fb-7c45b0618bb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T13:05:29.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.214.55.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T13:05:29.000Z",
      "valid_until": "2026-04-14T13:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-13T12:11:06.046Z",
      "x_nadsec_last_seen": "2026-03-17T08:40:16.187Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "201814"
      ],
      "x_nadsec_orgs": [
        "MEVSPACE sp. z o.o."
      ]
    },
    {
      "created": "2026-03-13T14:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--a37432e9-6d17-4646-b86e-d3414e1f56bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T14:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.89.23.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T14:05:14.000Z",
      "valid_until": "2026-04-14T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-13T13:04:59.522Z",
      "x_nadsec_last_seen": "2026-03-13T13:13:45.597Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-13T14:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mongod; ports=27017; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2f6e1115-df8e-4d55-81e7-6c1b1e636f42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T14:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.193.46.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T14:05:14.000Z",
      "valid_until": "2026-04-14T14:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-13T13:27:24.244Z",
      "x_nadsec_last_seen": "2026-03-13T13:27:41.502Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-13T14:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--4b559977-fe68-4bbd-9181-f0c09f735b33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T14:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T14:05:14.000Z",
      "valid_until": "2026-04-14T14:05:01.000Z",
      "x_nadsec_event_count": 70,
      "x_nadsec_first_seen": "2026-03-13T13:53:31.036Z",
      "x_nadsec_last_seen": "2026-03-27T08:06:46.641Z",
      "x_nadsec_ports": [
        "1433",
        "27017",
        "3306",
        "135",
        "81",
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mongod",
        "mysqld",
        "epmapper",
        "httpd",
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-03-13T14:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--5dcdfcbc-766a-42e9-838b-00082db7b4d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T14:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.21.159.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T14:05:14.000Z",
      "valid_until": "2026-04-14T14:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-13T13:19:54.816Z",
      "x_nadsec_last_seen": "2026-03-14T18:47:20.907Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-13T14:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e8963841-28c6-429e-842d-3a3e22f9822e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T14:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T14:05:14.000Z",
      "valid_until": "2026-04-14T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T13:33:14.928Z",
      "x_nadsec_last_seen": "2026-03-13T13:33:14.928Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-13T14:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--bd9ec3ed-b696-4249-b5fd-e7f4a9034874",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T14:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T14:05:14.000Z",
      "valid_until": "2026-04-14T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T13:33:14.591Z",
      "x_nadsec_last_seen": "2026-03-13T13:33:14.591Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-13T14:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--e541779d-8352-4c54-8eb0-67b1fbdbc90f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T14:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.57.161.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T14:05:14.000Z",
      "valid_until": "2026-04-14T14:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-13T13:46:40.272Z",
      "x_nadsec_last_seen": "2026-03-14T19:46:56.306Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-03-13T14:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=29072; asn_org=Regional Digital Telecommunication Company LLC",
      "id": "indicator--2a70f2df-5fd0-45fc-ae0b-902aa02610ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T14:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.220.163.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T14:05:14.000Z",
      "valid_until": "2026-04-14T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T13:57:00.219Z",
      "x_nadsec_last_seen": "2026-03-13T13:59:07.820Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "29072"
      ],
      "x_nadsec_orgs": [
        "Regional Digital Telecommunication Company LLC"
      ]
    },
    {
      "created": "2026-03-13T14:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T14:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T14:05:14.000Z",
      "valid_until": "2026-04-14T14:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-13T13:45:28.033Z",
      "x_nadsec_last_seen": "2026-03-28T12:36:35.653Z",
      "x_nadsec_ports": [
        "445",
        "27017",
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "mongod",
        "smbd",
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-13T14:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=215607; asn_org=dataforest GmbH",
      "id": "indicator--e2cb4b30-092a-4ca3-990a-688e95817582",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T14:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T14:05:14.000Z",
      "valid_until": "2026-04-14T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T14:01:24.799Z",
      "x_nadsec_last_seen": "2026-03-13T14:01:24.799Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "215607"
      ],
      "x_nadsec_orgs": [
        "dataforest GmbH"
      ]
    },
    {
      "created": "2026-03-13T14:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--957623a5-c832-4087-9bdc-3fc815638883",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T14:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.10.19.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T14:05:14.000Z",
      "valid_until": "2026-04-14T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T13:20:51.476Z",
      "x_nadsec_last_seen": "2026-03-13T13:22:58.839Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-13T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=138754; asn_org=Kerala Vision Broad Band Private Limited",
      "id": "indicator--80b18d38-7916-4b4f-8b2d-0e980544d5a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.139.64.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T21:05:02.000Z",
      "valid_until": "2026-04-14T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T20:20:41.199Z",
      "x_nadsec_last_seen": "2026-03-13T20:22:45.857Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138754"
      ],
      "x_nadsec_orgs": [
        "Kerala Vision Broad Band Private Limited"
      ]
    },
    {
      "created": "2026-03-13T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=135234; asn_org=SHERIE PLEXUS ISP PRIVATE LIMITED",
      "id": "indicator--10fa848a-4804-4b9a-a402-a64fc767735f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.171.48.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T21:05:02.000Z",
      "valid_until": "2026-04-14T21:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-13T20:21:27.578Z",
      "x_nadsec_last_seen": "2026-03-13T20:27:46.480Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135234"
      ],
      "x_nadsec_orgs": [
        "SHERIE PLEXUS ISP PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-13T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17665; asn_org=ONEOTT INTERTAINMENT LIMITED",
      "id": "indicator--770de5f6-2260-43ba-966d-7de2e5ee662d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.251.54.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T21:05:02.000Z",
      "valid_until": "2026-04-14T21:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-13T20:28:14.549Z",
      "x_nadsec_last_seen": "2026-03-22T06:05:26.633Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17665"
      ],
      "x_nadsec_orgs": [
        "ONEOTT INTERTAINMENT LIMITED"
      ]
    },
    {
      "created": "2026-03-13T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CO; asn=19429; asn_org=Colombia",
      "id": "indicator--5c8c2e56-5855-4ab0-8c8d-aa7a3e297300",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.28.247.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T21:05:02.000Z",
      "valid_until": "2026-04-14T21:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-13T20:26:25.740Z",
      "x_nadsec_last_seen": "2026-03-13T20:33:24.742Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "19429"
      ],
      "x_nadsec_orgs": [
        "Colombia"
      ]
    },
    {
      "created": "2026-03-13T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=2715; asn_org=Fundacao Carlos Chagas Filho de Amparo a Pesquisa",
      "id": "indicator--a5c5d7e2-5554-40ba-86dd-d0eb6668905b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.20.97.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T21:05:02.000Z",
      "valid_until": "2026-04-14T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T20:06:20.956Z",
      "x_nadsec_last_seen": "2026-03-13T20:06:20.956Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "2715"
      ],
      "x_nadsec_orgs": [
        "Fundacao Carlos Chagas Filho de Amparo a Pesquisa"
      ]
    },
    {
      "created": "2026-03-13T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--622dd7f5-291b-4b5f-8999-720a31588d89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T21:05:02.000Z",
      "valid_until": "2026-04-14T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T20:37:25.857Z",
      "x_nadsec_last_seen": "2026-03-13T20:37:25.857Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-13T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=269597; asn_org=STALKER ENGENHARIA EIRELI",
      "id": "indicator--1fa58f1c-0b14-4485-a9c5-a1fafcdb1ce9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.71.209.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T21:05:02.000Z",
      "valid_until": "2026-04-14T21:05:01.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-03-13T19:59:13.819Z",
      "x_nadsec_last_seen": "2026-03-24T15:09:44.290Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "269597"
      ],
      "x_nadsec_orgs": [
        "STALKER ENGENHARIA EIRELI"
      ]
    },
    {
      "created": "2026-03-13T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--eb5b1814-ecc5-4a4a-b469-4480b2d7c855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.57.48.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T21:05:02.000Z",
      "valid_until": "2026-04-14T21:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-13T20:33:56.499Z",
      "x_nadsec_last_seen": "2026-03-13T20:40:55.697Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-13T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=DE; asn=3209; asn_org=Vodafone GmbH",
      "id": "indicator--76835ef4-8c8b-4366-9118-e82704b59d71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.134.44.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T21:05:02.000Z",
      "valid_until": "2026-04-14T21:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-13T19:59:40.664Z",
      "x_nadsec_last_seen": "2026-03-13T20:06:47.922Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "3209"
      ],
      "x_nadsec_orgs": [
        "Vodafone GmbH"
      ]
    },
    {
      "created": "2026-03-13T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--dd1150f1-06a9-476c-9b88-30650dde8ab9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.33.246.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:05:03.000Z",
      "valid_until": "2026-04-14T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T23:01:51.493Z",
      "x_nadsec_last_seen": "2026-03-13T23:03:56.194Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-13T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9f3ef997-fe45-4474-828f-ee73cba1015b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:05:03.000Z",
      "valid_until": "2026-04-14T23:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-13T22:10:56.562Z",
      "x_nadsec_last_seen": "2026-03-28T04:24:43.578Z",
      "x_nadsec_ports": [
        "27017",
        "21"
      ],
      "x_nadsec_services": [
        "mongod",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-13T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--a59e0ccc-3486-4f34-8e95-abad8921d088",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.97.5.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:05:03.000Z",
      "valid_until": "2026-04-14T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T22:07:30.402Z",
      "x_nadsec_last_seen": "2026-03-13T22:07:30.402Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-13T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--08dce9ed-a6f7-4e0d-a7c4-5df577ce2ca2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.96.26.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:05:03.000Z",
      "valid_until": "2026-04-14T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T22:44:05.846Z",
      "x_nadsec_last_seen": "2026-03-13T22:46:11.141Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-13T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--afc3bce5-7dc5-45c5-b593-f63cd64d2741",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.213.57.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:05:03.000Z",
      "valid_until": "2026-04-14T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T22:38:27.772Z",
      "x_nadsec_last_seen": "2026-03-13T22:38:27.772Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-13T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--23d14e8d-1df6-400d-95d5-9c8f8e7e51c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.177.47.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:05:03.000Z",
      "valid_until": "2026-04-14T23:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-13T22:50:23.547Z",
      "x_nadsec_last_seen": "2026-03-13T22:57:11.129Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-13T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--cd5b3877-3a79-4f83-9cbc-7578f75dc678",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.177.77.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:05:03.000Z",
      "valid_until": "2026-04-14T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T22:06:37.018Z",
      "x_nadsec_last_seen": "2026-03-13T22:08:42.469Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-13T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--70dec905-af76-421e-bbe5-feb2dc9586bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:05:03.000Z",
      "valid_until": "2026-04-14T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T22:33:53.485Z",
      "x_nadsec_last_seen": "2026-03-13T22:33:53.485Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-13T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--62cc088e-a365-47e0-96c5-05950e06dbaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:05:03.000Z",
      "valid_until": "2026-04-14T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-13T22:13:58.616Z",
      "x_nadsec_last_seen": "2026-03-13T22:13:58.616Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-13T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--4c7beb51-03fd-4743-bfb9-ca7f6fcda7d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.205.96.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:05:03.000Z",
      "valid_until": "2026-04-14T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T22:42:00.079Z",
      "x_nadsec_last_seen": "2026-03-13T22:44:04.226Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-13T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KW; asn=196921; asn_org=Wireless Mobile Data Company KSCC",
      "id": "indicator--a675d34e-c10c-46e3-baa7-ad69816c5038",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-13T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.187.170.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:05:03.000Z",
      "valid_until": "2026-04-14T23:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-13T22:22:57.612Z",
      "x_nadsec_last_seen": "2026-03-30T18:15:11.935Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KW"
      ],
      "x_nadsec_asns": [
        "196921"
      ],
      "x_nadsec_orgs": [
        "Wireless Mobile Data Company KSCC"
      ]
    },
    {
      "created": "2026-03-14T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=30600; asn_org=Metronet",
      "id": "indicator--af17b2ef-11cd-4991-bcbf-29038e222cb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.117.111.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T00:05:03.000Z",
      "valid_until": "2026-04-15T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-13T23:43:27.815Z",
      "x_nadsec_last_seen": "2026-03-13T23:48:19.596Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "30600"
      ],
      "x_nadsec_orgs": [
        "Metronet"
      ]
    },
    {
      "created": "2026-03-14T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--84684169-abb0-405e-9873-e2832db6941a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.88.244.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T00:05:03.000Z",
      "valid_until": "2026-04-15T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T23:27:33.750Z",
      "x_nadsec_last_seen": "2026-03-13T23:27:40.130Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-14T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=28635; asn_org=AVATO TECNOLOGIA S.A",
      "id": "indicator--a99946ea-18dd-43a3-b06c-a6c8bbb8f5eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.71.157.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T00:05:03.000Z",
      "valid_until": "2026-04-15T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T00:03:25.104Z",
      "x_nadsec_last_seen": "2026-03-14T00:10:37.629Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28635"
      ],
      "x_nadsec_orgs": [
        "AVATO TECNOLOGIA S.A"
      ]
    },
    {
      "created": "2026-03-14T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--8931c6f2-1806-4d05-9b20-d8b1c53761a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T00:05:03.000Z",
      "valid_until": "2026-04-15T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-13T23:54:08.242Z",
      "x_nadsec_last_seen": "2026-03-22T22:52:39.962Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-14T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4224e06b-f95e-4fea-b900-414cb11d2f9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.209.66.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T01:05:02.000Z",
      "valid_until": "2026-04-15T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T00:22:15.019Z",
      "x_nadsec_last_seen": "2026-03-14T00:22:15.019Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-14T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0b81bb7d-8f38-4e87-b414-b22bb3376e1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.233.112.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T01:05:02.000Z",
      "valid_until": "2026-04-15T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T00:20:37.208Z",
      "x_nadsec_last_seen": "2026-03-14T00:20:47.382Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-14T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6702e520-46da-4193-9269-d321c2f1938f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T01:05:02.000Z",
      "valid_until": "2026-04-15T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T00:16:01.278Z",
      "x_nadsec_last_seen": "2026-03-14T00:16:01.278Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-14T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a00af559-ef38-4f09-9e71-6af7855c5fb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.244.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T01:05:02.000Z",
      "valid_until": "2026-04-15T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T00:52:20.508Z",
      "x_nadsec_last_seen": "2026-03-14T00:52:20.525Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-14T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--51fc2999-63e3-4022-ac06-1a5365ee7b29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.88.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T01:05:02.000Z",
      "valid_until": "2026-04-15T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T00:52:19.634Z",
      "x_nadsec_last_seen": "2026-03-14T00:52:19.634Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-14T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--0f156ac1-26db-4265-88f5-e99e665b0c5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.183.209.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T01:05:02.000Z",
      "valid_until": "2026-04-15T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T00:21:45.740Z",
      "x_nadsec_last_seen": "2026-03-14T00:23:51.223Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-14T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--c6a6340e-775a-41c4-b27c-f8ff8100a884",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.248.223.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T01:05:02.000Z",
      "valid_until": "2026-04-15T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T00:59:13.840Z",
      "x_nadsec_last_seen": "2026-03-14T00:59:21.729Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-03-14T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NZ; asn=4771; asn_org=Spark New Zealand Trading Ltd.",
      "id": "indicator--aa5553e1-9719-4d72-9dc8-43a95d6698a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.153.235.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T01:05:02.000Z",
      "valid_until": "2026-04-15T01:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-14T00:39:30.576Z",
      "x_nadsec_last_seen": "2026-03-22T17:06:02.049Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NZ"
      ],
      "x_nadsec_asns": [
        "4771"
      ],
      "x_nadsec_orgs": [
        "Spark New Zealand Trading Ltd."
      ]
    },
    {
      "created": "2026-03-14T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--75c38f78-2c9d-4512-8d84-f32775e02963",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.46.1.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T01:05:02.000Z",
      "valid_until": "2026-04-15T01:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-13T18:51:35.648Z",
      "x_nadsec_last_seen": "2026-03-14T01:42:25.912Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-14T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--95b611ed-caf6-463b-b981-2a4a864c6ac5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '68.183.96.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T01:05:02.000Z",
      "valid_until": "2026-04-15T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T00:22:03.094Z",
      "x_nadsec_last_seen": "2026-03-14T00:22:14.365Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-14T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ES; asn=15704; asn_org=Xtra Telecom S.A.",
      "id": "indicator--291adc00-d4b9-4843-a349-d2255d28c658",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.27.140.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T01:05:02.000Z",
      "valid_until": "2026-04-15T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T00:33:34.248Z",
      "x_nadsec_last_seen": "2026-03-14T00:33:34.266Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "15704"
      ],
      "x_nadsec_orgs": [
        "Xtra Telecom S.A."
      ]
    },
    {
      "created": "2026-03-14T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a2d3f214-d5d6-4eed-9087-9e3d11981e14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '129.212.180.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:05:03.000Z",
      "valid_until": "2026-04-15T02:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-14T01:46:19.052Z",
      "x_nadsec_last_seen": "2026-03-21T19:29:11.485Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "42",
        "81",
        "135",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-14T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--0dc1dd1d-f225-4189-9f87-6fd2dca06181",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:05:03.000Z",
      "valid_until": "2026-04-15T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T01:30:47.632Z",
      "x_nadsec_last_seen": "2026-03-14T01:30:47.632Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-14T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=200590; asn_org=NLS Kazakhstan LLC",
      "id": "indicator--a4cd10d7-39e8-4393-a997-15bd3d1d2bf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.182.217.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:05:03.000Z",
      "valid_until": "2026-04-15T02:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-14T02:02:57.071Z",
      "x_nadsec_last_seen": "2026-03-30T03:33:55.237Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "200590"
      ],
      "x_nadsec_orgs": [
        "NLS Kazakhstan LLC"
      ]
    },
    {
      "created": "2026-03-14T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--4aebd443-f7cb-4f35-95a0-d7b9679e2c74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.209.221.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:05:03.000Z",
      "valid_until": "2026-04-15T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T01:56:15.722Z",
      "x_nadsec_last_seen": "2026-03-14T01:58:21.227Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-14T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5eb4c354-7518-4d37-b09a-900ef74ac85f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:05:03.000Z",
      "valid_until": "2026-04-15T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T01:56:18.753Z",
      "x_nadsec_last_seen": "2026-03-14T01:56:18.753Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-14T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4a0eb991-2986-42c7-8bb7-c2f3c2bd01b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.106.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:05:03.000Z",
      "valid_until": "2026-04-15T02:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T01:37:55.408Z",
      "x_nadsec_last_seen": "2026-03-14T01:38:05.570Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-14T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--04c7d252-f36c-4afe-8f77-b89166e955c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.254.192.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:05:03.000Z",
      "valid_until": "2026-04-15T02:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-14T01:52:43.925Z",
      "x_nadsec_last_seen": "2026-03-31T04:40:37.176Z",
      "x_nadsec_ports": [
        "27017",
        "1433"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-14T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e652071f-392e-496e-b700-5ac6a63424c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.160.151.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:05:11.000Z",
      "valid_until": "2026-04-15T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T02:29:06.865Z",
      "x_nadsec_last_seen": "2026-03-14T02:31:11.621Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-14T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--3d9c7f1b-c535-4819-91cc-66e5f3022b91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.234.45.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:05:11.000Z",
      "valid_until": "2026-04-15T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T02:32:41.246Z",
      "x_nadsec_last_seen": "2026-03-14T02:34:45.992Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-14T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=11426; asn_org=Charter Communications Inc",
      "id": "indicator--9e455ada-bbf4-4a54-a53b-658b24e8cf91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.95.27.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:05:11.000Z",
      "valid_until": "2026-04-15T03:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-14T02:40:14.197Z",
      "x_nadsec_last_seen": "2026-03-20T14:00:12.469Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11426"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-03-14T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--1e4f1475-98c1-4ce8-a785-62094457eff6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.52.224.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:05:11.000Z",
      "valid_until": "2026-04-15T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T03:03:37.747Z",
      "x_nadsec_last_seen": "2026-03-14T03:05:42.371Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-14T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--92fbafa1-b136-4891-b363-6a70fa61e9b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.186.122.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:05:11.000Z",
      "valid_until": "2026-04-15T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T02:16:33.342Z",
      "x_nadsec_last_seen": "2026-03-14T02:18:38.652Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-14T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--864e0673-f6eb-408c-a5be-33c75c31997a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.181.171.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:05:11.000Z",
      "valid_until": "2026-04-15T03:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-14T02:35:09.529Z",
      "x_nadsec_last_seen": "2026-03-19T07:14:43.689Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-03-14T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--b3a1c6bb-a0ff-4a2e-9da7-f310aaa53c3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '8.216.5.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:05:11.000Z",
      "valid_until": "2026-04-15T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T02:34:51.665Z",
      "x_nadsec_last_seen": "2026-03-14T02:34:51.665Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-14T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--27d25e15-32be-4fb8-880c-7e8f7b8d6ea1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:05:11.000Z",
      "valid_until": "2026-04-15T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T02:53:26.813Z",
      "x_nadsec_last_seen": "2026-03-14T02:53:26.813Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-14T03:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3746d5ec-375f-44c4-b58c-baf923de543a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T03:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:05:11.000Z",
      "valid_until": "2026-04-15T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T02:53:26.401Z",
      "x_nadsec_last_seen": "2026-03-14T02:53:26.401Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-14T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--24c5e477-d4bc-4bf4-8a37-a905d517849d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.192.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:05:02.000Z",
      "valid_until": "2026-04-15T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T03:30:25.322Z",
      "x_nadsec_last_seen": "2026-03-14T03:30:25.322Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-14T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CY; asn=6866; asn_org=Cyprus Telecommunications Authority",
      "id": "indicator--55ddd197-1060-46fa-ac59-43e85a419392",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.92.211.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:05:02.000Z",
      "valid_until": "2026-04-15T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T03:14:09.042Z",
      "x_nadsec_last_seen": "2026-03-14T03:14:09.177Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CY"
      ],
      "x_nadsec_asns": [
        "6866"
      ],
      "x_nadsec_orgs": [
        "Cyprus Telecommunications Authority"
      ]
    },
    {
      "created": "2026-03-14T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--0ae463a2-9f24-4f54-be0f-3ae40aad20e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.167.239.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:05:02.000Z",
      "valid_until": "2026-04-15T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T03:48:33.908Z",
      "x_nadsec_last_seen": "2026-03-14T03:48:37.923Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-14T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fa318bdd-6017-4477-889a-aaaaf0522bb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:05:02.000Z",
      "valid_until": "2026-04-15T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T03:59:11.909Z",
      "x_nadsec_last_seen": "2026-03-14T03:59:22.052Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-14T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=8393; asn_org=astel Jsc",
      "id": "indicator--193b3272-1647-4197-8e94-3419c22d0e70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.157.51.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:05:02.000Z",
      "valid_until": "2026-04-15T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T03:37:41.221Z",
      "x_nadsec_last_seen": "2026-03-14T03:39:48.255Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "8393"
      ],
      "x_nadsec_orgs": [
        "astel Jsc"
      ]
    },
    {
      "created": "2026-03-14T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SG; asn=9506; asn_org=Singtel Fibre Broadband",
      "id": "indicator--4439ebbb-79af-4a12-afe1-bfadc87e8a33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '219.74.205.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:05:02.000Z",
      "valid_until": "2026-04-15T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T03:46:40.410Z",
      "x_nadsec_last_seen": "2026-03-14T03:46:40.469Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "9506"
      ],
      "x_nadsec_orgs": [
        "Singtel Fibre Broadband"
      ]
    },
    {
      "created": "2026-03-14T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--454bac4a-91e8-49e6-be2f-29288d8d778d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.65.225.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:05:02.000Z",
      "valid_until": "2026-04-15T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T03:05:23.068Z",
      "x_nadsec_last_seen": "2026-03-14T03:07:27.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-14T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SZ; asn=19711; asn_org=SWAZINET",
      "id": "indicator--30146447-7b0c-4970-a014-0329bbdab087",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '69.63.76.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:05:02.000Z",
      "valid_until": "2026-04-15T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T03:10:25.814Z",
      "x_nadsec_last_seen": "2026-03-14T03:12:33.263Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SZ"
      ],
      "x_nadsec_asns": [
        "19711"
      ],
      "x_nadsec_orgs": [
        "SWAZINET"
      ]
    },
    {
      "created": "2026-03-14T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--0c7a8ef7-b1e5-45f5-9f32-fdee316a61d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:05:02.000Z",
      "valid_until": "2026-04-15T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T03:10:40.985Z",
      "x_nadsec_last_seen": "2026-03-14T03:10:40.985Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-14T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--30dc4a52-f414-44ce-8271-dc248942350d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:05:02.000Z",
      "valid_until": "2026-04-15T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T03:10:41.321Z",
      "x_nadsec_last_seen": "2026-03-18T19:22:14.820Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-14T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--8c87330c-1f9d-48e7-8f4c-eb5443a6314a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:05:02.000Z",
      "valid_until": "2026-04-15T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T03:11:16.665Z",
      "x_nadsec_last_seen": "2026-03-14T03:11:16.665Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-14T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d551cb5f-4e96-4cd2-9545-110e4f8b2707",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:05:02.000Z",
      "valid_until": "2026-04-15T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T03:11:16.999Z",
      "x_nadsec_last_seen": "2026-03-14T03:11:16.999Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=38200; asn_org=BTS Communications BD ltd",
      "id": "indicator--afd36d38-3c97-4836-9749-719f003c10c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.234.26.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T04:35:21.531Z",
      "x_nadsec_last_seen": "2026-03-14T04:41:48.529Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "38200"
      ],
      "x_nadsec_orgs": [
        "BTS Communications BD ltd"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=141314; asn_org=Wi5 Internet Services Private Limited",
      "id": "indicator--cf2baa12-d925-4b07-a754-dbeefb06123d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.87.104.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T04:21:50.009Z",
      "x_nadsec_last_seen": "2026-03-14T04:21:50.009Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141314"
      ],
      "x_nadsec_orgs": [
        "Wi5 Internet Services Private Limited"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=141314; asn_org=Wi5 Internet Services Private Limited",
      "id": "indicator--9c4f1698-341c-437f-b648-4a38fa19466c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.87.105.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T04:21:49.860Z",
      "x_nadsec_last_seen": "2026-03-14T04:22:15.138Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141314"
      ],
      "x_nadsec_orgs": [
        "Wi5 Internet Services Private Limited"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3147; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b25667ed-0883-4cc0-b470-c6e091ef3e1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.181.237.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 3147,
      "x_nadsec_first_seen": "2026-03-14T04:06:29.093Z",
      "x_nadsec_last_seen": "2026-03-14T04:38:20.726Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--8383f536-523f-481e-aa6d-6a4d0f627fb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.225.201.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T04:48:31.972Z",
      "x_nadsec_last_seen": "2026-03-14T04:55:07.798Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--5cbd6a68-0136-4772-be72-5b958d16a6a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.138.240.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T04:19:31.946Z",
      "x_nadsec_last_seen": "2026-03-14T04:21:37.553Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--e841ab27-cb88-4325-90d1-6e17f26b9516",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.238.52.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-14T04:53:45.280Z",
      "x_nadsec_last_seen": "2026-03-15T05:52:38.319Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28300; asn_org=Speed Servicos de Internet Ltda",
      "id": "indicator--f67a59dd-aa15-42cf-8804-241e2c401dce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.28.162.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T04:35:55.549Z",
      "x_nadsec_last_seen": "2026-03-14T04:38:02.077Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28300"
      ],
      "x_nadsec_orgs": [
        "Speed Servicos de Internet Ltda"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--7ac7253e-6ced-4aa4-b514-f3817614193d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.46.106.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T04:22:20.149Z",
      "x_nadsec_last_seen": "2026-03-14T04:24:27.862Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e438ee9b-e6cf-4075-89f9-f19034858dc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T04:45:47.722Z",
      "x_nadsec_last_seen": "2026-03-30T03:54:09.458Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--453c1c77-0d37-4a27-89a2-933db385c6a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.104.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T04:34:51.822Z",
      "x_nadsec_last_seen": "2026-03-14T04:34:51.822Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=9930; asn_org=TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al",
      "id": "indicator--789b6944-403e-40ee-90b4-e20d83ebbc68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.187.236.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T04:19:31.646Z",
      "x_nadsec_last_seen": "2026-03-14T04:21:35.866Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9930"
      ],
      "x_nadsec_orgs": [
        "TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--0d49bdd7-9f8f-4ba8-8dfb-931b6417fefe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.156.112.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T04:10:12.057Z",
      "x_nadsec_last_seen": "2026-03-14T04:12:18.703Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--ea82ca38-c7eb-46d0-b74c-17ff34b99f39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.77.221.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T04:37:20.676Z",
      "x_nadsec_last_seen": "2026-03-14T04:37:25.446Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--1ebc9dfb-2a26-4683-b163-5eabf1c28729",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.38.14.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-14T04:38:39.039Z",
      "x_nadsec_last_seen": "2026-03-23T05:13:42.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--190c2be7-d23c-4a8a-901d-fadfc0e560b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.103.36.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-03-14T04:29:49.128Z",
      "x_nadsec_last_seen": "2026-03-26T22:39:09.634Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=42610; asn_org=Rostelecom",
      "id": "indicator--9b785ea8-2bb9-4373-9c7d-abf8887c445f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.228.117.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T04:55:14.655Z",
      "x_nadsec_last_seen": "2026-03-14T04:57:30.296Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "42610"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--1daa9882-13f7-44bd-ba30-155ab9c8c04e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.103.26.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T04:42:23.042Z",
      "x_nadsec_last_seen": "2026-03-14T04:44:29.096Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-14T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=134732; asn_org=Dot Internet",
      "id": "indicator--973d850a-c842-4e95-a559-2a5a8f825004",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.153.101.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T05:05:03.000Z",
      "valid_until": "2026-04-15T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T04:11:18.665Z",
      "x_nadsec_last_seen": "2026-03-14T04:13:23.254Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "134732"
      ],
      "x_nadsec_orgs": [
        "Dot Internet"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=140122; asn_org=Omnet Infratech Pvt Ltd",
      "id": "indicator--c0417d8a-23dd-404d-b06b-53dcbe96383b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.152.69.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-14T05:31:32.575Z",
      "x_nadsec_last_seen": "2026-03-20T16:33:31.850Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "140122"
      ],
      "x_nadsec_orgs": [
        "Omnet Infratech Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--8af6e959-0970-4013-a9c6-c8c0bc872d1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T05:56:10.918Z",
      "x_nadsec_last_seen": "2026-03-16T09:16:19.132Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--4dc847eb-821a-4aaa-9c9b-31e57df54103",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T05:56:16.636Z",
      "x_nadsec_last_seen": "2026-03-16T09:15:59.289Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--d5fa39fb-5df7-42ea-b6a9-c611c20e4add",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T05:55:40.319Z",
      "x_nadsec_last_seen": "2026-03-14T05:55:40.319Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--b707912a-a905-41d1-a9b9-1af91330cb3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T05:55:38.587Z",
      "x_nadsec_last_seen": "2026-03-16T09:16:09.117Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--a51943f8-ec2d-47a7-96b3-1b53b482c7e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T05:56:26.102Z",
      "x_nadsec_last_seen": "2026-03-16T09:15:54.099Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--676a3852-e0da-4d74-9ea9-12ff94ee9c55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-14T05:55:54.947Z",
      "x_nadsec_last_seen": "2026-03-16T09:16:15.652Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--9e552a55-92cf-439e-b472-4a03af6816ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T05:55:56.678Z",
      "x_nadsec_last_seen": "2026-03-16T09:15:43.208Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--d42a4479-dfa5-4231-809c-5e7db5888397",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T05:56:18.793Z",
      "x_nadsec_last_seen": "2026-03-14T05:56:18.793Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--46d8d02e-f47b-4f5a-8915-eec83d0f0489",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.163.112.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T06:03:16.404Z",
      "x_nadsec_last_seen": "2026-03-14T06:09:54.937Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2db96f40-5ef5-4563-b65d-264fd9b7d9ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-14T06:01:19.310Z",
      "x_nadsec_last_seen": "2026-03-18T14:33:27.713Z",
      "x_nadsec_ports": [
        "1433",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d67bde3e-b928-48e5-bd35-5240d7f2fa0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T05:32:08.769Z",
      "x_nadsec_last_seen": "2026-03-14T05:32:08.769Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--60b389a0-d96d-468a-baaa-5a157f9f7dfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.236.77.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-14T05:26:39.996Z",
      "x_nadsec_last_seen": "2026-03-17T15:32:27.781Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--03a9faf2-2cb7-4fe5-8dbc-27238ae8ae5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.254.116.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T05:22:15.047Z",
      "x_nadsec_last_seen": "2026-03-14T05:24:22.581Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--28f3fe63-3fdf-4cb9-a0a5-605d721975e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.52.22.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T05:12:50.145Z",
      "x_nadsec_last_seen": "2026-03-14T05:14:54.780Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--584cf865-d0e0-4d3c-9329-d0860fbc0f82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.171.9.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T05:32:04.270Z",
      "x_nadsec_last_seen": "2026-03-14T05:32:04.270Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=28009; asn_org=Davitel S.A.",
      "id": "indicator--2d6abf27-5081-4a1b-baff-d2b3e5a9e12d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.85.183.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-14T05:59:43.170Z",
      "x_nadsec_last_seen": "2026-03-16T21:56:23.496Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "28009"
      ],
      "x_nadsec_orgs": [
        "Davitel S.A."
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=SG; asn=3758; asn_org=SingNet",
      "id": "indicator--2ada4726-c452-436c-b8b2-33a1acbe7bba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.125.242.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T05:45:08.716Z",
      "x_nadsec_last_seen": "2026-03-14T05:52:22.142Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "3758"
      ],
      "x_nadsec_orgs": [
        "SingNet"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=CM; asn=30992; asn_org=MTN-NS-CAMEROON",
      "id": "indicator--92c7bbf0-f4bb-4bdf-ab8f-1df5fc569020",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.205.13.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-14T05:33:10.589Z",
      "x_nadsec_last_seen": "2026-03-20T07:19:48.854Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CM"
      ],
      "x_nadsec_asns": [
        "30992"
      ],
      "x_nadsec_orgs": [
        "MTN-NS-CAMEROON"
      ]
    },
    {
      "created": "2026-03-14T06:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JO; asn=8376; asn_org=Jordan Data Communications Company LLC",
      "id": "indicator--cf8398f6-d5cb-4946-ba65-67b83fdd0470",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T06:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.185.128.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:05:09.000Z",
      "valid_until": "2026-04-15T06:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T05:20:24.247Z",
      "x_nadsec_last_seen": "2026-03-14T05:22:30.986Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "8376"
      ],
      "x_nadsec_orgs": [
        "Jordan Data Communications Company LLC"
      ]
    },
    {
      "created": "2026-03-14T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=24; services=smbd; ports=445; cc=ZA; asn=327782; asn_org=METROFIBRE-NETWORX",
      "id": "indicator--ae89ffd7-4fe2-414b-982b-51142414b91c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.33.152.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:05:02.000Z",
      "valid_until": "2026-04-15T07:05:01.000Z",
      "x_nadsec_event_count": 3125,
      "x_nadsec_first_seen": "2026-03-14T06:50:34.679Z",
      "x_nadsec_last_seen": "2026-03-14T10:31:12.636Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "327782"
      ],
      "x_nadsec_orgs": [
        "METROFIBRE-NETWORX"
      ]
    },
    {
      "created": "2026-03-14T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--85230581-2fa2-4d23-8437-8384bdb7c3a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.39.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:05:02.000Z",
      "valid_until": "2026-04-15T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T06:15:47.626Z",
      "x_nadsec_last_seen": "2026-03-14T06:22:22.654Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-14T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8b5c0b6a-8710-4854-9801-a92cc8527593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.251.159.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:05:02.000Z",
      "valid_until": "2026-04-15T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T06:55:55.988Z",
      "x_nadsec_last_seen": "2026-03-14T06:58:01.109Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-14T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--ae59ab64-180e-4f2f-9f3f-30256806cfe2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.115.180.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:05:02.000Z",
      "valid_until": "2026-04-15T07:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-14T06:56:54.200Z",
      "x_nadsec_last_seen": "2026-03-19T17:11:05.563Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-14T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b7d6b3ec-fd7a-4797-a74f-d545ef43318c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:05:02.000Z",
      "valid_until": "2026-04-15T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T06:40:49.454Z",
      "x_nadsec_last_seen": "2026-03-14T06:40:49.454Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-14T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--55f16055-26ad-4695-9b0b-6364806e39ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.106.206.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:05:02.000Z",
      "valid_until": "2026-04-15T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T06:56:21.446Z",
      "x_nadsec_last_seen": "2026-03-14T06:56:21.834Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-14T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--c7c3b222-87f9-4ffd-9516-47f22d5ec080",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.209.182.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:05:02.000Z",
      "valid_until": "2026-04-15T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T06:24:02.606Z",
      "x_nadsec_last_seen": "2026-03-14T06:26:08.322Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-03-14T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=3549; asn_org=Level 3 Parent, LLC",
      "id": "indicator--808d95f2-8a11-4d3b-bf8e-edfc4f711bc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '204.199.40.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:05:02.000Z",
      "valid_until": "2026-04-15T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T06:50:25.712Z",
      "x_nadsec_last_seen": "2026-03-14T06:52:32.249Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "3549"
      ],
      "x_nadsec_orgs": [
        "Level 3 Parent, LLC"
      ]
    },
    {
      "created": "2026-03-14T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=49718; asn_org=Nizhnevolzhskie Telecommunication Networks Real LLC",
      "id": "indicator--1267dd40-365c-4fc6-875b-58b17f06c3ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.108.175.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:05:02.000Z",
      "valid_until": "2026-04-15T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-14T06:47:18.084Z",
      "x_nadsec_last_seen": "2026-03-14T06:53:09.600Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "49718"
      ],
      "x_nadsec_orgs": [
        "Nizhnevolzhskie Telecommunication Networks Real LLC"
      ]
    },
    {
      "created": "2026-03-14T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--f42df1b1-ab19-4b20-b22a-b76d268b4b38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.74.203.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:05:02.000Z",
      "valid_until": "2026-04-15T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T06:31:53.934Z",
      "x_nadsec_last_seen": "2026-03-14T06:34:00.571Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-14T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--2e2300b6-461a-49d3-bec8-d3d0305271c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.79.180.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:05:02.000Z",
      "valid_until": "2026-04-15T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-14T06:22:24.751Z",
      "x_nadsec_last_seen": "2026-03-23T17:32:29.350Z",
      "x_nadsec_ports": [
        "3306",
        "445"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-14T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=JM; asn=33576; asn_org=Digicel Jamaica",
      "id": "indicator--63df61dc-5639-43f2-9ded-55015c5d6f81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '63.143.99.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:05:02.000Z",
      "valid_until": "2026-04-15T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T06:44:54.857Z",
      "x_nadsec_last_seen": "2026-03-14T06:44:54.993Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JM"
      ],
      "x_nadsec_asns": [
        "33576"
      ],
      "x_nadsec_orgs": [
        "Digicel Jamaica"
      ]
    },
    {
      "created": "2026-03-14T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--27de468b-6cf0-4aa9-af77-a529f7816a21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:05:02.000Z",
      "valid_until": "2026-04-15T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T06:52:14.103Z",
      "x_nadsec_last_seen": "2026-03-14T06:52:14.103Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-14T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--515b0c99-edfb-47ce-a08e-ef6d99ddd772",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:05:02.000Z",
      "valid_until": "2026-04-15T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T06:52:13.487Z",
      "x_nadsec_last_seen": "2026-03-14T06:52:13.487Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-14T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--f6c5f89c-4c4d-4a90-a412-aa115f13a20d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.232.69.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:05:03.000Z",
      "valid_until": "2026-04-15T08:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-14T07:55:38.791Z",
      "x_nadsec_last_seen": "2026-03-29T03:17:54.150Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-14T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1cca2fb1-f216-437a-98ea-dba92b0da1f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.162.193.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:05:03.000Z",
      "valid_until": "2026-04-15T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T07:22:31.532Z",
      "x_nadsec_last_seen": "2026-03-14T07:29:40.266Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-14T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--acb65837-c6b7-4a12-b5e6-e063d1efc789",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.168.14.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:05:03.000Z",
      "valid_until": "2026-04-15T08:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-14T07:55:40.467Z",
      "x_nadsec_last_seen": "2026-03-15T15:20:30.208Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-14T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=14; services=httpd; ports=81; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:05:03.000Z",
      "valid_until": "2026-04-15T08:05:01.000Z",
      "x_nadsec_event_count": 25,
      "x_nadsec_first_seen": "2026-03-14T07:47:25.055Z",
      "x_nadsec_last_seen": "2026-03-18T13:34:02.745Z",
      "x_nadsec_ports": [
        "81",
        "42",
        "42741"
      ],
      "x_nadsec_services": [
        "httpd",
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-14T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--f209de52-e780-4499-a790-5d983b619f4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.205.237.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:05:03.000Z",
      "valid_until": "2026-04-15T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T07:31:40.401Z",
      "x_nadsec_last_seen": "2026-03-14T07:33:44.923Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-14T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134032; asn_org=INFONET COMM ENTERPRISES",
      "id": "indicator--c0f376ba-25e0-44eb-8a42-a93c428fede6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.118.35.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:05:03.000Z",
      "valid_until": "2026-04-15T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T07:30:24.850Z",
      "x_nadsec_last_seen": "2026-03-14T07:32:30.104Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134032"
      ],
      "x_nadsec_orgs": [
        "INFONET COMM ENTERPRISES"
      ]
    },
    {
      "created": "2026-03-14T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=131269; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--35f8f1fd-e48b-4af5-82de-0f87fbd79417",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.206.119.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:05:03.000Z",
      "valid_until": "2026-04-15T08:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-14T07:39:57.241Z",
      "x_nadsec_last_seen": "2026-03-14T08:16:47.849Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "131269"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-14T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=50477; asn_org=Svyaz-Energo Ltd.",
      "id": "indicator--d7d85f74-d3f7-4904-85d8-dbdf4368f55d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.149.203.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:05:03.000Z",
      "valid_until": "2026-04-15T08:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-14T07:38:27.036Z",
      "x_nadsec_last_seen": "2026-03-14T07:39:45.264Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50477"
      ],
      "x_nadsec_orgs": [
        "Svyaz-Energo Ltd."
      ]
    },
    {
      "created": "2026-03-14T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=42396; asn_org=PJSC Telesystems of Ukraine",
      "id": "indicator--27667b46-549e-49fc-bc43-c9bd3769176b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.109.21.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:05:03.000Z",
      "valid_until": "2026-04-15T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T07:48:20.364Z",
      "x_nadsec_last_seen": "2026-03-14T07:50:26.794Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "42396"
      ],
      "x_nadsec_orgs": [
        "PJSC Telesystems of Ukraine"
      ]
    },
    {
      "created": "2026-03-14T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--f28d4ab1-d795-4e5d-8ca6-109f5023f2e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.204.141.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T08:05:03.000Z",
      "valid_until": "2026-04-15T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T08:03:13.056Z",
      "x_nadsec_last_seen": "2026-03-14T08:10:15.510Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-14T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--3c43f727-e349-49fc-8956-6327df19af00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.186.76.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:05:03.000Z",
      "valid_until": "2026-04-15T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T08:11:05.345Z",
      "x_nadsec_last_seen": "2026-03-14T08:11:11.603Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-03-14T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=59165; asn_org=Auspice Infratel Pvt. Ltd.",
      "id": "indicator--9b8008ce-f2fe-49c7-b95b-7f5e01e4e9ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.231.44.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:05:03.000Z",
      "valid_until": "2026-04-15T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T08:39:54.138Z",
      "x_nadsec_last_seen": "2026-03-14T08:39:54.460Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "59165"
      ],
      "x_nadsec_orgs": [
        "Auspice Infratel Pvt. Ltd."
      ]
    },
    {
      "created": "2026-03-14T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8e4c6cfb-fd4e-4f5c-8385-75231417140d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:05:03.000Z",
      "valid_until": "2026-04-15T09:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-14T09:03:46.124Z",
      "x_nadsec_last_seen": "2026-03-14T09:03:46.915Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-14T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--d72adcf2-7d23-43d5-ba55-833064aaf002",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.4.16.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:05:03.000Z",
      "valid_until": "2026-04-15T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T08:22:07.233Z",
      "x_nadsec_last_seen": "2026-03-14T08:22:11.726Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-14T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--5fe2091f-3749-4771-9d02-45ee21531b03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.82.98.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:05:03.000Z",
      "valid_until": "2026-04-15T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T08:44:38.184Z",
      "x_nadsec_last_seen": "2026-03-14T08:44:43.576Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-14T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--8cbd1adc-9a35-4f97-bc9b-ca1940ff1d4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.153.82.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:05:03.000Z",
      "valid_until": "2026-04-15T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T08:31:03.677Z",
      "x_nadsec_last_seen": "2026-03-14T08:33:09.474Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-03-14T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--08aadb53-f162-49cc-8797-6f3025a549f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.210.157.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:05:03.000Z",
      "valid_until": "2026-04-15T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T08:05:42.594Z",
      "x_nadsec_last_seen": "2026-03-14T08:07:47.377Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-14T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TN; asn=37492; asn_org=ORANGE",
      "id": "indicator--997c6009-38a8-4401-8113-4b3f845383ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.230.222.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:05:03.000Z",
      "valid_until": "2026-04-15T09:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-14T08:56:18.656Z",
      "x_nadsec_last_seen": "2026-03-14T08:57:02.985Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37492"
      ],
      "x_nadsec_orgs": [
        "ORANGE"
      ]
    },
    {
      "created": "2026-03-14T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--4345555e-08fe-414e-bc8c-179888fe9d93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.65.248.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:05:03.000Z",
      "valid_until": "2026-04-15T09:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-14T08:38:49.564Z",
      "x_nadsec_last_seen": "2026-03-14T08:40:54.532Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-03-14T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=epmapper; ports=135; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--e210de3f-1415-47e8-bb82-18df4036b16c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.88.84.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:05:03.000Z",
      "valid_until": "2026-04-15T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T08:06:06.748Z",
      "x_nadsec_last_seen": "2026-03-14T08:06:49.770Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-14T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--4065fe43-92c4-406a-a3e2-c2b26994718b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.145.185.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:05:03.000Z",
      "valid_until": "2026-04-15T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T09:01:54.097Z",
      "x_nadsec_last_seen": "2026-03-14T09:01:59.352Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-14T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--3c86d17d-013e-4ec8-bde7-6c7deb5d5e89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.189.193.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:05:03.000Z",
      "valid_until": "2026-04-15T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T08:42:50.099Z",
      "x_nadsec_last_seen": "2026-03-14T08:44:56.776Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--7a3d102b-5a5a-41b9-950d-dbbbe1f30825",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.54.177.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:05:02.000Z",
      "valid_until": "2026-04-15T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T09:36:09.694Z",
      "x_nadsec_last_seen": "2026-03-14T09:38:14.998Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--5256f131-9363-40c1-a8e5-920d3e762bd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.163.54.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:05:02.000Z",
      "valid_until": "2026-04-15T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T09:12:25.053Z",
      "x_nadsec_last_seen": "2026-03-14T09:14:29.824Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--c3d5a5b3-d121-4b97-a4b1-add8e52b586d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.45.177.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:05:02.000Z",
      "valid_until": "2026-04-15T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T09:25:08.355Z",
      "x_nadsec_last_seen": "2026-03-14T09:25:08.355Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-03-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--6f53437f-c06a-4828-bb71-4c0a32f32e08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.45.177.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:05:02.000Z",
      "valid_until": "2026-04-15T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T09:25:09.018Z",
      "x_nadsec_last_seen": "2026-03-14T09:25:09.018Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-03-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=GB; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--b52e7b57-958d-426b-9f1d-f561e9574b2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.45.179.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:05:02.000Z",
      "valid_until": "2026-04-15T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T09:26:27.573Z",
      "x_nadsec_last_seen": "2026-03-14T09:26:27.573Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-03-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=37340; asn_org=Spectranet",
      "id": "indicator--d613acce-13fc-4f66-bd17-c8174b4ec684",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.118.1.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:05:02.000Z",
      "valid_until": "2026-04-15T10:05:00.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-14T09:42:47.946Z",
      "x_nadsec_last_seen": "2026-03-14T17:09:21.221Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37340"
      ],
      "x_nadsec_orgs": [
        "Spectranet"
      ]
    },
    {
      "created": "2026-03-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--571418cc-094f-4511-8b8e-72ea80a1b472",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.6.204.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:05:02.000Z",
      "valid_until": "2026-04-15T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T09:46:59.870Z",
      "x_nadsec_last_seen": "2026-03-14T09:49:04.256Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--62526437-6189-4345-8f18-11d3a2ff1f9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.130.47.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:05:02.000Z",
      "valid_until": "2026-04-15T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T09:23:18.206Z",
      "x_nadsec_last_seen": "2026-03-14T09:23:18.206Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-03-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--ad8f6c24-db9e-4073-bc90-46aaa5ffb824",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.52.22.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:05:02.000Z",
      "valid_until": "2026-04-15T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T09:38:56.478Z",
      "x_nadsec_last_seen": "2026-03-14T09:41:01.107Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--9a5a3e22-ba7c-4aa0-b7a2-0d6da54bcf3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:05:02.000Z",
      "valid_until": "2026-04-15T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T09:14:48.392Z",
      "x_nadsec_last_seen": "2026-03-14T09:14:48.392Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=SA; asn=39891; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--0a574939-f25d-4af1-acf1-ac0304341401",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.90.242.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:05:02.000Z",
      "valid_until": "2026-04-15T10:05:00.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-14T09:59:09.418Z",
      "x_nadsec_last_seen": "2026-03-16T18:37:32.876Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "39891"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=215540; asn_org=Global Connectivity Solutions Llp",
      "id": "indicator--4a27b9d3-12c2-4007-8cae-38dfe7e272cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.148.103.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:05:02.000Z",
      "valid_until": "2026-04-15T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T09:24:04.885Z",
      "x_nadsec_last_seen": "2026-03-14T09:24:04.885Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "215540"
      ],
      "x_nadsec_orgs": [
        "Global Connectivity Solutions Llp"
      ]
    },
    {
      "created": "2026-03-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2e7e1984-2c67-4f7d-a851-d55b3f618519",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:05:02.000Z",
      "valid_until": "2026-04-15T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T09:32:58.654Z",
      "x_nadsec_last_seen": "2026-03-14T09:32:58.654Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-14T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--0c3d4ec6-4320-4971-83c6-720865904870",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.241.126.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:05:02.000Z",
      "valid_until": "2026-04-15T10:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T09:40:04.543Z",
      "x_nadsec_last_seen": "2026-03-14T09:47:07.768Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-14T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--090816dd-9b19-4770-9fc7-f5ec5029d018",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.183.44.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T11:05:03.000Z",
      "valid_until": "2026-04-15T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T10:17:49.860Z",
      "x_nadsec_last_seen": "2026-03-14T10:19:57.325Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-14T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=18103; asn_org=Neuviz Net",
      "id": "indicator--32a613c4-e263-4390-a7d9-15871cf4a6ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.128.67.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T11:05:03.000Z",
      "valid_until": "2026-04-15T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T10:20:51.914Z",
      "x_nadsec_last_seen": "2026-03-14T10:22:56.580Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "18103"
      ],
      "x_nadsec_orgs": [
        "Neuviz Net"
      ]
    },
    {
      "created": "2026-03-14T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45458; asn_org=SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "id": "indicator--d756f86b-d8a1-44d5-8c45-ad1e63feb74a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.100.42.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T11:05:03.000Z",
      "valid_until": "2026-04-15T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T10:18:17.028Z",
      "x_nadsec_last_seen": "2026-03-14T10:24:35.847Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45458"
      ],
      "x_nadsec_orgs": [
        "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX"
      ]
    },
    {
      "created": "2026-03-14T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--3fc98896-5f41-4df8-8b24-638b4b3f5886",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T11:05:03.000Z",
      "valid_until": "2026-04-15T11:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T10:39:35.439Z",
      "x_nadsec_last_seen": "2026-03-20T15:28:39.882Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-14T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--4b725b5a-5152-4ca8-a071-19ac60026ac1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T11:05:03.000Z",
      "valid_until": "2026-04-15T11:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T10:13:34.290Z",
      "x_nadsec_last_seen": "2026-03-15T06:36:33.934Z",
      "x_nadsec_ports": [
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-14T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--a91c9ae2-34c9-451d-bf16-53ca39dfda40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.15.156.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T11:05:03.000Z",
      "valid_until": "2026-04-15T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T10:36:43.885Z",
      "x_nadsec_last_seen": "2026-03-14T10:43:48.446Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-03-14T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=137085; asn_org=ANO Broadband Service Pvt Ltd",
      "id": "indicator--12321e3a-8008-4b01-9b7a-5fd7f9212736",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.106.30.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:05:02.000Z",
      "valid_until": "2026-04-15T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T11:43:47.951Z",
      "x_nadsec_last_seen": "2026-03-14T11:50:27.320Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "137085"
      ],
      "x_nadsec_orgs": [
        "ANO Broadband Service Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-14T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--110caa8f-f649-4634-b59b-f4930cb29cc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.155.11.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:05:02.000Z",
      "valid_until": "2026-04-15T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T11:50:20.083Z",
      "x_nadsec_last_seen": "2026-03-21T12:56:05.770Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-14T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=37340; asn_org=Spectranet",
      "id": "indicator--03e8ba4b-1aa7-47d5-9152-4f4c92051511",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.120.68.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:05:02.000Z",
      "valid_until": "2026-04-15T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T11:12:48.820Z",
      "x_nadsec_last_seen": "2026-03-14T11:14:55.960Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37340"
      ],
      "x_nadsec_orgs": [
        "Spectranet"
      ]
    },
    {
      "created": "2026-03-14T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--2ea66a35-1660-4a0e-9f2a-3da4fbc4f146",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.249.124.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:05:02.000Z",
      "valid_until": "2026-04-15T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T11:50:51.742Z",
      "x_nadsec_last_seen": "2026-03-14T11:50:52.143Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-14T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--9ecde781-f464-4213-9c30-0fd9c9864c45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.51.102.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:05:02.000Z",
      "valid_until": "2026-04-15T12:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-14T11:54:47.926Z",
      "x_nadsec_last_seen": "2026-03-14T16:29:50.439Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-03-14T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=20978; asn_org=TT Mobil Iletisim Hizmetleri A.S",
      "id": "indicator--51f9dee2-aa36-4df2-96e9-6d5dc01ce242",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.104.12.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:05:02.000Z",
      "valid_until": "2026-04-15T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T11:25:27.211Z",
      "x_nadsec_last_seen": "2026-03-14T11:32:49.190Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "20978"
      ],
      "x_nadsec_orgs": [
        "TT Mobil Iletisim Hizmetleri A.S"
      ]
    },
    {
      "created": "2026-03-14T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--286f8b5c-f9e4-467c-89a1-401702d6f0a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.34.223.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:05:02.000Z",
      "valid_until": "2026-04-15T12:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-14T12:02:39.832Z",
      "x_nadsec_last_seen": "2026-03-14T15:13:31.665Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-03-14T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--32828f09-f796-4e45-88bf-0120cb1c2f73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.62.4.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:05:02.000Z",
      "valid_until": "2026-04-15T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T11:20:57.167Z",
      "x_nadsec_last_seen": "2026-03-14T11:20:57.525Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-03-14T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--af77e1d6-5bb4-465a-86fb-7078475bfb6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.71.152.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:05:02.000Z",
      "valid_until": "2026-04-15T12:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-14T12:02:50.302Z",
      "x_nadsec_last_seen": "2026-03-14T13:18:47.988Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-14T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--aea9aff9-e932-4e46-9d63-29dfa9b14b55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.53.198.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T13:05:03.000Z",
      "valid_until": "2026-04-15T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T13:01:52.045Z",
      "x_nadsec_last_seen": "2026-03-14T13:03:56.977Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-14T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=37069; asn_org=MOBINIL",
      "id": "indicator--6d8f844f-8c03-4c7e-b0ab-efecd5ef72de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.37.206.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T13:05:03.000Z",
      "valid_until": "2026-04-15T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T12:19:48.814Z",
      "x_nadsec_last_seen": "2026-03-14T12:21:56.044Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "37069"
      ],
      "x_nadsec_orgs": [
        "MOBINIL"
      ]
    },
    {
      "created": "2026-03-14T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BD; asn=137967; asn_org=Digicon Telecommunication Ltd",
      "id": "indicator--1a4f22eb-3449-4644-aa01-6e136e3e14bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.204.151.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T13:05:03.000Z",
      "valid_until": "2026-04-15T13:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-14T12:16:11.328Z",
      "x_nadsec_last_seen": "2026-03-15T15:32:24.724Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "137967"
      ],
      "x_nadsec_orgs": [
        "Digicon Telecommunication Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-14T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--267a773a-095d-42d3-b5fd-ce0a9e5a1e50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.134.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T13:05:03.000Z",
      "valid_until": "2026-04-15T13:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-14T12:21:59.463Z",
      "x_nadsec_last_seen": "2026-03-14T12:22:32.069Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-14T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mqttd; ports=1883; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--20de2dc8-5d71-443e-9837-edcdb2c20b45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.191.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T13:05:03.000Z",
      "valid_until": "2026-04-15T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T12:35:20.924Z",
      "x_nadsec_last_seen": "2026-03-14T12:35:50.332Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-14T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--474ac3a9-0bca-4b2f-abf2-9cd6d91406cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.242.245.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T13:05:03.000Z",
      "valid_until": "2026-04-15T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T12:27:23.163Z",
      "x_nadsec_last_seen": "2026-03-14T12:34:20.645Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-14T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VE; asn=27717; asn_org=Corporacion Digitel C.A.",
      "id": "indicator--fcbd2685-e1f5-41d2-a17a-b8991d564b70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.167.85.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T13:05:03.000Z",
      "valid_until": "2026-04-15T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T12:16:35.484Z",
      "x_nadsec_last_seen": "2026-03-14T12:16:35.796Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "27717"
      ],
      "x_nadsec_orgs": [
        "Corporacion Digitel C.A."
      ]
    },
    {
      "created": "2026-03-14T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--e312c12c-ba1b-4b7d-af1a-f72b215881ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.249.22.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T13:05:03.000Z",
      "valid_until": "2026-04-15T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T12:11:20.130Z",
      "x_nadsec_last_seen": "2026-03-14T12:13:26.856Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-14T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0fbb174c-49b0-4fb5-bc00-563e89943b89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.25.20.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:05:03.000Z",
      "valid_until": "2026-04-15T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T13:17:57.165Z",
      "x_nadsec_last_seen": "2026-03-14T13:20:03.449Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-14T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--83c895b4-ffb3-4514-8113-c140f24ca8aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.191.61.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:05:03.000Z",
      "valid_until": "2026-04-15T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T13:41:45.957Z",
      "x_nadsec_last_seen": "2026-03-14T13:49:25.151Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-14T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9905; asn_org=Linknet ASN",
      "id": "indicator--7e790f10-3651-4e10-a8fb-6c96d4810943",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.137.6.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:05:03.000Z",
      "valid_until": "2026-04-15T14:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-14T13:13:50.534Z",
      "x_nadsec_last_seen": "2026-03-14T15:51:00.966Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9905"
      ],
      "x_nadsec_orgs": [
        "Linknet ASN"
      ]
    },
    {
      "created": "2026-03-14T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--6bb152cc-5d2f-424a-9ace-eb58b63fb45a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.47.129.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:05:03.000Z",
      "valid_until": "2026-04-15T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T13:20:10.283Z",
      "x_nadsec_last_seen": "2026-03-14T13:22:17.155Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-14T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--b7ce0d24-bc4a-4d77-872f-56724c402348",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:05:03.000Z",
      "valid_until": "2026-04-15T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T13:30:09.118Z",
      "x_nadsec_last_seen": "2026-03-17T22:38:06.185Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-14T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mirrord; ports=42; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--68d80ead-e207-4416-b259-bad04e6998d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:05:03.000Z",
      "valid_until": "2026-04-15T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-14T13:51:10.060Z",
      "x_nadsec_last_seen": "2026-03-14T13:58:01.040Z",
      "x_nadsec_ports": [
        "42",
        "81",
        "35561"
      ],
      "x_nadsec_services": [
        "httpd",
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-14T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--b648c2e2-870a-44cc-92c1-55da36f0b757",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:05:03.000Z",
      "valid_until": "2026-04-15T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T13:59:57.855Z",
      "x_nadsec_last_seen": "2026-03-14T13:59:57.855Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-14T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--20b8a5f8-a545-42ff-99db-7193fec15053",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.59.246.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:05:03.000Z",
      "valid_until": "2026-04-15T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T14:03:34.024Z",
      "x_nadsec_last_seen": "2026-03-14T14:09:02.147Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-14T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f6b28a5a-4a5b-4d18-8ec4-13d7d8049d3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T15:05:02.000Z",
      "valid_until": "2026-04-15T15:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-14T14:32:11.274Z",
      "x_nadsec_last_seen": "2026-03-23T13:31:39.041Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-14T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mongod; ports=27017; cc=AU; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--a74d0342-24ca-4af1-a5be-637797dd8680",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.35.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T15:05:02.000Z",
      "valid_until": "2026-04-15T15:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-14T14:27:47.861Z",
      "x_nadsec_last_seen": "2026-03-14T14:28:28.217Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-14T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--763fb0b7-eecd-4f7a-bf3b-c7d8e4e1beab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.172.18.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T15:05:02.000Z",
      "valid_until": "2026-04-15T15:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-14T14:19:54.593Z",
      "x_nadsec_last_seen": "2026-03-14T23:58:07.215Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-14T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GB; asn=5607; asn_org=Sky UK Limited",
      "id": "indicator--5583d9f9-2a6f-4790-a4b4-cbc1bef9c63d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.216.23.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T15:05:02.000Z",
      "valid_until": "2026-04-15T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T14:48:05.815Z",
      "x_nadsec_last_seen": "2026-03-14T14:50:11.737Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "5607"
      ],
      "x_nadsec_orgs": [
        "Sky UK Limited"
      ]
    },
    {
      "created": "2026-03-14T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--f14683ce-00cd-4041-9f90-d312095247b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.56.147.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T15:05:02.000Z",
      "valid_until": "2026-04-15T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T14:08:25.667Z",
      "x_nadsec_last_seen": "2026-03-14T14:10:30.681Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-14T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135247; asn_org=K Net Solutions Pvt Ltd",
      "id": "indicator--3b38db84-441a-43b2-8b68-fd6f01e178c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.251.33.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T15:05:02.000Z",
      "valid_until": "2026-04-15T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T14:21:09.827Z",
      "x_nadsec_last_seen": "2026-03-14T14:23:14.308Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135247"
      ],
      "x_nadsec_orgs": [
        "K Net Solutions Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-14T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=9121; asn_org=Turk Telekom; user(top)=**",
      "id": "indicator--84c91484-f4c9-4a81-ae34-ccc9ba1ef98d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.186.253.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T15:05:02.000Z",
      "valid_until": "2026-04-15T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T14:54:32.450Z",
      "x_nadsec_last_seen": "2026-03-14T14:54:32.450Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-14T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--b3da3872-51d4-4a54-8812-f0d1c7e14736",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T15:05:02.000Z",
      "valid_until": "2026-04-15T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T14:15:57.842Z",
      "x_nadsec_last_seen": "2026-03-14T14:15:57.842Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-14T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=17625; asn_org=BlazeNets Network",
      "id": "indicator--7e5cfe02-7130-4ed0-b6ed-4074012e4467",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.19.134.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:05:04.000Z",
      "valid_until": "2026-04-15T16:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T15:50:56.338Z",
      "x_nadsec_last_seen": "2026-03-14T15:57:30.854Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17625"
      ],
      "x_nadsec_orgs": [
        "BlazeNets Network"
      ]
    },
    {
      "created": "2026-03-14T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--15dbe329-3c3d-4a23-947f-d7d865726779",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.17.46.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:05:04.000Z",
      "valid_until": "2026-04-15T16:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T15:30:15.785Z",
      "x_nadsec_last_seen": "2026-03-14T15:32:20.571Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-14T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2c0810b8-0ea0-4745-92c1-389c5b5962c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '132.196.42.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:05:04.000Z",
      "valid_until": "2026-04-15T16:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T15:13:13.297Z",
      "x_nadsec_last_seen": "2026-03-14T15:13:23.642Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-14T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--163293bb-e9d9-4a9f-a03e-86afea5b55e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.192.21.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:05:04.000Z",
      "valid_until": "2026-04-15T16:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T15:05:27.433Z",
      "x_nadsec_last_seen": "2026-03-14T15:07:33.497Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-14T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KZ; asn=200962; asn_org=LLC Citicom Systems",
      "id": "indicator--fc544203-e66d-4c41-8857-e3287a1f0159",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.90.74.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:05:04.000Z",
      "valid_until": "2026-04-15T16:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-14T15:32:04.029Z",
      "x_nadsec_last_seen": "2026-03-14T15:32:56.381Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "200962"
      ],
      "x_nadsec_orgs": [
        "LLC Citicom Systems"
      ]
    },
    {
      "created": "2026-03-14T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=273490; asn_org=FIBRION INTERNET LTDA",
      "id": "indicator--573225a1-b6ca-4e57-a973-df7f761da025",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.229.230.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:05:04.000Z",
      "valid_until": "2026-04-15T16:05:02.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-14T15:34:14.338Z",
      "x_nadsec_last_seen": "2026-03-23T02:22:47.938Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "273490"
      ],
      "x_nadsec_orgs": [
        "FIBRION INTERNET LTDA"
      ]
    },
    {
      "created": "2026-03-14T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6902a184-062a-4bd5-8709-a46ef9b4fa0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:05:04.000Z",
      "valid_until": "2026-04-15T16:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T15:40:06.036Z",
      "x_nadsec_last_seen": "2026-03-14T15:40:06.036Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-14T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=12271; asn_org=Charter Communications Inc",
      "id": "indicator--bf246b1a-7aa3-439d-bdeb-8b44182b312d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '24.103.110.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:05:04.000Z",
      "valid_until": "2026-04-15T16:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T15:32:36.120Z",
      "x_nadsec_last_seen": "2026-03-14T15:34:42.820Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "12271"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-03-14T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=131386; asn_org=Long Van System Solution JSC; user(top)=**",
      "id": "indicator--b412b98f-1173-4963-8f5e-dd89143b43f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.119.87.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:05:04.000Z",
      "valid_until": "2026-04-15T16:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T16:01:32.384Z",
      "x_nadsec_last_seen": "2026-03-14T16:01:32.384Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "131386"
      ],
      "x_nadsec_orgs": [
        "Long Van System Solution JSC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-14T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--a1b9b91e-7300-4fc4-9226-8fbe96cde816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:05:04.000Z",
      "valid_until": "2026-04-15T16:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T15:48:30.227Z",
      "x_nadsec_last_seen": "2026-03-14T15:48:30.227Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-14T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--7a7534be-d5b2-4eab-bd38-d685a217276f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.217.159.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:05:04.000Z",
      "valid_until": "2026-04-15T16:05:02.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-14T15:27:40.021Z",
      "x_nadsec_last_seen": "2026-03-28T15:21:28.036Z",
      "x_nadsec_ports": [
        "135",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-03-14T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--354cc2b5-96ff-47f2-9706-4436f01ce7ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.93.43.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:05:04.000Z",
      "valid_until": "2026-04-15T16:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T15:20:10.365Z",
      "x_nadsec_last_seen": "2026-03-14T15:20:10.702Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-14T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UA; asn=57519; asn_org=LTD Bukovel",
      "id": "indicator--b556e29d-cbc8-4618-b323-cd7b80c8d91c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.232.128.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:05:04.000Z",
      "valid_until": "2026-04-15T16:05:02.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-13T16:43:33.905Z",
      "x_nadsec_last_seen": "2026-03-14T20:57:27.825Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "57519"
      ],
      "x_nadsec_orgs": [
        "LTD Bukovel"
      ]
    },
    {
      "created": "2026-03-14T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262903; asn_org=Tubaron Telecom",
      "id": "indicator--7e8a16bf-c726-4fb5-9276-ac7aa5fcad29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.251.56.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:05:02.000Z",
      "valid_until": "2026-04-15T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T16:44:14.388Z",
      "x_nadsec_last_seen": "2026-03-14T16:46:21.448Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262903"
      ],
      "x_nadsec_orgs": [
        "Tubaron Telecom"
      ]
    },
    {
      "created": "2026-03-14T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=ftpd; ports=21; cc=RO; asn=42397; asn_org=Bunea TELECOM SRL",
      "id": "indicator--6169aa37-4c72-4f68-b5d5-88ff2f18837b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.29.13.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:05:02.000Z",
      "valid_until": "2026-04-15T17:05:01.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-14T16:39:32.172Z",
      "x_nadsec_last_seen": "2026-03-14T17:39:15.712Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "42397"
      ],
      "x_nadsec_orgs": [
        "Bunea TELECOM SRL"
      ]
    },
    {
      "created": "2026-03-14T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b6cad070-d43e-49a5-b615-646c2bdc79aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:05:02.000Z",
      "valid_until": "2026-04-15T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T16:11:57.700Z",
      "x_nadsec_last_seen": "2026-03-14T16:11:57.700Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-14T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6304ddfd-6e90-4ad1-b761-eff6e7ba7e57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.168.122.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:05:02.000Z",
      "valid_until": "2026-04-15T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T16:31:25.462Z",
      "x_nadsec_last_seen": "2026-03-14T16:31:25.462Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-14T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--0a5d88d7-6184-4d1a-b7ae-4c8db6e6b09b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.6.102.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:05:02.000Z",
      "valid_until": "2026-04-15T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T16:30:05.531Z",
      "x_nadsec_last_seen": "2026-03-14T16:32:12.019Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-03-14T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PL; asn=16342; asn_org=Toya sp.z.o.o",
      "id": "indicator--9b189d53-10c7-424e-9a81-bf898cd4e143",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.182.57.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:05:02.000Z",
      "valid_until": "2026-04-15T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T16:31:00.721Z",
      "x_nadsec_last_seen": "2026-03-23T14:52:55.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "16342"
      ],
      "x_nadsec_orgs": [
        "Toya sp.z.o.o"
      ]
    },
    {
      "created": "2026-03-14T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=59165; asn_org=Auspice Infratel Pvt. Ltd.",
      "id": "indicator--906eb17e-e7b9-436b-a83c-2097a14aacb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.229.225.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:05:02.000Z",
      "valid_until": "2026-04-15T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T16:25:45.128Z",
      "x_nadsec_last_seen": "2026-03-14T16:27:51.182Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "59165"
      ],
      "x_nadsec_orgs": [
        "Auspice Infratel Pvt. Ltd."
      ]
    },
    {
      "created": "2026-03-14T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TJ; asn=43197; asn_org=Closed Joint Stock Company TT mobile",
      "id": "indicator--70eaf66a-22c2-4d28-b5dd-ef1c4cc8743f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.89.210.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:05:02.000Z",
      "valid_until": "2026-04-15T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T16:59:44.577Z",
      "x_nadsec_last_seen": "2026-03-14T16:59:52.467Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TJ"
      ],
      "x_nadsec_asns": [
        "43197"
      ],
      "x_nadsec_orgs": [
        "Closed Joint Stock Company TT mobile"
      ]
    },
    {
      "created": "2026-03-14T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--47b386e2-1728-46e8-ac5a-da91f82cf2f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T17:05:02.000Z",
      "valid_until": "2026-04-15T17:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-14T16:57:06.252Z",
      "x_nadsec_last_seen": "2026-03-28T01:38:35.734Z",
      "x_nadsec_ports": [
        "1723",
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "pptpd",
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-03-14T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--546ff561-c1b7-4788-b150-316d0b9a43f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.102.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:05:02.000Z",
      "valid_until": "2026-04-15T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T17:29:10.044Z",
      "x_nadsec_last_seen": "2026-03-14T17:31:18.014Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-14T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--04b4f9ce-3285-44ad-a164-b68c1143610f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.182.192.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:05:02.000Z",
      "valid_until": "2026-04-15T18:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-14T17:31:43.327Z",
      "x_nadsec_last_seen": "2026-03-22T08:01:36.785Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-03-14T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=7738; asn_org=V tal",
      "id": "indicator--2632b55c-c146-4f62-8dc6-66191c76dbb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.237.185.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:05:02.000Z",
      "valid_until": "2026-04-15T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T17:47:55.474Z",
      "x_nadsec_last_seen": "2026-03-14T17:50:03.499Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "7738"
      ],
      "x_nadsec_orgs": [
        "V tal"
      ]
    },
    {
      "created": "2026-03-14T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cbc67404-e744-404b-aa62-ce19b895e6da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.210.81.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:05:02.000Z",
      "valid_until": "2026-04-15T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T17:28:48.724Z",
      "x_nadsec_last_seen": "2026-03-14T17:28:49.717Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-14T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=RU; asn=216246; asn_org=Aeza Group LLC",
      "id": "indicator--39341a5a-2d48-41df-b7eb-696e7b987758",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.20.208.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:05:02.000Z",
      "valid_until": "2026-04-15T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T17:49:48.337Z",
      "x_nadsec_last_seen": "2026-03-14T18:32:23.478Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "216246"
      ],
      "x_nadsec_orgs": [
        "Aeza Group LLC"
      ]
    },
    {
      "created": "2026-03-14T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--c49f959b-5942-4996-af49-69ad553f21b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.83.31.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:05:02.000Z",
      "valid_until": "2026-04-15T18:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-14T17:58:16.949Z",
      "x_nadsec_last_seen": "2026-03-20T11:49:12.177Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-14T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--dd83a1ba-7c89-40eb-942d-82432f0d16b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.195.241.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:05:02.000Z",
      "valid_until": "2026-04-15T18:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-09T16:21:16.404Z",
      "x_nadsec_last_seen": "2026-03-20T12:45:19.752Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-14T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--25605881-627e-4d1f-8e41-8d10c841bac8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.105.252.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:05:02.000Z",
      "valid_until": "2026-04-15T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T17:25:47.577Z",
      "x_nadsec_last_seen": "2026-03-14T17:27:54.307Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-14T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--e6a73315-a61b-49e9-9e8b-d7f3d53d2b8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.43.58.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:05:02.000Z",
      "valid_until": "2026-04-15T18:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-14T17:58:42.689Z",
      "x_nadsec_last_seen": "2026-03-18T09:44:19.289Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-03-14T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--9896e034-7ce1-4292-8058-62673b5c1de7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.79.7.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:05:02.000Z",
      "valid_until": "2026-04-15T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T17:26:12.291Z",
      "x_nadsec_last_seen": "2026-03-14T17:30:43.397Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-03-14T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--b7b2abaa-0d9b-4f25-b8f4-63422187a6a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.2.114.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:05:04.000Z",
      "valid_until": "2026-04-15T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T18:30:51.436Z",
      "x_nadsec_last_seen": "2026-03-14T18:30:57.544Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-14T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=41330; asn_org=T2 Mobile LLC",
      "id": "indicator--8f794c9f-e1e9-472d-b06e-7fbe7b357ec1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.59.136.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:05:04.000Z",
      "valid_until": "2026-04-15T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T19:04:30.675Z",
      "x_nadsec_last_seen": "2026-03-14T19:06:38.979Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "41330"
      ],
      "x_nadsec_orgs": [
        "T2 Mobile LLC"
      ]
    },
    {
      "created": "2026-03-14T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--13d417b7-ca96-4f34-bbf8-f4349a2e8272",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.188.25.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:05:04.000Z",
      "valid_until": "2026-04-15T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T18:57:08.124Z",
      "x_nadsec_last_seen": "2026-03-14T18:57:13.554Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-14T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=17072; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--113b4eab-9df0-4c4c-98e5-d2420c5212c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.188.9.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:05:04.000Z",
      "valid_until": "2026-04-15T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T18:08:18.967Z",
      "x_nadsec_last_seen": "2026-03-14T18:10:24.531Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "17072"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-14T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AR; asn=52402; asn_org=INTERCITY COMUNICACIONES S.A.",
      "id": "indicator--4704acfc-9529-4ec9-b7cd-c5913f2ce3e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.123.248.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:05:04.000Z",
      "valid_until": "2026-04-15T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T18:49:08.373Z",
      "x_nadsec_last_seen": "2026-03-14T18:49:08.448Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "52402"
      ],
      "x_nadsec_orgs": [
        "INTERCITY COMUNICACIONES S.A."
      ]
    },
    {
      "created": "2026-03-14T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=51669; asn_org=Home Computer Networks ltd.",
      "id": "indicator--71939079-eccc-4823-85c8-d5a242b478e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.129.134.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:05:04.000Z",
      "valid_until": "2026-04-15T19:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-14T18:22:08.104Z",
      "x_nadsec_last_seen": "2026-03-23T11:44:46.885Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "51669"
      ],
      "x_nadsec_orgs": [
        "Home Computer Networks ltd."
      ]
    },
    {
      "created": "2026-03-14T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--f56de56a-429e-4e99-9695-9f023fbb1685",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.247.63.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T19:05:04.000Z",
      "valid_until": "2026-04-15T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T18:43:56.871Z",
      "x_nadsec_last_seen": "2026-03-14T18:46:03.955Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-14T20:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=24088; asn_org=Hanoi Telecom Joint Stock Company - HCMC Branch",
      "id": "indicator--4111fb74-47be-47d0-b1fd-270696d67401",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.238.69.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:05:08.000Z",
      "valid_until": "2026-04-15T20:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T19:50:29.198Z",
      "x_nadsec_last_seen": "2026-03-14T19:56:49.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24088"
      ],
      "x_nadsec_orgs": [
        "Hanoi Telecom Joint Stock Company - HCMC Branch"
      ]
    },
    {
      "created": "2026-03-14T20:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135223; asn_org=Netway Internet Pvt Ltd",
      "id": "indicator--78584a97-0c4e-477c-9fad-9c510d354706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.255.235.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:05:08.000Z",
      "valid_until": "2026-04-15T20:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-14T19:08:56.046Z",
      "x_nadsec_last_seen": "2026-03-14T21:20:29.338Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135223"
      ],
      "x_nadsec_orgs": [
        "Netway Internet Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-14T20:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mysqld; ports=3306; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--f5b430e5-2153-402e-acbf-8bdd32360af7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.57.168.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:05:08.000Z",
      "valid_until": "2026-04-15T20:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-14T19:14:11.105Z",
      "x_nadsec_last_seen": "2026-03-14T19:14:11.193Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-14T20:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--40f61673-2a3a-41cc-b760-9784a9c65f06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.22.151.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:05:08.000Z",
      "valid_until": "2026-04-15T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T19:29:11.783Z",
      "x_nadsec_last_seen": "2026-03-14T19:29:11.783Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-14T20:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ae30adf4-aae0-4156-8e04-3e41ff9a0f68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:05:08.000Z",
      "valid_until": "2026-04-15T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T19:40:45.761Z",
      "x_nadsec_last_seen": "2026-03-16T10:34:52.695Z",
      "x_nadsec_ports": [
        "81",
        "1883"
      ],
      "x_nadsec_services": [
        "httpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-14T20:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--e9d7555b-8208-4966-af32-8eeb38f3de2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.180.18.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:05:08.000Z",
      "valid_until": "2026-04-15T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T19:32:59.256Z",
      "x_nadsec_last_seen": "2026-03-14T19:35:04.156Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-14T20:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--3efa7230-0a76-40b1-a357-d7012f37c83e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:05:08.000Z",
      "valid_until": "2026-04-15T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T19:33:37.927Z",
      "x_nadsec_last_seen": "2026-03-29T23:14:20.462Z",
      "x_nadsec_ports": [
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-14T20:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--997566b1-263e-480d-b9ef-3fd2263ef472",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:05:08.000Z",
      "valid_until": "2026-04-15T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T20:03:37.409Z",
      "x_nadsec_last_seen": "2026-03-14T20:03:37.409Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-14T20:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BG; asn=211486; asn_org=Alferov Aleksey Aleksandrovich",
      "id": "indicator--6d856bf7-d183-42ff-8f90-04a780e75260",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T20:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.187.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:05:08.000Z",
      "valid_until": "2026-04-15T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T19:12:36.786Z",
      "x_nadsec_last_seen": "2026-03-14T19:12:36.786Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "211486"
      ],
      "x_nadsec_orgs": [
        "Alferov Aleksey Aleksandrovich"
      ]
    },
    {
      "created": "2026-03-14T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=38511; asn_org=PT Remala Abadi",
      "id": "indicator--0e9ae4ea-0537-4da2-b62b-be7860534519",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.255.44.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:05:02.000Z",
      "valid_until": "2026-04-15T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T20:13:25.705Z",
      "x_nadsec_last_seen": "2026-03-14T20:15:29.920Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "38511"
      ],
      "x_nadsec_orgs": [
        "PT Remala Abadi"
      ]
    },
    {
      "created": "2026-03-14T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--f57cb9d1-8ef6-4c0b-8fa4-d7db91c57af3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.29.223.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:05:02.000Z",
      "valid_until": "2026-04-15T21:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T20:44:51.706Z",
      "x_nadsec_last_seen": "2026-03-14T20:50:10.175Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-14T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KG; asn=42581; asn_org=Inform Communications Ltd.",
      "id": "indicator--817a3bd6-addb-4028-bd0e-91bb09e9d3aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.120.212.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:05:02.000Z",
      "valid_until": "2026-04-15T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T21:02:42.143Z",
      "x_nadsec_last_seen": "2026-03-14T21:04:49.877Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "42581"
      ],
      "x_nadsec_orgs": [
        "Inform Communications Ltd."
      ]
    },
    {
      "created": "2026-03-14T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=263652; asn_org=BIZZ INTERNET LTDA",
      "id": "indicator--1569a362-7fbd-4728-b538-e0bdc193ded9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.74.226.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:05:02.000Z",
      "valid_until": "2026-04-15T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T20:36:29.452Z",
      "x_nadsec_last_seen": "2026-03-14T20:38:36.044Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263652"
      ],
      "x_nadsec_orgs": [
        "BIZZ INTERNET LTDA"
      ]
    },
    {
      "created": "2026-03-14T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=BG; asn=48090; asn_org=Techoff Srv Limited",
      "id": "indicator--4217732e-df81-48e2-804e-1c47d49e62fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.178.110.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:05:02.000Z",
      "valid_until": "2026-04-15T21:05:00.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-03-14T20:25:06.448Z",
      "x_nadsec_last_seen": "2026-03-25T21:05:22.586Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "48090"
      ],
      "x_nadsec_orgs": [
        "Techoff Srv Limited"
      ]
    },
    {
      "created": "2026-03-14T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MA; asn=36925; asn_org=ASMedi",
      "id": "indicator--94fe82cd-1802-4e1e-a8ee-4c0b2174ec3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.230.149.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:05:02.000Z",
      "valid_until": "2026-04-15T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T21:04:46.898Z",
      "x_nadsec_last_seen": "2026-03-14T21:06:53.193Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36925"
      ],
      "x_nadsec_orgs": [
        "ASMedi"
      ]
    },
    {
      "created": "2026-03-14T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=269814; asn_org=PROLUX COMSER S.A.",
      "id": "indicator--bf0b0fd5-04e4-4022-979b-daee1d300c19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.186.25.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:05:02.000Z",
      "valid_until": "2026-04-15T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T20:23:30.257Z",
      "x_nadsec_last_seen": "2026-03-14T20:25:37.525Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "269814"
      ],
      "x_nadsec_orgs": [
        "PROLUX COMSER S.A."
      ]
    },
    {
      "created": "2026-03-14T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9583; asn_org=Sify Limited",
      "id": "indicator--e1b47a42-9674-4356-95ae-f8bf575d470a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.6.27.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:05:02.000Z",
      "valid_until": "2026-04-15T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T21:29:52.961Z",
      "x_nadsec_last_seen": "2026-03-14T21:31:58.075Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9583"
      ],
      "x_nadsec_orgs": [
        "Sify Limited"
      ]
    },
    {
      "created": "2026-03-14T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--b231a672-47db-4033-bf4c-1f68d876b1ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.144.178.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:05:02.000Z",
      "valid_until": "2026-04-15T22:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-14T21:55:09.335Z",
      "x_nadsec_last_seen": "2026-03-14T23:47:09.163Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-03-14T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--c7904438-0531-4eb8-90dc-411e677d9596",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.230.249.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:05:02.000Z",
      "valid_until": "2026-04-15T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T21:13:05.383Z",
      "x_nadsec_last_seen": "2026-03-18T18:46:21.198Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-14T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=RU; asn=198953; asn_org=Proton66 OOO",
      "id": "indicator--e224e36c-8f06-4799-a1c0-094111286ffc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.120.22.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:05:02.000Z",
      "valid_until": "2026-04-15T22:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-14T21:18:53.636Z",
      "x_nadsec_last_seen": "2026-03-15T04:00:34.142Z",
      "x_nadsec_ports": [
        "1433",
        "21"
      ],
      "x_nadsec_services": [
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "198953"
      ],
      "x_nadsec_orgs": [
        "Proton66 OOO"
      ]
    },
    {
      "created": "2026-03-14T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC; user(top)=**",
      "id": "indicator--e73dbb0c-a027-4bcc-9e85-aa1640529afa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.116.1.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:05:02.000Z",
      "valid_until": "2026-04-15T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T21:10:38.492Z",
      "x_nadsec_last_seen": "2026-03-14T21:10:39.838Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-14T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--48bb4e69-ff25-46a6-8145-3379faefbec9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.189.159.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:05:02.000Z",
      "valid_until": "2026-04-15T22:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-14T21:15:09.659Z",
      "x_nadsec_last_seen": "2026-03-18T18:46:22.309Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-14T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--c56e21ab-8520-4d25-92f3-0b4772523cb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.53.191.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:05:02.000Z",
      "valid_until": "2026-04-15T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T21:55:02.869Z",
      "x_nadsec_last_seen": "2026-03-14T21:57:11.116Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-14T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--95ad3ab5-7bfe-4e5b-bdd4-b09c7fa7cef1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:05:02.000Z",
      "valid_until": "2026-04-15T22:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-14T21:57:08.669Z",
      "x_nadsec_last_seen": "2026-03-15T06:42:16.389Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-14T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=48438; asn_org=Corbina Telecom Llc.",
      "id": "indicator--e1bc05d4-3816-4e14-bbe3-a410b762a070",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.43.142.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:05:02.000Z",
      "valid_until": "2026-04-15T22:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T21:42:20.785Z",
      "x_nadsec_last_seen": "2026-03-14T21:49:18.019Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "48438"
      ],
      "x_nadsec_orgs": [
        "Corbina Telecom Llc."
      ]
    },
    {
      "created": "2026-03-14T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--93ed98b9-912b-4ac0-b080-ef07f582025b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.119.43.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:05:02.000Z",
      "valid_until": "2026-04-15T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T21:44:01.269Z",
      "x_nadsec_last_seen": "2026-03-14T21:44:01.619Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-14T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=136119; asn_org=PT Bali Towerindo Sentra, Tbk",
      "id": "indicator--7f9ef71d-9c9a-4433-9ea9-fc8e20b6eb09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.119.145.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:05:03.000Z",
      "valid_until": "2026-04-15T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T23:04:27.752Z",
      "x_nadsec_last_seen": "2026-03-14T23:04:31.899Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "136119"
      ],
      "x_nadsec_orgs": [
        "PT Bali Towerindo Sentra, Tbk"
      ]
    },
    {
      "created": "2026-03-14T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--43423e7c-0cfd-47a4-81f0-1fc79bc96606",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.124.44.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:05:03.000Z",
      "valid_until": "2026-04-15T23:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T22:22:37.125Z",
      "x_nadsec_last_seen": "2026-03-14T22:29:43.229Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-14T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--da4e55ce-1674-4623-9322-bf9beb49fdad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.25.30.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:05:03.000Z",
      "valid_until": "2026-04-15T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T23:04:39.298Z",
      "x_nadsec_last_seen": "2026-03-14T23:04:45.592Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-14T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2b7ed60f-2c04-44fc-98ff-0c52b7b9c2f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:05:03.000Z",
      "valid_until": "2026-04-15T23:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T22:33:00.125Z",
      "x_nadsec_last_seen": "2026-03-18T13:32:34.008Z",
      "x_nadsec_ports": [
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-14T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--270c42d7-f3fb-4397-adaf-ccf534d0d7ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.235.63.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:05:03.000Z",
      "valid_until": "2026-04-15T23:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-14T22:47:30.821Z",
      "x_nadsec_last_seen": "2026-03-16T16:42:05.408Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-14T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--78ff70ff-a3f3-43d2-b120-ab1afcd08163",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.235.66.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:05:03.000Z",
      "valid_until": "2026-04-15T23:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-14T22:47:31.049Z",
      "x_nadsec_last_seen": "2026-03-16T16:42:50.830Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-14T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--cc910ec7-2a6b-4b05-ae96-c52aad4550af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.18.53.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:05:03.000Z",
      "valid_until": "2026-04-15T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T22:47:43.504Z",
      "x_nadsec_last_seen": "2026-03-14T22:49:50.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-14T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--0c53d773-fbbd-4019-844c-52b944cf7041",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-14T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.23.98.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:05:03.000Z",
      "valid_until": "2026-04-15T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T22:26:40.212Z",
      "x_nadsec_last_seen": "2026-03-14T22:28:47.873Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-15T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--7bec12b8-1013-4f52-a037-67f18fb456ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.87.234.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:05:02.000Z",
      "valid_until": "2026-04-16T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-14T23:07:48.444Z",
      "x_nadsec_last_seen": "2026-03-14T23:14:52.826Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-15T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=4755; asn_org=TATA Communications formerly VSNL is Leading ISP",
      "id": "indicator--06740c2f-e1e5-4f9e-8b5c-27b9a8ed8cdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.143.187.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:05:02.000Z",
      "valid_until": "2026-04-16T00:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-14T23:18:57.482Z",
      "x_nadsec_last_seen": "2026-03-14T23:21:02.816Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "4755"
      ],
      "x_nadsec_orgs": [
        "TATA Communications formerly VSNL is Leading ISP"
      ]
    },
    {
      "created": "2026-03-15T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=7488; asn_org=CNServer LLC",
      "id": "indicator--8dcddffa-36b7-4e61-8a47-dcaa0e3b9e39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.34.144.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:05:02.000Z",
      "valid_until": "2026-04-16T00:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-14T23:59:10.061Z",
      "x_nadsec_last_seen": "2026-03-24T20:13:43.946Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "7488"
      ],
      "x_nadsec_orgs": [
        "CNServer LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "%****%"
      ]
    },
    {
      "created": "2026-03-15T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--75944978-17ff-4ce6-b804-402eba16a79e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.146.209.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:05:02.000Z",
      "valid_until": "2026-04-16T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T23:40:47.009Z",
      "x_nadsec_last_seen": "2026-03-14T23:42:52.532Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-15T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=5573; asn_org=Rostelecom",
      "id": "indicator--dc05f032-5bb6-4afa-9ced-756d2b5103af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.112.230.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:05:02.000Z",
      "valid_until": "2026-04-16T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T23:14:06.102Z",
      "x_nadsec_last_seen": "2026-03-14T23:14:06.222Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "5573"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-15T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--e6b9afe5-06bc-49b1-ab73-4adc91ce268c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.202.4.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:05:02.000Z",
      "valid_until": "2026-04-16T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T23:16:13.356Z",
      "x_nadsec_last_seen": "2026-03-14T23:18:20.406Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-15T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--a57ac641-3cf2-46b6-936e-f485689e7294",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.145.117.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:05:02.000Z",
      "valid_until": "2026-04-16T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T23:18:57.311Z",
      "x_nadsec_last_seen": "2026-03-14T23:18:57.311Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-15T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--b99efdeb-3120-4639-b825-7601630e0443",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.181.87.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:05:02.000Z",
      "valid_until": "2026-04-16T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-14T23:37:11.275Z",
      "x_nadsec_last_seen": "2026-03-14T23:39:15.719Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-03-15T00:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--1e45ef06-c8cb-4458-8dee-14570bb26c9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T00:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:05:02.000Z",
      "valid_until": "2026-04-16T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-14T23:39:25.312Z",
      "x_nadsec_last_seen": "2026-03-14T23:39:25.312Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-15T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--8ebe94ce-ac6c-495e-bacb-f876864fee25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.248.27.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:05:03.000Z",
      "valid_until": "2026-04-16T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T00:28:40.074Z",
      "x_nadsec_last_seen": "2026-03-15T00:28:45.023Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-15T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--bf1f142a-da69-45c8-94fa-7b3b08b22c1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '158.173.21.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:05:03.000Z",
      "valid_until": "2026-04-16T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T00:22:47.445Z",
      "x_nadsec_last_seen": "2026-03-15T00:22:47.445Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-03-15T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b3911f83-ca4d-47e3-8636-837a0729aacd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.107.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:05:03.000Z",
      "valid_until": "2026-04-16T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T01:01:47.498Z",
      "x_nadsec_last_seen": "2026-03-15T01:01:47.498Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-15T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--71f700a0-e12c-4965-85c0-9101a1e68029",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.82.191.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:05:03.000Z",
      "valid_until": "2026-04-16T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T00:59:21.155Z",
      "x_nadsec_last_seen": "2026-03-15T00:59:21.155Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-15T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--381ef45d-653f-4785-888d-2ef4037ff877",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:05:03.000Z",
      "valid_until": "2026-04-16T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T00:10:39.194Z",
      "x_nadsec_last_seen": "2026-03-22T03:18:40.183Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-15T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=16276; asn_org=OVH SAS; user(top)=**",
      "id": "indicator--9b5fc7cf-3a85-41b4-b37c-683b1f238048",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.137.76.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:05:03.000Z",
      "valid_until": "2026-04-16T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T01:01:09.951Z",
      "x_nadsec_last_seen": "2026-03-26T01:36:13.184Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-15T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=39891; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--6757fce2-0a03-4e04-983e-f18ca398400b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.186.97.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:05:03.000Z",
      "valid_until": "2026-04-16T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T00:31:48.602Z",
      "x_nadsec_last_seen": "2026-03-15T00:39:54.341Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "39891"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-15T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--70108cd0-4d98-4099-9edf-e22ea14dc25a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.89.9.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:05:03.000Z",
      "valid_until": "2026-04-16T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T01:09:42.918Z",
      "x_nadsec_last_seen": "2026-03-15T01:11:49.916Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-15T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--93ba5069-7dee-479f-91dd-53f4f59d4697",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.86.112.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:05:03.000Z",
      "valid_until": "2026-04-16T02:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T01:52:57.260Z",
      "x_nadsec_last_seen": "2026-03-15T01:53:07.438Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-15T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=264278; asn_org=MICROTELL INFORMATICA",
      "id": "indicator--c0f84b35-58db-4a13-9478-ab35cca7e368",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.121.49.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:05:03.000Z",
      "valid_until": "2026-04-16T02:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-15T01:53:53.672Z",
      "x_nadsec_last_seen": "2026-03-30T12:46:53.861Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264278"
      ],
      "x_nadsec_orgs": [
        "MICROTELL INFORMATICA"
      ]
    },
    {
      "created": "2026-03-15T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=262867; asn_org=HOJE SISTEMAS DE INFORMATICA LTDA",
      "id": "indicator--96394ccb-98f7-45d5-9293-4c07a5e4854e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.20.192.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:05:03.000Z",
      "valid_until": "2026-04-16T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T01:54:21.179Z",
      "x_nadsec_last_seen": "2026-03-15T01:54:21.179Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262867"
      ],
      "x_nadsec_orgs": [
        "HOJE SISTEMAS DE INFORMATICA LTDA"
      ]
    },
    {
      "created": "2026-03-15T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=17222; asn_org=MUNDIVOX DO BRASIL LTDA",
      "id": "indicator--043feacc-d972-4e1c-b1e3-dbd0b6073f61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.92.99.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:05:03.000Z",
      "valid_until": "2026-04-16T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T01:20:49.259Z",
      "x_nadsec_last_seen": "2026-03-15T01:22:55.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "17222"
      ],
      "x_nadsec_orgs": [
        "MUNDIVOX DO BRASIL LTDA"
      ]
    },
    {
      "created": "2026-03-15T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--91b5c36a-2b68-4cb6-87fc-b48bbbd7b665",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.14.163.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:05:03.000Z",
      "valid_until": "2026-04-16T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T01:13:56.980Z",
      "x_nadsec_last_seen": "2026-03-15T01:16:03.605Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-15T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--30d77914-02f5-457c-8fc0-c643d8c40bc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.76.175.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:05:03.000Z",
      "valid_until": "2026-04-16T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T01:23:46.151Z",
      "x_nadsec_last_seen": "2026-03-15T01:25:52.594Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-15T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--f283d690-d4d3-4954-92cf-d93500e963e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.188.13.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:05:03.000Z",
      "valid_until": "2026-04-16T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T01:24:03.968Z",
      "x_nadsec_last_seen": "2026-03-15T01:24:10.639Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-15T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e402365c-595a-4332-92e9-54493ca520a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.175.57.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:05:03.000Z",
      "valid_until": "2026-04-16T02:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-15T01:35:15.294Z",
      "x_nadsec_last_seen": "2026-03-15T03:52:59.138Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-15T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=136716; asn_org=APPLE BROADBAND SERVICES PVT. LTD",
      "id": "indicator--6668d11c-dad2-48da-8341-f3c51cf637de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.46.234.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:05:02.000Z",
      "valid_until": "2026-04-16T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T02:25:23.084Z",
      "x_nadsec_last_seen": "2026-03-15T02:30:17.206Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "136716"
      ],
      "x_nadsec_orgs": [
        "APPLE BROADBAND SERVICES PVT. LTD"
      ]
    },
    {
      "created": "2026-03-15T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=629; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--0f6687fa-2ce5-484d-97ef-fe4655993d21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.77.173.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:05:02.000Z",
      "valid_until": "2026-04-16T03:05:01.000Z",
      "x_nadsec_event_count": 3148,
      "x_nadsec_first_seen": "2026-03-15T02:55:42.538Z",
      "x_nadsec_last_seen": "2026-03-15T03:24:17.815Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-15T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--bc0d7fe3-79dc-4544-be7c-9ae73a6e2bae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.191.8.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:05:02.000Z",
      "valid_until": "2026-04-16T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T02:25:53.608Z",
      "x_nadsec_last_seen": "2026-03-15T02:32:45.180Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-15T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e5bcc242-9ff0-4811-b6a7-9f1091ce503b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.73.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:05:02.000Z",
      "valid_until": "2026-04-16T03:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-15T02:16:26.628Z",
      "x_nadsec_last_seen": "2026-03-20T01:03:17.312Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-15T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TN; asn=37693; asn_org=TUNISIANA",
      "id": "indicator--ab313e85-db08-4ab8-8ca2-9079542b987b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.179.236.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:05:02.000Z",
      "valid_until": "2026-04-16T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T03:03:28.725Z",
      "x_nadsec_last_seen": "2026-03-15T03:03:35.056Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37693"
      ],
      "x_nadsec_orgs": [
        "TUNISIANA"
      ]
    },
    {
      "created": "2026-03-15T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=30600; asn_org=Metronet",
      "id": "indicator--61277feb-2322-419f-ac14-a3f4bb808cbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.180.210.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:05:02.000Z",
      "valid_until": "2026-04-16T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T02:11:04.060Z",
      "x_nadsec_last_seen": "2026-03-15T02:15:52.841Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "30600"
      ],
      "x_nadsec_orgs": [
        "Metronet"
      ]
    },
    {
      "created": "2026-03-15T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--0e295883-9d5d-47cf-9dec-031e07594d91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:05:02.000Z",
      "valid_until": "2026-04-16T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T02:52:07.351Z",
      "x_nadsec_last_seen": "2026-03-28T18:19:45.066Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-15T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e8e91247-3014-49fe-adf9-e5f709897c47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:05:02.000Z",
      "valid_until": "2026-04-16T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T02:52:06.910Z",
      "x_nadsec_last_seen": "2026-03-15T02:52:06.910Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-15T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7fa6cacf-7878-45ef-ad04-85158b2b905b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:05:02.000Z",
      "valid_until": "2026-04-16T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T02:52:28.435Z",
      "x_nadsec_last_seen": "2026-03-15T02:52:29.222Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-15T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=136556; asn_org=MS BD ONLINE SYSTEMS",
      "id": "indicator--ed4d4d34-6cc0-4487-af21-87125788b0dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.92.161.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:05:03.000Z",
      "valid_until": "2026-04-16T04:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T03:51:29.708Z",
      "x_nadsec_last_seen": "2026-03-15T03:58:08.614Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "136556"
      ],
      "x_nadsec_orgs": [
        "MS BD ONLINE SYSTEMS"
      ]
    },
    {
      "created": "2026-03-15T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EC; asn=27947; asn_org=Telconet S.A",
      "id": "indicator--5f0b827f-5fd1-480d-a21d-f1102e9881fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.100.78.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:05:03.000Z",
      "valid_until": "2026-04-16T04:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-15T03:14:31.506Z",
      "x_nadsec_last_seen": "2026-03-16T12:29:52.617Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "27947"
      ],
      "x_nadsec_orgs": [
        "Telconet S.A"
      ]
    },
    {
      "created": "2026-03-15T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mongod; ports=27017; cc=NG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2444d111-1635-4c3e-9486-1d92be0434a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.10.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:05:03.000Z",
      "valid_until": "2026-04-16T04:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T03:39:46.730Z",
      "x_nadsec_last_seen": "2026-03-15T09:28:32.186Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-15T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--a8cba964-3cff-42da-8c20-abb9578a3bcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.196.52.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:05:03.000Z",
      "valid_until": "2026-04-16T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T03:39:19.043Z",
      "x_nadsec_last_seen": "2026-03-15T03:41:24.289Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-03-15T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31208; asn_org=PJSC MegaFon",
      "id": "indicator--8f0219b6-d224-4953-b926-cfd060dfaa7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.170.53.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:05:03.000Z",
      "valid_until": "2026-04-16T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T03:16:28.728Z",
      "x_nadsec_last_seen": "2026-03-15T03:18:35.365Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31208"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-15T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2eb7534f-3361-440b-af44-48157a5021db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:05:03.000Z",
      "valid_until": "2026-04-16T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T03:22:38.300Z",
      "x_nadsec_last_seen": "2026-03-15T03:22:38.300Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-15T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--c3aff435-dd5f-4b34-ba1b-4527e4d18543",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.140.92.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:05:03.000Z",
      "valid_until": "2026-04-16T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T03:45:00.967Z",
      "x_nadsec_last_seen": "2026-03-15T03:45:00.967Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-15T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--cccc1112-1b19-4d84-838b-36b7dfededdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.53.204.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:05:03.000Z",
      "valid_until": "2026-04-16T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T03:45:00.382Z",
      "x_nadsec_last_seen": "2026-03-15T03:45:00.382Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-15T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--1ae2ecba-b57b-410c-87ad-b44beb9e1d47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.0.53.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:05:07.000Z",
      "valid_until": "2026-04-16T05:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-13T08:44:33.659Z",
      "x_nadsec_last_seen": "2026-03-15T04:23:55.259Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-03-15T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=38493; asn_org=Royal Green Communication Limited",
      "id": "indicator--faa3170c-f73f-4cdf-a205-9c9a0199a5ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.151.212.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:05:07.000Z",
      "valid_until": "2026-04-16T05:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-15T04:57:50.451Z",
      "x_nadsec_last_seen": "2026-03-15T07:14:54.856Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "38493"
      ],
      "x_nadsec_orgs": [
        "Royal Green Communication Limited"
      ]
    },
    {
      "created": "2026-03-15T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--fc9363a0-9509-40a2-a71c-a52a1758d75e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.96.34.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:05:07.000Z",
      "valid_until": "2026-04-16T05:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-15T04:11:24.442Z",
      "x_nadsec_last_seen": "2026-03-19T05:29:36.790Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-15T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--81fe6c51-4227-4421-a613-9c54250dfa6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.53.62.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:05:07.000Z",
      "valid_until": "2026-04-16T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T04:09:03.729Z",
      "x_nadsec_last_seen": "2026-03-15T04:16:00.685Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-15T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--8087c8c4-2e28-45f9-9ee2-c9082bd7d90d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.235.229.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:05:07.000Z",
      "valid_until": "2026-04-16T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T04:09:10.884Z",
      "x_nadsec_last_seen": "2026-03-15T04:11:15.624Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-15T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--6b3c7e7f-8f06-4ce3-bd5f-290013b0a5a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.26.173.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:05:07.000Z",
      "valid_until": "2026-04-16T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T04:23:17.324Z",
      "x_nadsec_last_seen": "2026-03-15T04:29:36.034Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-15T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--21827904-c1e5-4244-be73-7eac00ada749",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.248.82.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:05:07.000Z",
      "valid_until": "2026-04-16T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T04:29:11.971Z",
      "x_nadsec_last_seen": "2026-03-15T04:31:16.846Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-15T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--c6cdae23-4e1d-4370-809e-0979b12d96ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.183.177.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:05:07.000Z",
      "valid_until": "2026-04-16T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T04:45:55.751Z",
      "x_nadsec_last_seen": "2026-03-15T04:48:02.462Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-15T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=138769; asn_org=JM OPTICAL FIBER SOLUTIONS PRIVATE LIMITED",
      "id": "indicator--c19abbb6-4c1a-41d7-96ed-92febe561c49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.66.104.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:05:07.000Z",
      "valid_until": "2026-04-16T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T04:21:14.003Z",
      "x_nadsec_last_seen": "2026-03-15T04:25:27.379Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138769"
      ],
      "x_nadsec_orgs": [
        "JM OPTICAL FIBER SOLUTIONS PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-15T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones",
      "id": "indicator--9470754d-ef2f-4dcc-8399-fcc725cab2f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.53.89.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:05:07.000Z",
      "valid_until": "2026-04-16T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T04:51:39.642Z",
      "x_nadsec_last_seen": "2026-03-15T04:51:39.694Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UY"
      ],
      "x_nadsec_asns": [
        "6057"
      ],
      "x_nadsec_orgs": [
        "Administracion Nacional de Telecomunicaciones"
      ]
    },
    {
      "created": "2026-03-15T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=136160; asn_org=Tianjin Shi Shi Ji Hulian Yuntong Network Technology Co., Ltd.",
      "id": "indicator--20d6f7d2-7f1e-4e3b-a7ab-c9532783a8c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.251.101.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:05:07.000Z",
      "valid_until": "2026-04-16T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T05:02:49.986Z",
      "x_nadsec_last_seen": "2026-03-15T05:04:55.089Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "136160"
      ],
      "x_nadsec_orgs": [
        "Tianjin Shi Shi Ji Hulian Yuntong Network Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-15T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=BD; asn=58912; asn_org=Chittagong Telecom Services Ltd",
      "id": "indicator--d7e2fda7-3946-4a4e-adf3-061119f130ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.124.15.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:05:07.000Z",
      "valid_until": "2026-04-16T05:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-15T04:22:40.587Z",
      "x_nadsec_last_seen": "2026-03-15T04:55:41.945Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "58912"
      ],
      "x_nadsec_orgs": [
        "Chittagong Telecom Services Ltd"
      ]
    },
    {
      "created": "2026-03-15T05:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--d2d9f93e-1868-4b3d-a80a-4971974062e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T05:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T05:05:07.000Z",
      "valid_until": "2026-04-16T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T04:21:25.945Z",
      "x_nadsec_last_seen": "2026-03-15T04:21:25.945Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-15T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132778; asn_org=Rvsm Solutions Private Limited",
      "id": "indicator--012b9bd3-16f3-410f-8cad-2b88017e44b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.162.216.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:05:05.000Z",
      "valid_until": "2026-04-16T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T05:12:21.418Z",
      "x_nadsec_last_seen": "2026-03-15T05:14:27.146Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132778"
      ],
      "x_nadsec_orgs": [
        "Rvsm Solutions Private Limited"
      ]
    },
    {
      "created": "2026-03-15T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=38712; asn_org=Telnet Communication Limited Network and Transit Service Provider. Having Nationwide MPLS Ne",
      "id": "indicator--122ae993-73ff-4a84-ace6-4f2afb13b996",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.50.17.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:05:05.000Z",
      "valid_until": "2026-04-16T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T05:24:27.718Z",
      "x_nadsec_last_seen": "2026-03-15T05:26:32.384Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "38712"
      ],
      "x_nadsec_orgs": [
        "Telnet Communication Limited Network and Transit Service Provider. Having Nationwide MPLS Ne"
      ]
    },
    {
      "created": "2026-03-15T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=9534; asn_org=Binariang Berhad",
      "id": "indicator--4cef1bc6-d6af-4e9a-892e-e1d2511f4a34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.121.220.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:05:05.000Z",
      "valid_until": "2026-04-16T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T05:45:16.605Z",
      "x_nadsec_last_seen": "2026-03-15T05:47:22.009Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9534"
      ],
      "x_nadsec_orgs": [
        "Binariang Berhad"
      ]
    },
    {
      "created": "2026-03-15T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--5bf8f6d5-834d-4639-b3b0-6e6e65525792",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.77.131.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:05:05.000Z",
      "valid_until": "2026-04-16T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T05:32:13.754Z",
      "x_nadsec_last_seen": "2026-03-15T05:39:48.202Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-15T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=45588; asn_org=Bangladesh Telecommunications Company Limited BTCL, Nationwide PSTN Operator and Data and In",
      "id": "indicator--67705010-8c7c-4913-bc6c-061931e89a24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.211.191.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:05:05.000Z",
      "valid_until": "2026-04-16T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T05:49:29.202Z",
      "x_nadsec_last_seen": "2026-03-15T05:51:35.778Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "45588"
      ],
      "x_nadsec_orgs": [
        "Bangladesh Telecommunications Company Limited BTCL, Nationwide PSTN Operator and Data and In"
      ]
    },
    {
      "created": "2026-03-15T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--a302765f-cfc0-4544-926d-cd184337662d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.191.71.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:05:05.000Z",
      "valid_until": "2026-04-16T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T05:42:22.077Z",
      "x_nadsec_last_seen": "2026-03-15T05:44:28.283Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-15T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8f07dbd4-1126-4562-9ae3-580fd964c89b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.219.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:05:05.000Z",
      "valid_until": "2026-04-16T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T05:40:38.194Z",
      "x_nadsec_last_seen": "2026-03-15T05:40:48.513Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-15T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8cba0e21-b833-4b2a-8cc2-6d144652e2a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:05:05.000Z",
      "valid_until": "2026-04-16T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T05:43:57.177Z",
      "x_nadsec_last_seen": "2026-03-31T16:32:31.371Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-15T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=FR; asn=16347; asn_org=ADISTA SAS",
      "id": "indicator--e94213e5-cfeb-4425-ac95-cf45e0fbb32a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '23.90.243.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:05:05.000Z",
      "valid_until": "2026-04-16T06:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-15T05:08:08.585Z",
      "x_nadsec_last_seen": "2026-03-17T05:41:33.170Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16347"
      ],
      "x_nadsec_orgs": [
        "ADISTA SAS"
      ]
    },
    {
      "created": "2026-03-15T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--8e5a5d8a-8baf-4c37-8b52-f3e8fe8cb4c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.88.31.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:05:05.000Z",
      "valid_until": "2026-04-16T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T05:09:56.641Z",
      "x_nadsec_last_seen": "2026-03-15T05:09:56.641Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-15T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5f6e9069-4034-4d42-8d83-672e6da516b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.23.134.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:05:05.000Z",
      "valid_until": "2026-04-16T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T05:14:26.593Z",
      "x_nadsec_last_seen": "2026-03-15T05:14:26.593Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-15T06:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T06:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:05:05.000Z",
      "valid_until": "2026-04-16T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T05:54:52.969Z",
      "x_nadsec_last_seen": "2026-03-30T14:17:36.617Z",
      "x_nadsec_ports": [
        "445",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "pptpd",
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-15T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135848; asn_org=Digitax India Communications Pvt Ltd.",
      "id": "indicator--8ed4d507-afdc-43a6-81e1-fa08cde18eb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.81.156.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:05:03.000Z",
      "valid_until": "2026-04-16T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T06:36:56.169Z",
      "x_nadsec_last_seen": "2026-03-15T06:39:02.006Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135848"
      ],
      "x_nadsec_orgs": [
        "Digitax India Communications Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-15T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--a95aebf0-1306-4d90-ab40-880c0bb54538",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.173.95.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:05:03.000Z",
      "valid_until": "2026-04-16T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T06:57:44.693Z",
      "x_nadsec_last_seen": "2026-03-15T06:59:49.358Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-15T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--714d6898-4199-4027-8714-ec24244becfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:05:03.000Z",
      "valid_until": "2026-04-16T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T06:24:57.618Z",
      "x_nadsec_last_seen": "2026-03-21T00:01:36.985Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-15T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--1dd0aecd-b0c6-4c03-8b3a-ba5001e16f33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.200.122.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:05:03.000Z",
      "valid_until": "2026-04-16T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T06:56:21.254Z",
      "x_nadsec_last_seen": "2026-03-15T06:56:27.479Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-15T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fc04567d-fad4-4385-ab25-2a0050b230cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.242.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:05:03.000Z",
      "valid_until": "2026-04-16T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T06:40:49.741Z",
      "x_nadsec_last_seen": "2026-03-15T06:40:49.741Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-15T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9bd6fa2a-4dc3-4157-92f4-98b208fe08b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:05:03.000Z",
      "valid_until": "2026-04-16T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-15T06:37:03.553Z",
      "x_nadsec_last_seen": "2026-03-17T14:19:12.894Z",
      "x_nadsec_ports": [
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-15T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--aa716c02-b8e8-4fd3-a9b0-cc99f5ee02f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.216.149.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:05:03.000Z",
      "valid_until": "2026-04-16T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T06:39:55.748Z",
      "x_nadsec_last_seen": "2026-03-15T06:40:05.748Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-15T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--51757d5f-1b65-4178-95c8-75efd48251ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.72.162.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:05:03.000Z",
      "valid_until": "2026-04-16T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-15T06:58:53.873Z",
      "x_nadsec_last_seen": "2026-03-15T06:59:25.745Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-15T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CA; asn=6327; asn_org=Shaw Communications; user(top)=**",
      "id": "indicator--8694df63-367c-45fb-8e48-73a3ff9c9d1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.70.159.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:05:03.000Z",
      "valid_until": "2026-04-16T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T06:17:55.472Z",
      "x_nadsec_last_seen": "2026-03-22T01:17:53.120Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "6327"
      ],
      "x_nadsec_orgs": [
        "Shaw Communications"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-15T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fc12a587-5b90-4752-9daf-676cf1f3d6ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.241.151.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:05:03.000Z",
      "valid_until": "2026-04-16T07:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-13T17:01:54.309Z",
      "x_nadsec_last_seen": "2026-03-18T00:32:58.179Z",
      "x_nadsec_ports": [
        "1883",
        "27017",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-15T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--9afe541c-6721-4634-b526-7b2b90deba15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.219.72.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:05:03.000Z",
      "valid_until": "2026-04-16T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T07:02:55.128Z",
      "x_nadsec_last_seen": "2026-03-15T07:02:55.278Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-15T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b2cadc4b-781d-43e2-8e47-a44710162b35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:05:03.000Z",
      "valid_until": "2026-04-16T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T06:49:18.772Z",
      "x_nadsec_last_seen": "2026-03-15T06:49:18.772Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-15T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--2bf2acac-e486-436b-8ae1-86231e2ecc6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:05:03.000Z",
      "valid_until": "2026-04-16T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-15T06:58:57.400Z",
      "x_nadsec_last_seen": "2026-03-15T07:09:55.761Z",
      "x_nadsec_ports": [
        "42",
        "81",
        "34995"
      ],
      "x_nadsec_services": [
        "httpd",
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-15T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--9c430076-b68d-4c20-908d-8b80ad98bda0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.109.11.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T07:05:03.000Z",
      "valid_until": "2026-04-16T07:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-15T07:01:14.252Z",
      "x_nadsec_last_seen": "2026-03-24T18:47:33.850Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-15T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fbd0dd4a-d070-4f3e-bb5e-b7ad9e77805b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T08:05:05.000Z",
      "valid_until": "2026-04-16T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T07:30:27.115Z",
      "x_nadsec_last_seen": "2026-03-15T07:30:37.323Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-15T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--a3908727-dbaf-4db2-85c7-b4cb9b9feb49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.170.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T08:05:05.000Z",
      "valid_until": "2026-04-16T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T07:37:08.607Z",
      "x_nadsec_last_seen": "2026-03-15T07:37:08.607Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-15T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--67b12084-1c70-4366-99f2-81b946e09659",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.208.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T08:05:05.000Z",
      "valid_until": "2026-04-16T08:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-15T07:34:46.538Z",
      "x_nadsec_last_seen": "2026-03-15T07:35:32.332Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-15T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--9bbb2bcd-b05f-4b98-88a1-80218d7cfbec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.189.145.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T08:05:05.000Z",
      "valid_until": "2026-04-16T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T07:45:24.087Z",
      "x_nadsec_last_seen": "2026-03-15T07:47:30.427Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-15T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--cd7dae1f-aef1-4c07-84e9-70186eae637d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.248.70.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T08:05:05.000Z",
      "valid_until": "2026-04-16T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T07:20:21.143Z",
      "x_nadsec_last_seen": "2026-03-15T07:22:27.513Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-03-15T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--fa0a6046-8478-41c9-a9da-7ced674aeffa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.21.125.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T08:05:05.000Z",
      "valid_until": "2026-04-16T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T07:23:54.119Z",
      "x_nadsec_last_seen": "2026-03-15T07:32:45.093Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-15T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--5a84257b-599c-4ca2-81fd-3fd79737623c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.33.179.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T08:05:05.000Z",
      "valid_until": "2026-04-16T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T07:13:40.300Z",
      "x_nadsec_last_seen": "2026-03-15T07:20:59.788Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-15T08:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--d5e0d968-36e3-4253-99d1-3374e5bce0cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T08:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T08:05:05.000Z",
      "valid_until": "2026-04-16T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T07:09:37.093Z",
      "x_nadsec_last_seen": "2026-03-15T07:09:37.093Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-15T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--9bc752d3-1708-449f-afd5-0f20c05b29cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.72.2.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T09:05:03.000Z",
      "valid_until": "2026-04-16T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T08:09:08.496Z",
      "x_nadsec_last_seen": "2026-03-15T08:09:08.496Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ]
    },
    {
      "created": "2026-03-15T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ce420b4c-e6b5-4dd0-8b8c-d168b6ea05a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.248.90.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T09:05:03.000Z",
      "valid_until": "2026-04-16T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T09:01:58.280Z",
      "x_nadsec_last_seen": "2026-03-15T09:04:04.613Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-15T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--aa4c3198-7298-43c8-b1dc-c4b0cca2d5a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T09:05:03.000Z",
      "valid_until": "2026-04-16T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T09:01:29.269Z",
      "x_nadsec_last_seen": "2026-03-15T09:01:29.269Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-15T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=22616; asn_org=ZSCALER, INC.",
      "id": "indicator--6b58eaa3-b8c9-4d13-bc53-284a65b84b46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.225.57.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T09:05:03.000Z",
      "valid_until": "2026-04-16T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T08:15:37.077Z",
      "x_nadsec_last_seen": "2026-03-15T08:17:42.356Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "22616"
      ],
      "x_nadsec_orgs": [
        "ZSCALER, INC."
      ]
    },
    {
      "created": "2026-03-15T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--39bda1b1-0522-4efc-98d8-a08b3dc1e8aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '174.138.4.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T09:05:03.000Z",
      "valid_until": "2026-04-16T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T08:57:06.356Z",
      "x_nadsec_last_seen": "2026-03-15T08:57:09.716Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-15T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--8a7e742f-3d3c-4d95-8a33-9fcc08c7f4b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.79.80.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T09:05:03.000Z",
      "valid_until": "2026-04-16T09:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-15T08:47:43.875Z",
      "x_nadsec_last_seen": "2026-03-30T21:57:43.499Z",
      "x_nadsec_ports": [
        "27017",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-15T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=18049; asn_org=Taiwan Infrastructure Network Technologie",
      "id": "indicator--179b8fbd-5d3e-4030-8419-5d08355b07b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.105.92.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:05:03.000Z",
      "valid_until": "2026-04-16T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T09:53:32.155Z",
      "x_nadsec_last_seen": "2026-03-15T10:00:07.349Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "18049"
      ],
      "x_nadsec_orgs": [
        "Taiwan Infrastructure Network Technologie"
      ]
    },
    {
      "created": "2026-03-15T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=ftpd; ports=21; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5e58c20e-d703-481d-96a9-f1ee09e3aee5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.169.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:05:03.000Z",
      "valid_until": "2026-04-16T10:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-15T09:44:31.050Z",
      "x_nadsec_last_seen": "2026-03-15T09:46:35.984Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1723",
        "3306",
        "27017",
        "36561"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-15T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PH; asn=138965; asn_org=Streamtech Systems Technologies Inc.",
      "id": "indicator--0c63f1ec-1db0-496a-8ce8-c3748413910b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.236.93.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:05:03.000Z",
      "valid_until": "2026-04-16T10:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-15T09:39:22.617Z",
      "x_nadsec_last_seen": "2026-03-15T11:00:46.375Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "138965"
      ],
      "x_nadsec_orgs": [
        "Streamtech Systems Technologies Inc."
      ]
    },
    {
      "created": "2026-03-15T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--6464bf83-dbe9-44c7-9cd2-8e7bfa4739ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:05:03.000Z",
      "valid_until": "2026-04-16T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T09:39:00.313Z",
      "x_nadsec_last_seen": "2026-03-15T09:39:00.313Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-15T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--b598dfe3-d6db-470c-8264-f9d4528e1411",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.149.68.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:05:03.000Z",
      "valid_until": "2026-04-16T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T09:50:34.337Z",
      "x_nadsec_last_seen": "2026-03-15T09:52:39.948Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-15T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=17478; asn_org=Bangkok Metropolitan Administration",
      "id": "indicator--79074e5d-4eab-4d01-8bad-6883e9a7f130",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.155.222.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:05:03.000Z",
      "valid_until": "2026-04-16T10:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-15T09:36:43.792Z",
      "x_nadsec_last_seen": "2026-03-15T09:38:47.574Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "17478"
      ],
      "x_nadsec_orgs": [
        "Bangkok Metropolitan Administration"
      ]
    },
    {
      "created": "2026-03-15T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c57fe4ec-52b6-462a-accb-e8a18c873924",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.173.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:05:03.000Z",
      "valid_until": "2026-04-16T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T10:02:20.902Z",
      "x_nadsec_last_seen": "2026-03-15T10:02:31.068Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-15T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1830fa09-9885-4e47-85c4-c55fb509bd8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.146.21.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:05:03.000Z",
      "valid_until": "2026-04-16T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T09:34:55.951Z",
      "x_nadsec_last_seen": "2026-03-15T09:34:55.951Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-15T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=SA; asn=43766; asn_org=Mobile Telecommunication Company Saudi Arabia Joint-Stock company",
      "id": "indicator--9f88aece-5c98-4000-8be9-7083811b423e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.223.255.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:05:03.000Z",
      "valid_until": "2026-04-16T10:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-15T09:18:52.882Z",
      "x_nadsec_last_seen": "2026-03-15T09:20:03.772Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "43766"
      ],
      "x_nadsec_orgs": [
        "Mobile Telecommunication Company Saudi Arabia Joint-Stock company"
      ]
    },
    {
      "created": "2026-03-15T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=39153; asn_org=LLC SETEL",
      "id": "indicator--8f4c484c-e649-4cda-b113-9a3dc8ca8998",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.253.29.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:05:03.000Z",
      "valid_until": "2026-04-16T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T09:33:54.967Z",
      "x_nadsec_last_seen": "2026-03-15T09:36:01.062Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "39153"
      ],
      "x_nadsec_orgs": [
        "LLC SETEL"
      ]
    },
    {
      "created": "2026-03-15T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=33779; asn_org=wataniya-telecom-as",
      "id": "indicator--a692850d-805e-4615-a138-e07fba1de173",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.235.130.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:05:02.000Z",
      "valid_until": "2026-04-16T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T10:19:11.162Z",
      "x_nadsec_last_seen": "2026-03-15T10:27:14.504Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "33779"
      ],
      "x_nadsec_orgs": [
        "wataniya-telecom-as"
      ]
    },
    {
      "created": "2026-03-15T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45184; asn_org=Den Digital Entertainment Pvt. Ltd. AS ISP india",
      "id": "indicator--254cbdc5-ec13-4161-bc96-7ad8b69f94e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.196.166.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:05:02.000Z",
      "valid_until": "2026-04-16T11:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-15T10:22:22.030Z",
      "x_nadsec_last_seen": "2026-03-24T09:54:42.796Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45184"
      ],
      "x_nadsec_orgs": [
        "Den Digital Entertainment Pvt. Ltd. AS ISP india"
      ]
    },
    {
      "created": "2026-03-15T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--5da8b21c-cbd3-4c79-b446-9bedfee9b36e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.239.32.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:05:02.000Z",
      "valid_until": "2026-04-16T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T10:38:31.655Z",
      "x_nadsec_last_seen": "2026-03-15T10:40:37.803Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-15T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**; pass(top)=!******x",
      "id": "indicator--354669e4-b74f-413c-97e6-b73909f5d280",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.210.240.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:05:02.000Z",
      "valid_until": "2026-04-16T11:05:01.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-15T10:53:46.881Z",
      "x_nadsec_last_seen": "2026-03-15T10:53:57.555Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-03-15T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=19429; asn_org=Colombia",
      "id": "indicator--7adb9a03-797f-4851-8b6e-a4688e2e2b40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.25.242.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:05:02.000Z",
      "valid_until": "2026-04-16T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T10:23:52.834Z",
      "x_nadsec_last_seen": "2026-03-15T10:25:59.120Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "19429"
      ],
      "x_nadsec_orgs": [
        "Colombia"
      ]
    },
    {
      "created": "2026-03-15T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8127d7f8-d72a-4ddb-a42b-4b206d7380b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:05:02.000Z",
      "valid_until": "2026-04-16T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T10:19:21.494Z",
      "x_nadsec_last_seen": "2026-03-15T10:19:21.494Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-15T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45543; asn_org=SaiGon Tourist cable Televition Company",
      "id": "indicator--7d43fc8b-9ab0-44e4-80e1-057cee34a8c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.3.10.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:05:02.000Z",
      "valid_until": "2026-04-16T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T10:39:49.267Z",
      "x_nadsec_last_seen": "2026-03-15T10:41:54.262Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45543"
      ],
      "x_nadsec_orgs": [
        "SaiGon Tourist cable Televition Company"
      ]
    },
    {
      "created": "2026-03-15T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--8a693586-f6a4-4b93-80cd-abea285bd4c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '8.216.8.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:05:02.000Z",
      "valid_until": "2026-04-16T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T11:00:41.291Z",
      "x_nadsec_last_seen": "2026-03-15T11:00:58.408Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-15T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=43148; asn_org=MTS PJSC",
      "id": "indicator--c3fef20a-dfbc-47d6-9310-ff125a2c84aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.31.32.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:05:02.000Z",
      "valid_until": "2026-04-16T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T11:01:19.622Z",
      "x_nadsec_last_seen": "2026-03-15T11:03:26.712Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "43148"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-03-15T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--c890ce33-8cad-44a9-a003-088f4f198b72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.241.103.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:05:02.000Z",
      "valid_until": "2026-04-16T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T11:22:01.980Z",
      "x_nadsec_last_seen": "2026-03-15T11:22:08.362Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-15T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--1171e9c1-c846-468d-9264-be0f0474c4b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.80.57.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:05:02.000Z",
      "valid_until": "2026-04-16T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T11:53:45.839Z",
      "x_nadsec_last_seen": "2026-03-15T11:53:46.063Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-15T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=57529; asn_org=ZAO GTNT",
      "id": "indicator--fec325f7-ab78-4cf7-b5dd-2d240a14b0b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.19.49.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:05:02.000Z",
      "valid_until": "2026-04-16T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T11:10:03.988Z",
      "x_nadsec_last_seen": "2026-03-15T11:11:54.268Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57529"
      ],
      "x_nadsec_orgs": [
        "ZAO GTNT"
      ]
    },
    {
      "created": "2026-03-15T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ada2531f-4dd5-45f8-9b0c-195f3b7385eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:05:02.000Z",
      "valid_until": "2026-04-16T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T11:31:44.399Z",
      "x_nadsec_last_seen": "2026-03-15T11:31:44.399Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-15T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--22255904-0ee2-4c66-82a8-4aa0aed7fef3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.206.155.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:05:02.000Z",
      "valid_until": "2026-04-16T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T11:28:38.732Z",
      "x_nadsec_last_seen": "2026-03-15T11:30:43.259Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-15T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--9596ff6b-cb82-4a24-bb93-d3ea80ee2165",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.70.196.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:05:02.000Z",
      "valid_until": "2026-04-16T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T11:31:29.104Z",
      "x_nadsec_last_seen": "2026-03-15T11:33:34.572Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-15T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=47524; asn_org=Turksat Uydu Haberlesme ve Kablo TV Isletme A.S.",
      "id": "indicator--d06e9862-b8e4-4f31-b2cf-9b6788c93c24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.196.192.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:05:02.000Z",
      "valid_until": "2026-04-16T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T11:31:10.395Z",
      "x_nadsec_last_seen": "2026-03-15T11:33:17.010Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "47524"
      ],
      "x_nadsec_orgs": [
        "Turksat Uydu Haberlesme ve Kablo TV Isletme A.S."
      ]
    },
    {
      "created": "2026-03-15T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--86639012-c5cc-499d-8c1e-8e7c449585e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.165.81.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:05:02.000Z",
      "valid_until": "2026-04-16T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T11:45:03.419Z",
      "x_nadsec_last_seen": "2026-03-15T11:45:13.593Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-15T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--7380ff13-877f-4333-90d4-0793791ddd67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.96.52.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:05:02.000Z",
      "valid_until": "2026-04-16T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T11:13:39.933Z",
      "x_nadsec_last_seen": "2026-03-15T11:15:47.152Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-03-15T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=FR; asn=15557; asn_org=Societe Francaise Du Radiotelephone - SFR SA",
      "id": "indicator--5ad86291-2401-4ba3-8bbe-4c47e2d10cb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.30.165.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:05:02.000Z",
      "valid_until": "2026-04-16T12:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-15T11:36:36.410Z",
      "x_nadsec_last_seen": "2026-03-15T15:58:20.541Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "15557"
      ],
      "x_nadsec_orgs": [
        "Societe Francaise Du Radiotelephone - SFR SA"
      ]
    },
    {
      "created": "2026-03-15T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--3a9222d7-ec1f-4b59-8064-c4f9cc6489cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.88.113.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:05:02.000Z",
      "valid_until": "2026-04-16T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T12:09:56.159Z",
      "x_nadsec_last_seen": "2026-03-15T12:12:03.740Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-15T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=LA; asn=9873; asn_org=Lao Telecom Communication, LTC",
      "id": "indicator--7af25294-3e64-4238-9f9a-d838a728585b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.84.114.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:05:02.000Z",
      "valid_until": "2026-04-16T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T12:31:00.655Z",
      "x_nadsec_last_seen": "2026-03-15T12:37:37.426Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "9873"
      ],
      "x_nadsec_orgs": [
        "Lao Telecom Communication, LTC"
      ]
    },
    {
      "created": "2026-03-15T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--f4971d16-d4e0-4453-ad70-11c9bd291d9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.202.176.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:05:02.000Z",
      "valid_until": "2026-04-16T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T12:45:56.887Z",
      "x_nadsec_last_seen": "2026-03-15T12:48:03.231Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-15T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--8443b76c-7453-4193-8bd7-652bf27c4be1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:05:02.000Z",
      "valid_until": "2026-04-16T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T12:42:53.733Z",
      "x_nadsec_last_seen": "2026-03-15T12:45:01.304Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-03-15T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=MN; asn=45204; asn_org=GEMNET LLC",
      "id": "indicator--b79cde4a-7520-486f-a6e2-265097065b4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.149.126.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:05:02.000Z",
      "valid_until": "2026-04-16T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T12:13:24.733Z",
      "x_nadsec_last_seen": "2026-03-15T12:13:24.733Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "45204"
      ],
      "x_nadsec_orgs": [
        "GEMNET LLC"
      ]
    },
    {
      "created": "2026-03-15T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--d49b8ea7-7639-402f-b376-93aa48384a04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.8.65.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:05:02.000Z",
      "valid_until": "2026-04-16T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T12:09:52.379Z",
      "x_nadsec_last_seen": "2026-03-15T12:11:57.346Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-03-15T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=US; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--ffafaa18-14bd-4c40-a135-08974301211b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:05:02.000Z",
      "valid_until": "2026-04-16T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T07:51:18.097Z",
      "x_nadsec_last_seen": "2026-03-15T12:59:16.851Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-15T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=30844; asn_org=Liquid Telecommunications Ltd",
      "id": "indicator--cd61a957-d4b6-42f6-9328-19ade48de934",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.201.231.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:05:02.000Z",
      "valid_until": "2026-04-16T13:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-15T12:55:24.133Z",
      "x_nadsec_last_seen": "2026-03-15T13:46:48.651Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "30844"
      ],
      "x_nadsec_orgs": [
        "Liquid Telecommunications Ltd"
      ]
    },
    {
      "created": "2026-03-15T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28637; asn_org=Cia Proc. de Dados do Estado de S Paulo - Prodesp",
      "id": "indicator--865a2aea-5a73-43e5-ae30-6c34f703ca0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.144.1.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:05:02.000Z",
      "valid_until": "2026-04-16T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T12:50:44.920Z",
      "x_nadsec_last_seen": "2026-03-15T12:52:51.730Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28637"
      ],
      "x_nadsec_orgs": [
        "Cia Proc. de Dados do Estado de S Paulo - Prodesp"
      ]
    },
    {
      "created": "2026-03-15T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f33113f5-8447-4398-a904-3da6b6bf935f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.189.233.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:05:02.000Z",
      "valid_until": "2026-04-16T13:05:01.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-15T12:18:47.209Z",
      "x_nadsec_last_seen": "2026-03-15T12:18:52.316Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-15T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--966b8d55-4bcd-4865-83dc-7e5a9f7e93d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.62.172.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:05:02.000Z",
      "valid_until": "2026-04-16T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T12:42:15.817Z",
      "x_nadsec_last_seen": "2026-03-15T12:42:15.817Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-15T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29091; asn_org=IPNXng",
      "id": "indicator--3b395047-d954-4ba9-8534-9e638c0c301d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.173.37.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:05:02.000Z",
      "valid_until": "2026-04-16T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T12:27:32.865Z",
      "x_nadsec_last_seen": "2026-03-15T12:29:39.780Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29091"
      ],
      "x_nadsec_orgs": [
        "IPNXng"
      ]
    },
    {
      "created": "2026-03-15T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=RO; asn=47890; asn_org=Unmanaged Ltd",
      "id": "indicator--9500164f-987d-4dc6-aa09-ecd88640ac84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.118.39.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:05:02.000Z",
      "valid_until": "2026-04-16T13:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-15T12:30:21.430Z",
      "x_nadsec_last_seen": "2026-03-31T12:10:00.570Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "47890"
      ],
      "x_nadsec_orgs": [
        "Unmanaged Ltd"
      ]
    },
    {
      "created": "2026-03-15T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CY; asn=6866; asn_org=Cyprus Telecommunications Authority",
      "id": "indicator--17ae6aeb-6cd1-4936-9ac7-a7e2fdbc8b49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.109.143.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T13:05:02.000Z",
      "valid_until": "2026-04-16T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T13:02:01.504Z",
      "x_nadsec_last_seen": "2026-03-15T13:04:10.116Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CY"
      ],
      "x_nadsec_asns": [
        "6866"
      ],
      "x_nadsec_orgs": [
        "Cyprus Telecommunications Authority"
      ]
    },
    {
      "created": "2026-03-15T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--adfd6237-c55d-443f-8368-5bf89248f094",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.46.33.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:05:03.000Z",
      "valid_until": "2026-04-16T14:05:00.000Z",
      "x_nadsec_event_count": 3148,
      "x_nadsec_first_seen": "2026-03-15T13:59:16.321Z",
      "x_nadsec_last_seen": "2026-03-17T04:51:32.286Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-15T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--10a16dc9-48a5-4c75-b46f-b6a8dca20336",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.214.128.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:05:03.000Z",
      "valid_until": "2026-04-16T14:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T14:00:32.633Z",
      "x_nadsec_last_seen": "2026-03-15T14:02:37.608Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-03-15T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45804; asn_org=MEGHBELA BROADBAND",
      "id": "indicator--62119476-894e-4333-be3b-c5ecb13c40e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.93.102.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:05:03.000Z",
      "valid_until": "2026-04-16T14:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T13:38:13.722Z",
      "x_nadsec_last_seen": "2026-03-15T13:40:19.470Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45804"
      ],
      "x_nadsec_orgs": [
        "MEGHBELA BROADBAND"
      ]
    },
    {
      "created": "2026-03-15T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=37457; asn_org=Telkom-Internet",
      "id": "indicator--ee6542f0-c2b9-476b-bf30-c120b9a2887a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.186.194.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:05:03.000Z",
      "valid_until": "2026-04-16T14:05:00.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-15T13:26:54.153Z",
      "x_nadsec_last_seen": "2026-03-22T02:36:31.456Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37457"
      ],
      "x_nadsec_orgs": [
        "Telkom-Internet"
      ]
    },
    {
      "created": "2026-03-15T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d4af880c-1bb0-422c-8a27-d4a84132411b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '136.114.221.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:05:03.000Z",
      "valid_until": "2026-04-16T14:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T13:17:21.732Z",
      "x_nadsec_last_seen": "2026-03-15T13:17:21.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-15T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--672232e7-c284-4b71-b1b7-c4701e2a3411",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.230.138.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:05:03.000Z",
      "valid_until": "2026-04-16T14:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-15T13:31:01.684Z",
      "x_nadsec_last_seen": "2026-03-15T13:31:47.826Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-15T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=BR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ee8dc2bd-acc8-4279-9d0d-0674e993f96c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.199.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:05:03.000Z",
      "valid_until": "2026-04-16T14:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-15T14:04:27.128Z",
      "x_nadsec_last_seen": "2026-03-15T14:05:25.684Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-15T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AU; asn=7474; asn_org=SingTel Optus Pty Ltd",
      "id": "indicator--19160274-e7a0-4d03-8445-0e5e98a1d55c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.43.85.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:05:03.000Z",
      "valid_until": "2026-04-16T14:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T13:58:16.610Z",
      "x_nadsec_last_seen": "2026-03-15T13:58:19.942Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "7474"
      ],
      "x_nadsec_orgs": [
        "SingTel Optus Pty Ltd"
      ]
    },
    {
      "created": "2026-03-15T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--a992e584-c8d0-4ee4-911d-099a2ba4fc9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.202.12.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:05:03.000Z",
      "valid_until": "2026-04-16T14:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T13:29:18.574Z",
      "x_nadsec_last_seen": "2026-03-15T13:36:11.838Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-03-15T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--aecf776a-915f-4728-ad57-9ccf8fe75aed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.106.32.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:05:03.000Z",
      "valid_until": "2026-04-16T14:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T13:42:02.540Z",
      "x_nadsec_last_seen": "2026-03-15T13:42:02.540Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-15T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--62595142-4762-4148-8f06-0da93db15bcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.243.127.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:05:03.000Z",
      "valid_until": "2026-04-16T14:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T13:15:24.450Z",
      "x_nadsec_last_seen": "2026-03-15T13:21:44.703Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ]
    },
    {
      "created": "2026-03-15T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--2e36aaad-18c6-4abf-a731-9e14a666c652",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.79.7.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:05:03.000Z",
      "valid_until": "2026-04-16T14:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-15T13:25:33.558Z",
      "x_nadsec_last_seen": "2026-03-15T15:25:05.865Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-03-15T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=264933; asn_org=NTi Telecomunicacoes LTDA.",
      "id": "indicator--e88a91e0-6267-402d-a16e-fa09b8a12e79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '168.232.41.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T15:05:02.000Z",
      "valid_until": "2026-04-16T15:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T14:15:08.460Z",
      "x_nadsec_last_seen": "2026-03-15T14:22:37.229Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264933"
      ],
      "x_nadsec_orgs": [
        "NTi Telecomunicacoes LTDA."
      ]
    },
    {
      "created": "2026-03-15T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T15:05:02.000Z",
      "valid_until": "2026-04-16T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T14:55:59.163Z",
      "x_nadsec_last_seen": "2026-03-20T12:19:55.123Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-15T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--32da7e94-67bd-49e8-83b2-0a7c549ca3c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.219.122.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:05:02.000Z",
      "valid_until": "2026-04-16T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T15:52:02.634Z",
      "x_nadsec_last_seen": "2026-03-15T15:54:07.742Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-15T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=9534; asn_org=Binariang Berhad",
      "id": "indicator--b147fbb0-7368-4056-a7e5-46fa404648bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.211.113.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:05:02.000Z",
      "valid_until": "2026-04-16T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T15:17:46.828Z",
      "x_nadsec_last_seen": "2026-03-15T15:19:52.693Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9534"
      ],
      "x_nadsec_orgs": [
        "Binariang Berhad"
      ]
    },
    {
      "created": "2026-03-15T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--725103a3-8c88-461a-a2b2-d81f8e15f6f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.104.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:05:02.000Z",
      "valid_until": "2026-04-16T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T15:45:12.109Z",
      "x_nadsec_last_seen": "2026-03-15T15:47:16.916Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-15T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mirrorc; ports=35275; cc=LT; asn=209605; asn_org=UAB Host Baltic",
      "id": "indicator--ac23a67c-461e-416c-affc-56a64f6f0b03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:05:02.000Z",
      "valid_until": "2026-04-16T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T15:05:53.374Z",
      "x_nadsec_last_seen": "2026-03-18T09:01:26.039Z",
      "x_nadsec_ports": [
        "42",
        "81",
        "27017",
        "35275"
      ],
      "x_nadsec_services": [
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod"
      ],
      "x_nadsec_countries": [
        "LT"
      ],
      "x_nadsec_asns": [
        "209605"
      ],
      "x_nadsec_orgs": [
        "UAB Host Baltic"
      ]
    },
    {
      "created": "2026-03-15T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--70618f04-dcb8-4cfa-bf92-c9add9e99907",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.74.214.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:05:02.000Z",
      "valid_until": "2026-04-16T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T15:42:45.105Z",
      "x_nadsec_last_seen": "2026-03-15T15:44:49.858Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-15T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=106; services=smbd; ports=445; cc=GB; asn=201579; asn_org=Hostgnome Ltd",
      "id": "indicator--d1df47cd-1c82-4870-be16-a1671d967f74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.91.69.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:05:02.000Z",
      "valid_until": "2026-04-16T16:05:01.000Z",
      "x_nadsec_event_count": 155,
      "x_nadsec_first_seen": "2026-03-15T15:31:51.942Z",
      "x_nadsec_last_seen": "2026-03-18T03:40:06.499Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201579"
      ],
      "x_nadsec_orgs": [
        "Hostgnome Ltd"
      ]
    },
    {
      "created": "2026-03-15T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--c7bb2feb-38df-43ed-a418-a4497c61dbb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.153.6.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:05:02.000Z",
      "valid_until": "2026-04-16T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T15:38:49.471Z",
      "x_nadsec_last_seen": "2026-03-15T15:45:36.524Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-03-15T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--130125fd-53bd-4c5d-af25-c33219aa5380",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:05:02.000Z",
      "valid_until": "2026-04-16T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T16:02:00.148Z",
      "x_nadsec_last_seen": "2026-03-15T16:02:00.148Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-15T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1dca32d0-c08c-40aa-ac31-c829f08aaf1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:05:02.000Z",
      "valid_until": "2026-04-16T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T15:43:15.997Z",
      "x_nadsec_last_seen": "2026-03-30T01:31:47.974Z",
      "x_nadsec_ports": [
        "81",
        "1433"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-15T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--440a1f55-e702-4795-bfcd-dbbbe5dbea4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.77.206.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:05:02.000Z",
      "valid_until": "2026-04-16T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T15:16:39.520Z",
      "x_nadsec_last_seen": "2026-03-15T15:18:46.156Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-03-15T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--3e853679-3074-4462-936c-8fd0c467a745",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.98.42.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:05:02.000Z",
      "valid_until": "2026-04-16T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T15:24:03.907Z",
      "x_nadsec_last_seen": "2026-03-15T15:31:10.068Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-15T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--34d65e5d-e94e-4832-ad9f-73fe480ec3be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:05:02.000Z",
      "valid_until": "2026-04-16T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T15:12:19.178Z",
      "x_nadsec_last_seen": "2026-03-15T15:12:19.178Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--0219bfe2-288f-41c7-a984-71fa27876c84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.199.110.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T16:40:30.338Z",
      "x_nadsec_last_seen": "2026-03-15T21:53:21.478Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--22be67f1-7b62-4094-83cd-b4d9248676b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.222.248.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T16:29:13.593Z",
      "x_nadsec_last_seen": "2026-03-15T16:31:18.419Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LA; asn=9873; asn_org=Lao Telecom Communication, LTC",
      "id": "indicator--69133d2d-6f47-446c-9c6e-4bdc28689a8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.84.96.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T16:49:01.574Z",
      "x_nadsec_last_seen": "2026-03-15T16:51:06.360Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "9873"
      ],
      "x_nadsec_orgs": [
        "Lao Telecom Communication, LTC"
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--864bcf82-9d66-40ce-bcbd-1e86ae779b1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.224.161.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T16:13:40.730Z",
      "x_nadsec_last_seen": "2026-03-15T16:13:40.730Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0e64c170-528a-48c5-84ae-2f098316c608",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T16:17:12.762Z",
      "x_nadsec_last_seen": "2026-03-15T16:17:12.762Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--e12b7f19-028a-488d-a00a-4f20600a4e67",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T16:18:09.749Z",
      "x_nadsec_last_seen": "2026-03-15T16:18:39.751Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--8dcbb056-c166-4ab1-8fe6-f11e5507199d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.236.7.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T16:12:25.000Z",
      "x_nadsec_last_seen": "2026-03-15T16:14:32.529Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=34700; asn_org=Maxnet Telecom, Ltd",
      "id": "indicator--34741dde-697e-4acb-885f-7cf4872778e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.165.127.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T16:41:22.251Z",
      "x_nadsec_last_seen": "2026-03-15T16:43:28.621Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "34700"
      ],
      "x_nadsec_orgs": [
        "Maxnet Telecom, Ltd"
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--0e35584f-4a2a-4a51-860c-546cb550cbd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.251.156.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T16:49:42.321Z",
      "x_nadsec_last_seen": "2026-03-15T16:51:47.428Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BO; asn=27882; asn_org=Telefonica Celular de Bolivia S.A.",
      "id": "indicator--d454329b-b8df-4fc0-ab6b-9dd3ea0bd80f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.188.166.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T16:16:02.454Z",
      "x_nadsec_last_seen": "2026-03-15T16:23:27.137Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "27882"
      ],
      "x_nadsec_orgs": [
        "Telefonica Celular de Bolivia S.A."
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SG; asn=26496; asn_org=GoDaddy.com, LLC",
      "id": "indicator--96b42dd9-66b2-4a94-add4-b9ec1a1ed737",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '208.109.10.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T16:15:24.026Z",
      "x_nadsec_last_seen": "2026-03-15T16:15:24.026Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "26496"
      ],
      "x_nadsec_orgs": [
        "GoDaddy.com, LLC"
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=epmapper; ports=135; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--c36f2837-6aaa-4775-a06e-1874a96f7196",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.137.148.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-15T16:09:45.078Z",
      "x_nadsec_last_seen": "2026-03-15T16:09:45.740Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--b2b859a7-3bf9-451f-a460-0dcd9039e96e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.45.27.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T17:00:57.911Z",
      "x_nadsec_last_seen": "2026-03-15T17:03:04.276Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=6849; asn_org=JSC Ukrtelecom",
      "id": "indicator--17b974a1-dbb2-422f-ad75-633323ceb069",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.201.247.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T16:50:14.910Z",
      "x_nadsec_last_seen": "2026-03-15T16:52:21.237Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "6849"
      ],
      "x_nadsec_orgs": [
        "JSC Ukrtelecom"
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--b3ab6d9b-4400-4afd-98ab-09c70bf29805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T16:59:12.800Z",
      "x_nadsec_last_seen": "2026-03-25T05:36:48.381Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=RO; asn=47890; asn_org=Unmanaged Ltd",
      "id": "indicator--1a7280f4-d8af-48a0-b413-6bf1e8fbdb1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-15T16:38:13.982Z",
      "x_nadsec_last_seen": "2026-03-15T20:45:12.487Z",
      "x_nadsec_ports": [
        "445",
        "21",
        "81",
        "135",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "47890"
      ],
      "x_nadsec_orgs": [
        "Unmanaged Ltd"
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9ed034f1-9d66-44e7-adba-72f193cb42ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T16:08:37.400Z",
      "x_nadsec_last_seen": "2026-03-15T16:08:37.400Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-15T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--37f601b4-2b4b-460b-8d80-c4270c3bda56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:05:02.000Z",
      "valid_until": "2026-04-16T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T16:08:37.063Z",
      "x_nadsec_last_seen": "2026-03-15T16:08:37.063Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-15T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=LT; asn=209605; asn_org=UAB Host Baltic",
      "id": "indicator--ee4bce54-02f7-42fc-b105-d77aadd76d5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:05:02.000Z",
      "valid_until": "2026-04-16T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T17:24:50.781Z",
      "x_nadsec_last_seen": "2026-03-15T17:24:50.781Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "LT"
      ],
      "x_nadsec_asns": [
        "209605"
      ],
      "x_nadsec_orgs": [
        "UAB Host Baltic"
      ]
    },
    {
      "created": "2026-03-15T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--aea34727-57cc-4263-881d-028e5b151202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.244.61.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:05:02.000Z",
      "valid_until": "2026-04-16T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T17:42:12.150Z",
      "x_nadsec_last_seen": "2026-03-15T17:42:12.275Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-03-15T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PY; asn=23201; asn_org=Telecel S.A.",
      "id": "indicator--41e61f59-1bb5-4a99-9488-a8d93ef275fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.124.62.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:05:02.000Z",
      "valid_until": "2026-04-16T18:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-15T17:52:53.354Z",
      "x_nadsec_last_seen": "2026-03-22T07:59:37.024Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "23201"
      ],
      "x_nadsec_orgs": [
        "Telecel S.A."
      ]
    },
    {
      "created": "2026-03-15T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--a5b3ef69-df37-4ed9-bc8e-673883e794e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.64.68.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:05:02.000Z",
      "valid_until": "2026-04-16T18:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T17:33:14.958Z",
      "x_nadsec_last_seen": "2026-03-15T17:39:43.533Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-15T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--45f6a2b1-f5ea-4363-b1e0-f71f69f9efec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:05:02.000Z",
      "valid_until": "2026-04-16T18:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T17:53:28.413Z",
      "x_nadsec_last_seen": "2026-03-15T17:54:19.323Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-15T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BJ; asn=28683; asn_org=SBIN",
      "id": "indicator--2fd18e5d-7c1e-4993-b194-a9240630572a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.85.185.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:05:02.000Z",
      "valid_until": "2026-04-16T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T17:34:12.915Z",
      "x_nadsec_last_seen": "2026-03-15T17:36:20.148Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BJ"
      ],
      "x_nadsec_asns": [
        "28683"
      ],
      "x_nadsec_orgs": [
        "SBIN"
      ]
    },
    {
      "created": "2026-03-15T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=133798; asn_org=PT. Smartfren Telecom, Tbk",
      "id": "indicator--f48b0861-89d1-4ebc-9ba1-cf906da1e83c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.96.245.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:05:02.000Z",
      "valid_until": "2026-04-16T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T17:11:01.378Z",
      "x_nadsec_last_seen": "2026-03-15T17:13:05.592Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "133798"
      ],
      "x_nadsec_orgs": [
        "PT. Smartfren Telecom, Tbk"
      ]
    },
    {
      "created": "2026-03-15T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MD; asn=31252; asn_org=StarNet Solutii SRL",
      "id": "indicator--290eb7d8-5f51-445d-9d9b-1a22b0c4d076",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.248.174.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:05:02.000Z",
      "valid_until": "2026-04-16T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T17:24:27.860Z",
      "x_nadsec_last_seen": "2026-03-15T17:25:41.196Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MD"
      ],
      "x_nadsec_asns": [
        "31252"
      ],
      "x_nadsec_orgs": [
        "StarNet Solutii SRL"
      ]
    },
    {
      "created": "2026-03-15T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--8173f20c-aa35-40c2-a351-8fd11a56e801",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.98.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:05:03.000Z",
      "valid_until": "2026-04-16T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T19:02:03.983Z",
      "x_nadsec_last_seen": "2026-03-15T19:04:11.408Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-15T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--02a03048-1b7c-40ee-9bd6-2fe2848029ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.14.237.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:05:03.000Z",
      "valid_until": "2026-04-16T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T18:53:27.900Z",
      "x_nadsec_last_seen": "2026-03-15T18:53:57.000Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-15T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=DZ; asn=36947; asn_org=Telecom Algeria; user(top)=**",
      "id": "indicator--9f4b3320-9e35-4934-93b0-7e5cefbaeb85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.241.57.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:05:03.000Z",
      "valid_until": "2026-04-16T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T18:44:24.763Z",
      "x_nadsec_last_seen": "2026-03-15T18:44:24.763Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-15T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=RU; asn=12389; asn_org=Rostelecom; user(top)=**",
      "id": "indicator--ca9c4987-51a2-4bfc-83ac-b2c299c2eaba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.128.73.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:05:03.000Z",
      "valid_until": "2026-04-16T19:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-15T18:10:10.966Z",
      "x_nadsec_last_seen": "2026-03-28T17:33:40.622Z",
      "x_nadsec_ports": [
        "1433",
        "445"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-15T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MZ; asn=25139; asn_org=Comunicacoes Multimedia, Lda; user(top)=**",
      "id": "indicator--ffa3335b-41cc-4926-8316-eb8dcf7a144e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.249.255.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:05:03.000Z",
      "valid_until": "2026-04-16T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T18:40:58.560Z",
      "x_nadsec_last_seen": "2026-03-17T18:42:56.178Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MZ"
      ],
      "x_nadsec_asns": [
        "25139"
      ],
      "x_nadsec_orgs": [
        "Comunicacoes Multimedia, Lda"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-15T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC; user(top)=**",
      "id": "indicator--204ce407-d724-4a96-b1a0-a29f6194f87d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.135.48.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:05:03.000Z",
      "valid_until": "2026-04-16T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T18:25:13.179Z",
      "x_nadsec_last_seen": "2026-03-15T18:25:13.179Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-15T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=11426; asn_org=Charter Communications Inc",
      "id": "indicator--5fa29840-df92-4fff-83fa-af197bd68ba8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.57.151.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:05:03.000Z",
      "valid_until": "2026-04-16T19:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-15T18:31:42.731Z",
      "x_nadsec_last_seen": "2026-03-30T09:04:16.365Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11426"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-03-15T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12683; asn_org=Rostelecom",
      "id": "indicator--16a27a0f-df69-46dd-8a59-eeefb4e19b13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.119.155.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:05:03.000Z",
      "valid_until": "2026-04-16T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T18:41:12.342Z",
      "x_nadsec_last_seen": "2026-03-15T18:43:19.847Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12683"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-15T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=GB; asn=209605; asn_org=UAB Host Baltic",
      "id": "indicator--65758f38-b9ca-48a8-8226-bbd4f09b08e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:05:03.000Z",
      "valid_until": "2026-04-16T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T18:07:01.359Z",
      "x_nadsec_last_seen": "2026-03-15T22:30:05.515Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "209605"
      ],
      "x_nadsec_orgs": [
        "UAB Host Baltic"
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=23888; asn_org=National Telecommunication Corporation HQ",
      "id": "indicator--eac8fa49-cdfd-48e8-ab70-a6dec0d2abd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.197.55.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T19:44:17.053Z",
      "x_nadsec_last_seen": "2026-03-15T19:46:23.322Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23888"
      ],
      "x_nadsec_orgs": [
        "National Telecommunication Corporation HQ"
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--9fa22e12-0197-4196-be27-9dd318e33841",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.239.188.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T19:51:57.150Z",
      "x_nadsec_last_seen": "2026-03-15T19:54:03.453Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=IN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--5d9580bd-32be-4fb8-82e1-2f5e6f69decf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.156.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-15T19:06:58.012Z",
      "x_nadsec_last_seen": "2026-03-15T19:07:20.251Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--6a8b7a68-734d-4a0e-9720-641d22fb71f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.47.46.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T19:26:59.453Z",
      "x_nadsec_last_seen": "2026-03-15T19:29:06.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--c9ccf025-e458-49cc-bd5b-f8a21a1dee84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.66.157.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T19:13:43.696Z",
      "x_nadsec_last_seen": "2026-03-15T19:13:50.746Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PE; asn=262210; asn_org=VIETTEL PERU S.A.C.",
      "id": "indicator--944ef159-de72-4b10-9e01-dfe0f35fd959",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.176.136.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-15T19:51:06.789Z",
      "x_nadsec_last_seen": "2026-03-15T19:51:11.725Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "262210"
      ],
      "x_nadsec_orgs": [
        "VIETTEL PERU S.A.C."
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=11664; asn_org=Techtel LMDS Comunicaciones Interactivas S.A.",
      "id": "indicator--b550c270-c9e9-4bfb-b4d3-18311d8d6898",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.221.31.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T19:55:29.369Z",
      "x_nadsec_last_seen": "2026-03-15T19:57:36.745Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11664"
      ],
      "x_nadsec_orgs": [
        "Techtel LMDS Comunicaciones Interactivas S.A."
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--b819eb99-f2bc-400c-9181-e0445d150130",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.239.78.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-15T19:35:57.816Z",
      "x_nadsec_last_seen": "2026-03-29T07:51:32.649Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--8ded2670-2faf-4adb-b3f3-ac47991ea0b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.144.203.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-15T19:12:59.673Z",
      "x_nadsec_last_seen": "2026-03-15T20:31:04.854Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--b58c757f-c6f8-40c3-a71c-ee0ec3c052ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T19:35:26.166Z",
      "x_nadsec_last_seen": "2026-03-15T19:35:26.166Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=JO; asn=9038; asn_org=Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co",
      "id": "indicator--09cb8e04-5685-400e-90f4-45cfdcb2e863",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.118.18.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-15T19:23:22.695Z",
      "x_nadsec_last_seen": "2026-03-15T19:24:13.677Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "9038"
      ],
      "x_nadsec_orgs": [
        "Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co"
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=UA; asn=6849; asn_org=JSC Ukrtelecom",
      "id": "indicator--7c357613-6c0b-454e-94ce-ce3d5e613570",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.200.72.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T20:04:52.528Z",
      "x_nadsec_last_seen": "2026-03-15T20:04:52.842Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "6849"
      ],
      "x_nadsec_orgs": [
        "JSC Ukrtelecom"
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=57334; asn_org=SPB State Unitary Enterprise ATS Smolnogo",
      "id": "indicator--4909f12f-6168-47d1-973d-543bc9d0c44e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.183.29.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T19:54:18.475Z",
      "x_nadsec_last_seen": "2026-03-15T19:56:25.519Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57334"
      ],
      "x_nadsec_orgs": [
        "SPB State Unitary Enterprise ATS Smolnogo"
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=4134; asn_org=Chinanet; user(top)=***; pass(top)=a*******s",
      "id": "indicator--6380f4e5-ab4f-4389-9807-d69d8ef8ed0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.177.122.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 28,
      "x_nadsec_first_seen": "2026-03-15T20:02:53.812Z",
      "x_nadsec_last_seen": "2026-03-15T22:53:13.769Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "a***n",
        "r**t",
        "***",
        "A***n",
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******6",
        "1***5",
        "1*******9",
        "a*******s",
        "d***y"
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=CN; asn=4134; asn_org=Chinanet; user(top)=***; pass(top)=a***n",
      "id": "indicator--cb898d42-8274-4ffa-a292-614f38ecb0d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.164.57.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 287,
      "x_nadsec_first_seen": "2026-03-15T20:02:09.686Z",
      "x_nadsec_last_seen": "2026-03-15T23:00:04.910Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "A***n",
        "r**t",
        "***",
        "a***n"
      ],
      "x_nadsec_passwords_attempted": [
        "a***n",
        "r**t",
        "1****6",
        "p******d",
        "0****0"
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--ebd08371-f690-44c1-a4dc-9d0f498686f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.107.81.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T19:23:47.567Z",
      "x_nadsec_last_seen": "2026-03-15T19:25:54.681Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-15T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--762b55da-3192-4a9a-83c5-a04138a32f54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.26.164.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:05:03.000Z",
      "valid_until": "2026-04-16T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T19:33:41.242Z",
      "x_nadsec_last_seen": "2026-03-15T19:35:48.240Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-15T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2462938c-ec19-4078-8d71-c11bac695c0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.80.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:05:04.000Z",
      "valid_until": "2026-04-16T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T20:14:19.387Z",
      "x_nadsec_last_seen": "2026-03-15T20:14:19.387Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-15T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--36ce50d5-501e-4fce-a3e6-ffd2663de43c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.82.1.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:05:04.000Z",
      "valid_until": "2026-04-16T21:05:01.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-15T20:16:20.734Z",
      "x_nadsec_last_seen": "2026-03-27T22:14:25.499Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-15T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--ec7a3327-4fe9-40ee-8c98-1c49d366ed23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.203.178.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:05:04.000Z",
      "valid_until": "2026-04-16T21:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-15T21:00:37.701Z",
      "x_nadsec_last_seen": "2026-03-21T15:46:44.422Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-03-15T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8e2a7009-c4e9-4a33-b5b9-16691e563e2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:05:04.000Z",
      "valid_until": "2026-04-16T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T20:31:06.593Z",
      "x_nadsec_last_seen": "2026-03-15T20:31:06.593Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-15T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=59508; asn_org=Krasnoyarsk network Ltd.",
      "id": "indicator--0a147ecb-d82a-4e62-ae68-9d4ed3e548f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.159.96.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:05:04.000Z",
      "valid_until": "2026-04-16T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T20:57:21.637Z",
      "x_nadsec_last_seen": "2026-03-15T20:59:29.783Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "59508"
      ],
      "x_nadsec_orgs": [
        "Krasnoyarsk network Ltd."
      ]
    },
    {
      "created": "2026-03-15T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--6bda7a2b-13b7-4101-a9a2-e923e5c41d9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.153.0.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:05:03.000Z",
      "valid_until": "2026-04-16T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T21:13:19.131Z",
      "x_nadsec_last_seen": "2026-03-15T21:15:26.241Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-15T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--dd5006ba-4a6f-4e09-b581-6d3b975108af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:05:03.000Z",
      "valid_until": "2026-04-16T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T21:17:01.938Z",
      "x_nadsec_last_seen": "2026-03-22T16:09:21.127Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-15T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=23674; asn_org=Nayatel Pvt Ltd",
      "id": "indicator--eb82f758-735d-48b0-ab66-df05495d0ad9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.99.51.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:05:03.000Z",
      "valid_until": "2026-04-16T22:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T21:47:33.380Z",
      "x_nadsec_last_seen": "2026-03-15T21:54:27.199Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23674"
      ],
      "x_nadsec_orgs": [
        "Nayatel Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-15T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--5ef219e3-ed63-4412-a076-f29393c499bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '219.146.243.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:05:03.000Z",
      "valid_until": "2026-04-16T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T21:25:33.400Z",
      "x_nadsec_last_seen": "2026-03-15T21:27:40.040Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-15T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=28840; asn_org=Pjsc tattelecom",
      "id": "indicator--8402a36f-a131-442e-8d01-00eed97eec30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.138.131.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:05:03.000Z",
      "valid_until": "2026-04-16T22:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-15T21:09:44.350Z",
      "x_nadsec_last_seen": "2026-03-15T21:17:30.040Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28840"
      ],
      "x_nadsec_orgs": [
        "Pjsc tattelecom"
      ]
    },
    {
      "created": "2026-03-15T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UZ; asn=61263; asn_org=Modern store group LLC",
      "id": "indicator--6f11c217-667b-4ac9-872a-2884db5c2935",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.207.241.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:05:02.000Z",
      "valid_until": "2026-04-16T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T22:08:47.362Z",
      "x_nadsec_last_seen": "2026-03-15T22:10:53.642Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "61263"
      ],
      "x_nadsec_orgs": [
        "Modern store group LLC"
      ]
    },
    {
      "created": "2026-03-15T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31257; asn_org=Orion Telecom LLC",
      "id": "indicator--f6862cad-bdc9-4ae4-b020-12ada9e9b4d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.226.252.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:05:02.000Z",
      "valid_until": "2026-04-16T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T22:14:32.547Z",
      "x_nadsec_last_seen": "2026-03-15T22:16:39.622Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31257"
      ],
      "x_nadsec_orgs": [
        "Orion Telecom LLC"
      ]
    },
    {
      "created": "2026-03-15T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--c5e27439-4d11-471a-a1bb-d82fe2f44054",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.210.47.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:05:02.000Z",
      "valid_until": "2026-04-16T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T22:38:35.479Z",
      "x_nadsec_last_seen": "2026-03-15T22:38:40.470Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-15T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=168; services=smbd; ports=445; cc=IT; asn=1267; asn_org=Wind Tre S.p.A.",
      "id": "indicator--181e6e05-0046-4f13-a288-d1e447b56e9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '151.47.150.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:05:02.000Z",
      "valid_until": "2026-04-16T23:05:01.000Z",
      "x_nadsec_event_count": 3154,
      "x_nadsec_first_seen": "2026-03-15T22:58:48.253Z",
      "x_nadsec_last_seen": "2026-03-16T00:12:33.672Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "1267"
      ],
      "x_nadsec_orgs": [
        "Wind Tre S.p.A."
      ]
    },
    {
      "created": "2026-03-15T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=MN; asn=45204; asn_org=GEMNET LLC",
      "id": "indicator--1946f735-f099-4c53-b832-d3ba334e4137",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.149.125.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:05:02.000Z",
      "valid_until": "2026-04-16T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T22:27:32.527Z",
      "x_nadsec_last_seen": "2026-03-15T22:27:32.527Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "45204"
      ],
      "x_nadsec_orgs": [
        "GEMNET LLC"
      ]
    },
    {
      "created": "2026-03-15T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--c82ca928-12b0-4a1a-b1a3-1700e4d4ae6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.128.75.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:05:02.000Z",
      "valid_until": "2026-04-16T23:05:01.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-15T22:13:12.772Z",
      "x_nadsec_last_seen": "2026-03-22T23:17:25.784Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-15T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--d1e4ab3e-a0ae-4e93-b270-65b369437db7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:05:02.000Z",
      "valid_until": "2026-04-16T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T22:08:53.099Z",
      "x_nadsec_last_seen": "2026-03-15T22:08:53.099Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-15T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1bfa346d-e27d-4498-b765-3dd9e078243e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:05:02.000Z",
      "valid_until": "2026-04-16T23:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-15T22:40:49.144Z",
      "x_nadsec_last_seen": "2026-03-15T22:40:59.462Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-15T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e60512a9-cbc4-4043-ba51-3e0bab64de5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:05:02.000Z",
      "valid_until": "2026-04-16T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-15T22:37:00.942Z",
      "x_nadsec_last_seen": "2026-03-15T22:37:00.942Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-15T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--9f95f978-1878-43c2-8014-13acebef6b78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.61.113.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:05:02.000Z",
      "valid_until": "2026-04-16T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-15T22:34:43.001Z",
      "x_nadsec_last_seen": "2026-03-15T22:36:49.082Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-15T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=JO; asn=47887; asn_org=Al-hadatheh Lil-itisalat Wa Al-technologia Co.",
      "id": "indicator--bc687e13-964d-44eb-b72f-69cf4466e5b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-15T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.212.82.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:05:02.000Z",
      "valid_until": "2026-04-16T23:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-15T22:38:09.487Z",
      "x_nadsec_last_seen": "2026-03-15T22:40:14.660Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "47887"
      ],
      "x_nadsec_orgs": [
        "Al-hadatheh Lil-itisalat Wa Al-technologia Co."
      ]
    },
    {
      "created": "2026-03-16T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--1fa7870a-5047-4812-b47d-6094a4c57ca0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.230.147.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:05:03.000Z",
      "valid_until": "2026-04-17T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T00:48:52.504Z",
      "x_nadsec_last_seen": "2026-03-16T00:51:00.518Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-16T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--50d44a8f-c57d-416c-b247-066eafef25be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.99.253.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:05:03.000Z",
      "valid_until": "2026-04-17T01:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T00:12:18.304Z",
      "x_nadsec_last_seen": "2026-03-16T00:18:55.132Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-16T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--6777e372-c790-4050-935e-774f9e6cc516",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.7.236.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:05:03.000Z",
      "valid_until": "2026-04-17T01:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T01:03:33.442Z",
      "x_nadsec_last_seen": "2026-03-16T01:09:56.323Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-16T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--71a318e5-54d9-4fda-a39d-6c3215e45875",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.236.77.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:05:03.000Z",
      "valid_until": "2026-04-17T01:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T00:10:33.987Z",
      "x_nadsec_last_seen": "2026-03-16T00:11:30.746Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-16T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=35805; asn_org=JSC Silknet",
      "id": "indicator--97fe85c8-a782-4df2-86fc-7d54a79c9c23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.134.39.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:05:03.000Z",
      "valid_until": "2026-04-17T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T00:25:33.083Z",
      "x_nadsec_last_seen": "2026-03-16T00:27:40.410Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "35805"
      ],
      "x_nadsec_orgs": [
        "JSC Silknet"
      ]
    },
    {
      "created": "2026-03-16T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--e4b25625-16ae-4ee6-a7a2-79267586f6da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.253.42.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:05:03.000Z",
      "valid_until": "2026-04-17T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T00:06:18.558Z",
      "x_nadsec_last_seen": "2026-03-16T00:08:23.086Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-03-16T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--cfcd06c8-f037-4506-a7ad-62c955a6c2c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:05:03.000Z",
      "valid_until": "2026-04-17T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T00:15:23.081Z",
      "x_nadsec_last_seen": "2026-03-26T05:27:00.234Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "smbd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-16T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=18747; asn_org=IFX Corporation",
      "id": "indicator--68ed2e94-e191-4225-9da4-6e700164eb01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.241.18.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:05:03.000Z",
      "valid_until": "2026-04-17T01:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T00:55:12.419Z",
      "x_nadsec_last_seen": "2026-03-16T00:59:21.867Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "18747"
      ],
      "x_nadsec_orgs": [
        "IFX Corporation"
      ]
    },
    {
      "created": "2026-03-16T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--2b40cbce-201b-404e-952e-d3fe53d6b122",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.242.178.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:05:03.000Z",
      "valid_until": "2026-04-17T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T00:59:58.608Z",
      "x_nadsec_last_seen": "2026-03-16T00:59:58.608Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-16T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:05:03.000Z",
      "valid_until": "2026-04-17T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T00:54:08.899Z",
      "x_nadsec_last_seen": "2026-03-16T00:54:08.899Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=151813; asn_org=NETCOM",
      "id": "indicator--ffa98d32-25eb-438b-a8f5-f07e875496cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.131.135.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T01:53:19.333Z",
      "x_nadsec_last_seen": "2026-03-16T01:55:31.201Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "151813"
      ],
      "x_nadsec_orgs": [
        "NETCOM"
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--63cd03eb-0869-413d-8604-19bc4f328d3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.170.8.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T01:18:08.881Z",
      "x_nadsec_last_seen": "2026-03-16T01:20:13.632Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0e1ede6e-76b8-478c-bacf-40b739889e9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T02:01:10.118Z",
      "x_nadsec_last_seen": "2026-03-28T16:59:29.874Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=smbd; ports=445; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--0afe38b7-be81-4f5e-a0f1-1289035fb714",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.149.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-03-16T01:39:12.160Z",
      "x_nadsec_last_seen": "2026-03-22T18:12:40.257Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--b1cde156-f744-4a90-9a3b-2c37b50a8cd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.72.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-16T01:21:13.026Z",
      "x_nadsec_last_seen": "2026-03-21T04:01:57.619Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=10029; asn_org=SHYAM SPECTRA PVT LTD",
      "id": "indicator--20d77404-cda0-408c-a998-0f20fd476c51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.151.84.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T01:54:32.543Z",
      "x_nadsec_last_seen": "2026-03-16T02:01:08.329Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "10029"
      ],
      "x_nadsec_orgs": [
        "SHYAM SPECTRA PVT LTD"
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--f1ce24fb-8a46-4fb8-82dd-9385f9dafcec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.252.238.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T01:57:52.644Z",
      "x_nadsec_last_seen": "2026-03-16T01:59:57.933Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--2ec97be3-cd43-46d0-a31d-37ba58b04237",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.50.141.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T01:34:40.901Z",
      "x_nadsec_last_seen": "2026-03-16T01:36:46.272Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--fd9b7fb9-1a13-43a9-999d-c0bc955fa737",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.10.135.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T02:03:36.002Z",
      "x_nadsec_last_seen": "2026-03-16T02:10:36.646Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2c9e1421-aa00-4e9c-a07c-0358edccb5b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.61.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T01:05:23.517Z",
      "x_nadsec_last_seen": "2026-03-16T01:05:24.113Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4772bec6-5edc-4e44-bf5f-521c7c664e55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T01:34:58.284Z",
      "x_nadsec_last_seen": "2026-03-25T15:20:48.948Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--5e1b3043-451d-48ab-8205-7c01ebee8547",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.73.251.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T02:00:02.073Z",
      "x_nadsec_last_seen": "2026-03-16T02:00:07.510Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--9fd8f06f-67cc-4716-b52f-336ebdf02e4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-16T01:21:45.154Z",
      "x_nadsec_last_seen": "2026-03-16T01:22:35.157Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=197275; asn_org=Link Telecom NN Ltd.",
      "id": "indicator--b25bf906-65df-4079-92ba-25e4b3fe68cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.219.58.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-16T02:01:37.973Z",
      "x_nadsec_last_seen": "2026-03-29T13:22:27.777Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "197275"
      ],
      "x_nadsec_orgs": [
        "Link Telecom NN Ltd."
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--b220329f-393c-4a48-8673-397da65ac5cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.41.0.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T01:15:40.243Z",
      "x_nadsec_last_seen": "2026-03-16T01:17:46.825Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-03-16T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--c534112b-e54f-4945-95c5-168763f6459e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.167.220.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:05:02.000Z",
      "valid_until": "2026-04-17T02:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T01:09:00.366Z",
      "x_nadsec_last_seen": "2026-03-16T01:17:42.789Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-16T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--6f904ee0-19a5-462c-bfec-4f37b7de0f63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.54.228.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:05:03.000Z",
      "valid_until": "2026-04-17T03:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T02:12:56.547Z",
      "x_nadsec_last_seen": "2026-03-16T02:18:14.931Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-16T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23974; asn_org=Ministry of education",
      "id": "indicator--4ff52f22-74e2-4f61-b338-cf58298799d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.0.157.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:05:03.000Z",
      "valid_until": "2026-04-17T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T02:51:56.188Z",
      "x_nadsec_last_seen": "2026-03-16T02:54:01.509Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23974"
      ],
      "x_nadsec_orgs": [
        "Ministry of education"
      ]
    },
    {
      "created": "2026-03-16T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=24086; asn_org=Viettel Corporation",
      "id": "indicator--6d4dffb1-1b31-4366-b3a3-5772b2a94695",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.108.48.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:05:03.000Z",
      "valid_until": "2026-04-17T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T02:18:17.329Z",
      "x_nadsec_last_seen": "2026-03-16T02:20:22.102Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24086"
      ],
      "x_nadsec_orgs": [
        "Viettel Corporation"
      ]
    },
    {
      "created": "2026-03-16T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MA; asn=36903; asn_org=MT-MPLS",
      "id": "indicator--3ab86e5a-fd01-4a6e-8619-5d7956890655",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.179.130.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:05:03.000Z",
      "valid_until": "2026-04-17T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T02:19:01.371Z",
      "x_nadsec_last_seen": "2026-03-16T02:19:01.371Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ]
    },
    {
      "created": "2026-03-16T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=57835; asn_org=Jsc Elektrosvyaz",
      "id": "indicator--ca67d2a2-41db-4032-8ad7-da0107afefb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.109.0.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:05:03.000Z",
      "valid_until": "2026-04-17T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T02:44:48.406Z",
      "x_nadsec_last_seen": "2026-03-16T02:52:10.473Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57835"
      ],
      "x_nadsec_orgs": [
        "Jsc Elektrosvyaz"
      ]
    },
    {
      "created": "2026-03-16T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MA; asn=36903; asn_org=MT-MPLS",
      "id": "indicator--b64e0443-fcf6-495d-b641-6dae3adaba92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.89.185.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:05:03.000Z",
      "valid_until": "2026-04-17T03:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T02:19:01.662Z",
      "x_nadsec_last_seen": "2026-03-16T02:21:07.594Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ]
    },
    {
      "created": "2026-03-16T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--84fd24dc-b323-40ce-8bf7-1ba96e098c36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.13.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:05:03.000Z",
      "valid_until": "2026-04-17T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T02:55:51.409Z",
      "x_nadsec_last_seen": "2026-03-16T02:55:51.409Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-16T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--07f93adc-ff4a-405c-995f-6d924bfb4c0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.6.38.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:05:03.000Z",
      "valid_until": "2026-04-17T03:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T02:22:18.032Z",
      "x_nadsec_last_seen": "2026-03-16T02:23:06.684Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-03-16T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mqttd; ports=1883; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--24788ee2-bbd4-4f54-826b-9882cacf540b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.144.44.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:05:03.000Z",
      "valid_until": "2026-04-17T03:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-16T02:20:09.254Z",
      "x_nadsec_last_seen": "2026-03-16T02:20:09.839Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-16T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--4ca66a4d-6aa5-4d8f-92c1-e7b0a6e24b23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.81.236.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:05:03.000Z",
      "valid_until": "2026-04-17T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T02:50:11.636Z",
      "x_nadsec_last_seen": "2026-03-16T02:50:17.014Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-16T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--9b3d0254-26f4-42de-9fd0-4476e02a59a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.216.189.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:05:03.000Z",
      "valid_until": "2026-04-17T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T02:41:54.047Z",
      "x_nadsec_last_seen": "2026-03-16T02:42:00.186Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-16T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--5e552172-1ef7-4a26-bd20-f37cd72931da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:05:03.000Z",
      "valid_until": "2026-04-17T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T02:52:49.439Z",
      "x_nadsec_last_seen": "2026-03-16T02:52:49.439Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-16T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--9a216525-6452-4172-a185-d3710f5f727a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.77.199.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:05:03.000Z",
      "valid_until": "2026-04-17T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T03:29:45.513Z",
      "x_nadsec_last_seen": "2026-03-16T03:31:50.438Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-16T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--5868c146-a61b-437e-9a5e-017186f4c370",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.23.123.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:05:03.000Z",
      "valid_until": "2026-04-17T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T03:37:01.369Z",
      "x_nadsec_last_seen": "2026-03-16T03:39:06.561Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-16T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--43179299-63dd-44b0-b95d-6adba7580e10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.221.139.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:05:03.000Z",
      "valid_until": "2026-04-17T04:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-16T03:55:52.835Z",
      "x_nadsec_last_seen": "2026-03-16T04:56:53.199Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-16T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--56a1ea18-9ca7-420d-91f2-e6a8cb2a85a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.4.178.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:05:03.000Z",
      "valid_until": "2026-04-17T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T03:32:49.814Z",
      "x_nadsec_last_seen": "2026-03-16T03:34:54.528Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-16T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=HK; asn=134365; asn_org=Ansheng Network Technology Co., Limited; user(top)=**",
      "id": "indicator--0bd29b7d-e97d-451b-b7df-5cf867431902",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.194.251.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:05:03.000Z",
      "valid_until": "2026-04-17T04:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T03:47:45.455Z",
      "x_nadsec_last_seen": "2026-03-30T10:53:49.492Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "134365"
      ],
      "x_nadsec_orgs": [
        "Ansheng Network Technology Co., Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-16T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--e40e7624-1219-4355-a68b-6997bd771385",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.242.167.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:05:03.000Z",
      "valid_until": "2026-04-17T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T03:24:48.687Z",
      "x_nadsec_last_seen": "2026-03-16T03:26:55.173Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-16T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=pptpd; ports=1723; cc=HK; asn=23470; asn_org=ReliableSite.Net LLC",
      "id": "indicator--fcf99b6b-b5cd-467b-9d66-131d45b4505e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.110.223.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:05:03.000Z",
      "valid_until": "2026-04-17T04:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-16T03:59:28.354Z",
      "x_nadsec_last_seen": "2026-03-26T19:12:30.925Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "23470"
      ],
      "x_nadsec_orgs": [
        "ReliableSite.Net LLC"
      ]
    },
    {
      "created": "2026-03-16T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--f2eba859-9861-4111-90e0-203cb0e9d434",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.74.51.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:05:03.000Z",
      "valid_until": "2026-04-17T04:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T03:07:46.399Z",
      "x_nadsec_last_seen": "2026-03-16T03:07:50.121Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-16T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=7738; asn_org=V tal",
      "id": "indicator--b14d5191-0af6-4129-8578-4bcce4191ab9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.80.32.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:05:03.000Z",
      "valid_until": "2026-04-17T04:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-16T03:14:55.669Z",
      "x_nadsec_last_seen": "2026-03-26T16:53:44.913Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "7738"
      ],
      "x_nadsec_orgs": [
        "V tal"
      ]
    },
    {
      "created": "2026-03-16T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c215c121-698a-43e9-b121-99dc18cedf6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.51.234.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:05:03.000Z",
      "valid_until": "2026-04-17T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T03:53:30.017Z",
      "x_nadsec_last_seen": "2026-03-16T03:53:40.209Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-16T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ed0e4e90-ba02-428c-95f4-ec50312d7079",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:05:03.000Z",
      "valid_until": "2026-04-17T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T03:59:03.990Z",
      "x_nadsec_last_seen": "2026-03-18T02:49:59.096Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-16T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KG; asn=12997; asn_org=OJSC Kyrgyztelecom",
      "id": "indicator--ad000853-72c5-4a33-b487-557e5ad60bb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.145.157.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:05:03.000Z",
      "valid_until": "2026-04-17T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T03:22:36.853Z",
      "x_nadsec_last_seen": "2026-03-16T03:24:43.949Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "12997"
      ],
      "x_nadsec_orgs": [
        "OJSC Kyrgyztelecom"
      ]
    },
    {
      "created": "2026-03-16T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--37faefc9-0a96-419f-a4ea-88a6811dc91f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.127.68.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:05:03.000Z",
      "valid_until": "2026-04-17T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T03:42:21.180Z",
      "x_nadsec_last_seen": "2026-03-16T03:44:25.906Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-16T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=140475; asn_org=PT Citra Celebas Multimedia",
      "id": "indicator--90f6fbfa-c48e-45aa-921c-cf416c79c1f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.39.174.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:05:03.000Z",
      "valid_until": "2026-04-17T04:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-16T03:45:17.938Z",
      "x_nadsec_last_seen": "2026-03-26T08:12:06.563Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "140475"
      ],
      "x_nadsec_orgs": [
        "PT Citra Celebas Multimedia"
      ]
    },
    {
      "created": "2026-03-16T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--7560f455-4305-4961-8cdd-ce52f467ccc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.96.46.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:05:04.000Z",
      "valid_until": "2026-04-17T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T04:34:35.180Z",
      "x_nadsec_last_seen": "2026-03-16T04:39:12.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-16T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2312e761-6bc9-4acf-b90c-64076914cc65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.226.38.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:05:04.000Z",
      "valid_until": "2026-04-17T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T04:17:32.637Z",
      "x_nadsec_last_seen": "2026-03-16T04:24:18.861Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-16T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--36148765-701b-42a6-b356-72529ef7b16d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:05:04.000Z",
      "valid_until": "2026-04-17T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T04:57:17.824Z",
      "x_nadsec_last_seen": "2026-03-16T04:57:17.824Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-16T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JP; asn=2514; asn_org=NTT PC Communications, Inc.",
      "id": "indicator--5bac5300-4b4b-444d-919b-6d2f7a7e1098",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.120.0.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:05:04.000Z",
      "valid_until": "2026-04-17T05:05:01.000Z",
      "x_nadsec_event_count": 30,
      "x_nadsec_first_seen": "2026-03-16T04:50:55.967Z",
      "x_nadsec_last_seen": "2026-03-22T13:15:33.476Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "2514"
      ],
      "x_nadsec_orgs": [
        "NTT PC Communications, Inc."
      ]
    },
    {
      "created": "2026-03-16T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:05:04.000Z",
      "valid_until": "2026-04-17T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T04:10:15.580Z",
      "x_nadsec_last_seen": "2026-03-16T04:10:15.580Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-03-16T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CL; asn=27651; asn_org=ENTEL CHILE S.A.",
      "id": "indicator--ce1bf697-8090-4d09-bae9-cf076f4fbe99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '164.77.96.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:05:04.000Z",
      "valid_until": "2026-04-17T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T05:00:31.408Z",
      "x_nadsec_last_seen": "2026-03-16T05:00:54.892Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "27651"
      ],
      "x_nadsec_orgs": [
        "ENTEL CHILE S.A."
      ]
    },
    {
      "created": "2026-03-16T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--0f464454-2db4-48e0-9a29-4b5193ec6a4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.16.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:05:04.000Z",
      "valid_until": "2026-04-17T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T04:40:28.624Z",
      "x_nadsec_last_seen": "2026-03-16T04:42:36.444Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-16T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=263661; asn_org=BRASIL DIGITAL SERVICOS DE INFORMATICA E COMERCIO",
      "id": "indicator--d1e860f2-94fa-45fa-afc3-43080efd2c57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.221.57.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:05:04.000Z",
      "valid_until": "2026-04-17T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T04:56:44.203Z",
      "x_nadsec_last_seen": "2026-03-16T04:58:51.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263661"
      ],
      "x_nadsec_orgs": [
        "BRASIL DIGITAL SERVICOS DE INFORMATICA E COMERCIO"
      ]
    },
    {
      "created": "2026-03-16T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--5bccbba8-32b3-43cf-a188-2a3a2d77a75a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.23.111.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:05:04.000Z",
      "valid_until": "2026-04-17T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T04:31:43.149Z",
      "x_nadsec_last_seen": "2026-03-16T04:33:50.657Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-16T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--6cbd5a53-f9c8-423c-ac13-1517714d18d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.82.247.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:05:04.000Z",
      "valid_until": "2026-04-17T05:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-16T04:46:32.215Z",
      "x_nadsec_last_seen": "2026-03-16T05:28:36.889Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-03-16T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=23991; asn_org=Ranks ITT Ltd.",
      "id": "indicator--03babd3c-f2fc-4675-adf9-436599a913bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.40.177.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:05:04.000Z",
      "valid_until": "2026-04-17T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T04:59:00.841Z",
      "x_nadsec_last_seen": "2026-03-16T05:01:05.543Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23991"
      ],
      "x_nadsec_orgs": [
        "Ranks ITT Ltd."
      ]
    },
    {
      "created": "2026-03-16T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=4618; asn_org=Internet Thailand Company Limited",
      "id": "indicator--1eb53b6e-425f-4b08-9c6d-10b8219a1833",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.150.168.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:05:04.000Z",
      "valid_until": "2026-04-17T05:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T04:19:09.312Z",
      "x_nadsec_last_seen": "2026-03-16T04:19:13.287Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "4618"
      ],
      "x_nadsec_orgs": [
        "Internet Thailand Company Limited"
      ]
    },
    {
      "created": "2026-03-16T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--5407d86c-0b3c-4185-9924-e9439166723a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.43.62.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:05:04.000Z",
      "valid_until": "2026-04-17T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T04:16:12.194Z",
      "x_nadsec_last_seen": "2026-03-16T04:16:32.064Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-16T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--f67bcc38-4343-4700-bf1c-99ff1b2fd1b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.125.2.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:05:04.000Z",
      "valid_until": "2026-04-17T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T04:33:58.948Z",
      "x_nadsec_last_seen": "2026-03-16T04:36:05.146Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-16T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RS; asn=31042; asn_org=Serbia BroadBand-Srpske Kablovske mreze d.o.o.",
      "id": "indicator--dfc3c190-913d-4830-9dff-9ff9f0cee685",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.216.114.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T05:05:04.000Z",
      "valid_until": "2026-04-17T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T04:39:10.951Z",
      "x_nadsec_last_seen": "2026-03-16T04:44:05.174Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "31042"
      ],
      "x_nadsec_orgs": [
        "Serbia BroadBand-Srpske Kablovske mreze d.o.o."
      ]
    },
    {
      "created": "2026-03-16T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--11b8a410-e1ce-4c31-b361-e7d8124ff6b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.41.36.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:05:06.000Z",
      "valid_until": "2026-04-17T06:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T05:57:20.566Z",
      "x_nadsec_last_seen": "2026-03-16T06:03:52.692Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-03-16T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=45458; asn_org=SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "id": "indicator--764541c8-ecce-4c36-8e7e-4fab58218772",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.49.31.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:05:06.000Z",
      "valid_until": "2026-04-17T06:05:03.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-03-16T05:20:02.088Z",
      "x_nadsec_last_seen": "2026-03-19T09:39:46.320Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45458"
      ],
      "x_nadsec_orgs": [
        "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX"
      ]
    },
    {
      "created": "2026-03-16T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=IN; asn=139490; asn_org=Aspt Networks Pvt Ltd",
      "id": "indicator--f003822c-56e9-4cf2-850a-b059cd022432",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '163.223.190.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:05:06.000Z",
      "valid_until": "2026-04-17T06:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-16T05:26:14.444Z",
      "x_nadsec_last_seen": "2026-03-16T05:53:01.752Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "139490"
      ],
      "x_nadsec_orgs": [
        "Aspt Networks Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-16T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--2e7de68d-1f50-4988-863f-bab4970713a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '168.149.80.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:05:06.000Z",
      "valid_until": "2026-04-17T06:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T05:43:31.345Z",
      "x_nadsec_last_seen": "2026-03-16T05:43:31.655Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-16T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ZA; asn=37611; asn_org=AFRIHOST-SP",
      "id": "indicator--f3d70ea7-4f04-439d-ba2c-2cac1d680e28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '169.0.78.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:05:06.000Z",
      "valid_until": "2026-04-17T06:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T05:21:55.011Z",
      "x_nadsec_last_seen": "2026-03-16T05:29:37.730Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37611"
      ],
      "x_nadsec_orgs": [
        "AFRIHOST-SP"
      ]
    },
    {
      "created": "2026-03-16T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31499; asn_org=Ekaterinburg-2000 LLC",
      "id": "indicator--d6da65d7-43b3-4118-9fbb-65233a5e0eda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.11.228.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:05:06.000Z",
      "valid_until": "2026-04-17T06:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-16T05:59:50.742Z",
      "x_nadsec_last_seen": "2026-03-16T07:05:18.120Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31499"
      ],
      "x_nadsec_orgs": [
        "Ekaterinburg-2000 LLC"
      ]
    },
    {
      "created": "2026-03-16T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--d53aa1fc-54aa-484b-9285-12e29cf9fb4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.158.178.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:05:06.000Z",
      "valid_until": "2026-04-17T06:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T05:58:22.084Z",
      "x_nadsec_last_seen": "2026-03-16T06:02:20.564Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-16T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--55ba95f9-ad62-480d-adb5-aa963f4f2cfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.49.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:05:06.000Z",
      "valid_until": "2026-04-17T06:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T05:55:00.129Z",
      "x_nadsec_last_seen": "2026-03-16T05:55:00.419Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-16T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BD; asn=23956; asn_org=AmberIT Limited",
      "id": "indicator--01731537-9b88-4be2-baea-c6fa3f4f3ee9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.4.107.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:05:06.000Z",
      "valid_until": "2026-04-17T06:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T05:37:41.019Z",
      "x_nadsec_last_seen": "2026-03-16T05:38:07.006Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23956"
      ],
      "x_nadsec_orgs": [
        "AmberIT Limited"
      ]
    },
    {
      "created": "2026-03-16T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--fb4f92f3-0c2f-45b5-8235-3a81fff0631b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.230.221.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:05:06.000Z",
      "valid_until": "2026-04-17T06:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T05:21:50.954Z",
      "x_nadsec_last_seen": "2026-03-16T05:21:50.954Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-16T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--670fd14d-b96d-4ea7-90d8-c4c076e6710f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.195.17.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:05:06.000Z",
      "valid_until": "2026-04-17T06:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T05:45:48.472Z",
      "x_nadsec_last_seen": "2026-03-18T20:06:48.791Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-16T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mysqld; ports=3306; cc=ES; asn=12479; asn_org=Orange Espagne SA",
      "id": "indicator--f2f42770-ca29-453a-8aba-233100a0ef6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '90.160.60.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:05:06.000Z",
      "valid_until": "2026-04-17T06:05:03.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-03-16T05:33:16.330Z",
      "x_nadsec_last_seen": "2026-03-23T01:09:32.715Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "12479"
      ],
      "x_nadsec_orgs": [
        "Orange Espagne SA"
      ]
    },
    {
      "created": "2026-03-16T06:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KZ; asn=59443; asn_org=Baynur and P Ltd.",
      "id": "indicator--41dc28bc-4f3e-4f07-beb8-75858e626551",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T06:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.182.15.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:05:06.000Z",
      "valid_until": "2026-04-17T06:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T06:02:36.598Z",
      "x_nadsec_last_seen": "2026-03-16T06:04:43.232Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "59443"
      ],
      "x_nadsec_orgs": [
        "Baynur and P Ltd."
      ]
    },
    {
      "created": "2026-03-16T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--13c5ffa6-0d21-4fcd-9098-312c58c83e9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.131.162.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:05:05.000Z",
      "valid_until": "2026-04-17T07:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T06:36:55.382Z",
      "x_nadsec_last_seen": "2026-03-16T06:36:56.092Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-16T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6d810a4c-e545-4077-b9a6-7cdad9140e32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.160.46.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:05:05.000Z",
      "valid_until": "2026-04-17T07:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T06:36:58.792Z",
      "x_nadsec_last_seen": "2026-03-16T06:39:05.112Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-16T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=49821; asn_org=Baza.net LLC",
      "id": "indicator--1d8eb2ae-e1e0-47b3-809e-a71332783ca3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.236.64.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:05:05.000Z",
      "valid_until": "2026-04-17T07:05:02.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-13T10:11:36.031Z",
      "x_nadsec_last_seen": "2026-03-16T06:54:55.948Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "49821"
      ],
      "x_nadsec_orgs": [
        "Baza.net LLC"
      ]
    },
    {
      "created": "2026-03-16T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=264628; asn_org=CORPORACION FIBEX TELECOM, C.A.",
      "id": "indicator--3517616c-0266-4377-b667-87aeee21d522",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.8.164.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:05:05.000Z",
      "valid_until": "2026-04-17T07:05:02.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-16T06:40:51.859Z",
      "x_nadsec_last_seen": "2026-03-16T07:44:01.029Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "264628"
      ],
      "x_nadsec_orgs": [
        "CORPORACION FIBEX TELECOM, C.A."
      ]
    },
    {
      "created": "2026-03-16T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--0523467f-1049-4749-b522-218d32a1a299",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:05:05.000Z",
      "valid_until": "2026-04-17T07:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T06:34:26.315Z",
      "x_nadsec_last_seen": "2026-03-16T11:56:54.221Z",
      "x_nadsec_ports": [
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-16T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=23688; asn_org=Link3 Technologies Ltd.",
      "id": "indicator--3c5c6b7f-4c3e-4dbf-9e4b-2c38e8ddca0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.147.209.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:05:05.000Z",
      "valid_until": "2026-04-17T07:05:02.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-16T06:16:28.618Z",
      "x_nadsec_last_seen": "2026-03-16T07:08:17.458Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23688"
      ],
      "x_nadsec_orgs": [
        "Link3 Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-16T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--822b6278-3136-48c4-829d-fb7682bba7a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:05:05.000Z",
      "valid_until": "2026-04-17T07:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T06:07:08.676Z",
      "x_nadsec_last_seen": "2026-03-16T06:07:09.007Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-16T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--a3495fac-a4d1-4fbc-86ae-4b19d1912418",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.122.115.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:05:05.000Z",
      "valid_until": "2026-04-17T07:05:02.000Z",
      "x_nadsec_event_count": 4722,
      "x_nadsec_first_seen": "2026-03-16T07:04:27.042Z",
      "x_nadsec_last_seen": "2026-03-16T07:26:45.212Z",
      "x_nadsec_ports": [
        "1433",
        "445"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-03-16T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--408e4688-9d3a-4288-80c6-9f7b114cb07e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.237.57.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:05:05.000Z",
      "valid_until": "2026-04-17T07:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T07:00:09.832Z",
      "x_nadsec_last_seen": "2026-03-16T07:07:37.073Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-16T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=41257; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a10c8c6c-87be-4328-9c7c-dffdb722d5ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:05:05.000Z",
      "valid_until": "2026-04-17T07:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T06:58:27.514Z",
      "x_nadsec_last_seen": "2026-03-16T06:58:27.517Z",
      "x_nadsec_ports": [
        "42",
        "41257"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-16T07:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3986cc22-3e53-49c0-8b8d-417ec5b90a56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T07:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:05:05.000Z",
      "valid_until": "2026-04-17T07:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T06:58:26.280Z",
      "x_nadsec_last_seen": "2026-03-16T06:58:26.284Z",
      "x_nadsec_ports": [
        "42",
        "44557"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-16T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=138551; asn_org=Skyinfo Online",
      "id": "indicator--5ea8c268-07f0-45ba-9fe3-aacaf12ab60f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.148.108.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:05:02.000Z",
      "valid_until": "2026-04-17T08:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T07:46:58.893Z",
      "x_nadsec_last_seen": "2026-03-16T07:53:40.604Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "138551"
      ],
      "x_nadsec_orgs": [
        "Skyinfo Online"
      ]
    },
    {
      "created": "2026-03-16T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--14f9527e-fb0f-4416-91e5-fcb64e3fcf19",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.251.96.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:05:02.000Z",
      "valid_until": "2026-04-17T08:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T08:01:14.301Z",
      "x_nadsec_last_seen": "2026-03-16T08:03:19.256Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-16T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--4bcd185a-8dcb-452b-a7a9-0596fbe440ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.180.24.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:05:02.000Z",
      "valid_until": "2026-04-17T08:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T07:55:10.357Z",
      "x_nadsec_last_seen": "2026-03-16T07:57:15.651Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-16T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=134863; asn_org=SP INTERNET TECHNOLOGIES PRIVATE LTD",
      "id": "indicator--e5de7a2f-b2d9-4e8b-91dd-c22e2f1c6528",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.16.91.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:05:02.000Z",
      "valid_until": "2026-04-17T08:05:00.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-16T07:31:30.665Z",
      "x_nadsec_last_seen": "2026-03-21T20:33:03.414Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134863"
      ],
      "x_nadsec_orgs": [
        "SP INTERNET TECHNOLOGIES PRIVATE LTD"
      ]
    },
    {
      "created": "2026-03-16T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--0499ee25-6380-4ed9-b2d5-0aa8b7fd5f22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.212.162.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:05:02.000Z",
      "valid_until": "2026-04-17T08:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T07:37:41.207Z",
      "x_nadsec_last_seen": "2026-03-16T07:39:46.081Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-16T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=15626; asn_org=Green Floid LLC",
      "id": "indicator--3476f950-b16e-4ce8-a60b-3c675d06ec59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.12.214.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:05:02.000Z",
      "valid_until": "2026-04-17T08:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T07:19:08.145Z",
      "x_nadsec_last_seen": "2026-03-16T07:21:14.736Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "15626"
      ],
      "x_nadsec_orgs": [
        "Green Floid LLC"
      ]
    },
    {
      "created": "2026-03-16T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--06a2184e-2c84-4d9b-9829-78ae88dd6172",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.252.148.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:05:02.000Z",
      "valid_until": "2026-04-17T08:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T07:24:03.220Z",
      "x_nadsec_last_seen": "2026-03-16T07:24:07.959Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-16T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--5e9026ac-323e-4325-8685-c5d88079c34f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.79.177.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:05:02.000Z",
      "valid_until": "2026-04-17T08:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T07:21:33.690Z",
      "x_nadsec_last_seen": "2026-03-18T18:24:53.701Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-16T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=45458; asn_org=SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "id": "indicator--b5c39848-83fa-4911-a9b2-89bb6553f807",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.231.148.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:05:02.000Z",
      "valid_until": "2026-04-17T08:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T07:13:10.640Z",
      "x_nadsec_last_seen": "2026-03-16T07:13:41.621Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45458"
      ],
      "x_nadsec_orgs": [
        "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX"
      ]
    },
    {
      "created": "2026-03-16T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d37c97bc-bf4f-4788-9330-a33183b069d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:05:02.000Z",
      "valid_until": "2026-04-17T08:05:00.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-16T07:17:26.719Z",
      "x_nadsec_last_seen": "2026-03-20T04:31:44.111Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "httpd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-16T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GB; asn=22351; asn_org=INTELSAT GLOBAL SERVICE CORPORATION",
      "id": "indicator--64972cc0-5062-4ccd-a50e-5222759d0b59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.255.51.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:05:02.000Z",
      "valid_until": "2026-04-17T08:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-13T02:25:09.524Z",
      "x_nadsec_last_seen": "2026-03-16T07:14:04.730Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "22351"
      ],
      "x_nadsec_orgs": [
        "INTELSAT GLOBAL SERVICE CORPORATION"
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--c724b900-793b-4fc5-b4cc-07c1784c56b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.240.93.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T08:10:10.429Z",
      "x_nadsec_last_seen": "2026-03-16T08:12:15.070Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--74d0ebb3-82b3-4f94-9c6c-9f2ee7abbceb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.21.105.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T08:11:26.498Z",
      "x_nadsec_last_seen": "2026-03-16T08:13:31.214Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--244cf451-ebb3-4f4a-b8f0-912fbb9f522c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.127.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T08:40:48.660Z",
      "x_nadsec_last_seen": "2026-03-16T08:40:48.660Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--23613dd2-8bb6-4e2f-81f5-90a84b7650b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.232.105.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-16T08:17:20.307Z",
      "x_nadsec_last_seen": "2026-03-16T10:10:48.238Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=46606; asn_org=Unified Layer",
      "id": "indicator--c7ef3755-2dd2-4e50-b4e0-09751b6f4912",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.215.135.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T08:30:35.024Z",
      "x_nadsec_last_seen": "2026-03-18T09:18:41.617Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "46606"
      ],
      "x_nadsec_orgs": [
        "Unified Layer"
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=49724; asn_org=JSC Vainah Telecom",
      "id": "indicator--3f43d373-296d-4858-b6da-f208babc4483",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.0.166.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T08:18:59.309Z",
      "x_nadsec_last_seen": "2026-03-16T08:21:04.376Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "49724"
      ],
      "x_nadsec_orgs": [
        "JSC Vainah Telecom"
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=UA; asn=15895; asn_org=Kyivstar PJSC",
      "id": "indicator--21530dbd-f272-4c2d-8d4d-6a030b3c6280",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.163.176.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T09:04:20.221Z",
      "x_nadsec_last_seen": "2026-03-16T09:11:26.354Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "15895"
      ],
      "x_nadsec_orgs": [
        "Kyivstar PJSC"
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=28318; asn_org=CYBERTAP",
      "id": "indicator--4aaf5857-9498-4fd9-9f23-0cdf287a2d9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.103.16.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-16T08:24:44.072Z",
      "x_nadsec_last_seen": "2026-03-27T07:09:38.729Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "28318"
      ],
      "x_nadsec_orgs": [
        "CYBERTAP"
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--caa9cce8-e888-4724-b661-cd93c08d8ce1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.174.24.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T08:29:05.919Z",
      "x_nadsec_last_seen": "2026-03-16T08:36:16.701Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UA; asn=39199; asn_org=Private Enterprise RadioNet",
      "id": "indicator--ad396403-588d-4059-95dc-a8e6ed6be18c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.34.206.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T09:00:46.786Z",
      "x_nadsec_last_seen": "2026-03-16T09:02:52.805Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "39199"
      ],
      "x_nadsec_orgs": [
        "Private Enterprise RadioNet"
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TN; asn=37492; asn_org=ORANGE; user(top)=**",
      "id": "indicator--d9db45fd-6799-4473-802e-aff1f3aa7ce7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.31.48.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T08:46:00.827Z",
      "x_nadsec_last_seen": "2026-03-21T09:50:33.453Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37492"
      ],
      "x_nadsec_orgs": [
        "ORANGE"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--07fc1ff6-327c-41ed-8272-bbfcf5683960",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.20.36.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T09:00:47.345Z",
      "x_nadsec_last_seen": "2026-03-16T09:00:47.682Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=16135; asn_org=Turkcell Iletisim Hizmetleri A.s.",
      "id": "indicator--e72e7f65-b347-45b7-829e-9559a50ee8af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.141.181.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T08:34:45.366Z",
      "x_nadsec_last_seen": "2026-03-16T08:36:52.024Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "16135"
      ],
      "x_nadsec_orgs": [
        "Turkcell Iletisim Hizmetleri A.s."
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--6acd89fb-a04c-4e75-9706-d6edc88b6170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.205.119.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T08:53:34.116Z",
      "x_nadsec_last_seen": "2026-03-16T08:55:39.487Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=63859; asn_org=PT. Eka Mas Republik",
      "id": "indicator--06d3b10c-8a41-44ec-bb50-325eaa81e09b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.96.238.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T08:38:24.526Z",
      "x_nadsec_last_seen": "2026-03-16T08:40:29.040Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "63859"
      ],
      "x_nadsec_orgs": [
        "PT. Eka Mas Republik"
      ]
    },
    {
      "created": "2026-03-16T09:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--eb54aa48-1d60-4da9-806d-5c4c7a7550d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T09:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.248.170.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:05:05.000Z",
      "valid_until": "2026-04-17T09:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T08:35:47.665Z",
      "x_nadsec_last_seen": "2026-03-16T08:37:54.243Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-16T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--2341b950-ce1f-4543-8139-25040e138f4d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:05:03.000Z",
      "valid_until": "2026-04-17T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T09:15:50.619Z",
      "x_nadsec_last_seen": "2026-03-16T09:15:50.619Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-16T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--4ed7af46-dbff-48e4-8cfc-0a3a0ceb70e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.185.26.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:05:03.000Z",
      "valid_until": "2026-04-17T10:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-16T09:05:18.151Z",
      "x_nadsec_last_seen": "2026-03-16T09:30:08.982Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-16T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0d9dbf91-7679-4834-9486-fd5cf765e5ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.64.196.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:05:03.000Z",
      "valid_until": "2026-04-17T10:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-16T09:22:47.519Z",
      "x_nadsec_last_seen": "2026-03-16T09:22:51.104Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "27017",
        "1723",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "smbd",
        "mqttd",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-16T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--b1dba78e-388a-401f-b6ae-53bdf0d2c430",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.184.87.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:05:03.000Z",
      "valid_until": "2026-04-17T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T09:44:28.007Z",
      "x_nadsec_last_seen": "2026-03-16T09:46:36.754Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-16T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=epmapper; ports=135; cc=BG; asn=48090; asn_org=Techoff Srv Limited",
      "id": "indicator--aff47176-8d79-4fe9-92ae-d8dfb90f699b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.178.110.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:05:03.000Z",
      "valid_until": "2026-04-17T10:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-16T09:17:18.311Z",
      "x_nadsec_last_seen": "2026-03-16T09:17:45.791Z",
      "x_nadsec_ports": [
        "135",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "48090"
      ],
      "x_nadsec_orgs": [
        "Techoff Srv Limited"
      ]
    },
    {
      "created": "2026-03-16T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MK; asn=6821; asn_org=Makedonski Telekom AD-Skopje",
      "id": "indicator--b39addaa-10a0-408c-a824-c86d6d546530",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.28.164.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:05:03.000Z",
      "valid_until": "2026-04-17T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T09:31:42.314Z",
      "x_nadsec_last_seen": "2026-03-16T09:31:49.320Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MK"
      ],
      "x_nadsec_asns": [
        "6821"
      ],
      "x_nadsec_orgs": [
        "Makedonski Telekom AD-Skopje"
      ]
    },
    {
      "created": "2026-03-16T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=56465; asn_org=Therecom Ltd",
      "id": "indicator--548dd076-7713-4ddb-80b5-163cb514cebf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.124.165.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:05:03.000Z",
      "valid_until": "2026-04-17T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T09:54:40.490Z",
      "x_nadsec_last_seen": "2026-03-16T09:56:46.494Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "56465"
      ],
      "x_nadsec_orgs": [
        "Therecom Ltd"
      ]
    },
    {
      "created": "2026-03-16T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=199731; asn_org=The Educational Center for Internet and New Technologies of the Nakhchivan Autonomous Repub",
      "id": "indicator--68a9077d-99e9-44ba-b7c4-cbe05b71719f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.20.234.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T10:05:03.000Z",
      "valid_until": "2026-04-17T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T09:06:10.582Z",
      "x_nadsec_last_seen": "2026-03-16T09:08:18.926Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "199731"
      ],
      "x_nadsec_orgs": [
        "The Educational Center for Internet and New Technologies of the Nakhchivan Autonomous Repub"
      ]
    },
    {
      "created": "2026-03-16T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--72dc3290-fafb-45da-8332-0dba785487dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.91.97.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:05:03.000Z",
      "valid_until": "2026-04-17T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T10:18:05.826Z",
      "x_nadsec_last_seen": "2026-03-16T10:20:14.826Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-16T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e979d996-037f-40d7-90ff-9df4968d816d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.254.37.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:05:03.000Z",
      "valid_until": "2026-04-17T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T10:56:21.773Z",
      "x_nadsec_last_seen": "2026-03-16T10:58:26.939Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-16T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AL; asn=203675; asn_org=Vista Sh.p.k.",
      "id": "indicator--4ed84bbe-0dc1-4d46-8d70-27c0a37e2476",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.82.110.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:05:03.000Z",
      "valid_until": "2026-04-17T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T10:41:33.802Z",
      "x_nadsec_last_seen": "2026-03-16T10:43:44.498Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AL"
      ],
      "x_nadsec_asns": [
        "203675"
      ],
      "x_nadsec_orgs": [
        "Vista Sh.p.k."
      ]
    },
    {
      "created": "2026-03-16T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=3215; asn_org=Orange",
      "id": "indicator--0aa77709-ecaa-44e3-9d54-34444ef563e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.250.243.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:05:03.000Z",
      "valid_until": "2026-04-17T11:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T10:16:38.889Z",
      "x_nadsec_last_seen": "2026-03-16T11:29:57.430Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "3215"
      ],
      "x_nadsec_orgs": [
        "Orange"
      ]
    },
    {
      "created": "2026-03-16T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--829fb2e5-1990-4e80-a808-866b21cf6e3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.136.197.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:05:03.000Z",
      "valid_until": "2026-04-17T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T10:38:10.432Z",
      "x_nadsec_last_seen": "2026-03-16T10:45:39.492Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-16T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--bc89cbaf-a8bc-44c4-84bf-9467ddbf2312",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:05:03.000Z",
      "valid_until": "2026-04-17T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T10:42:08.779Z",
      "x_nadsec_last_seen": "2026-03-16T10:42:08.779Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-16T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--4ee30982-c395-4e00-9d67-935680ec95c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:05:03.000Z",
      "valid_until": "2026-04-17T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T10:42:33.492Z",
      "x_nadsec_last_seen": "2026-03-16T10:42:33.492Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-16T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--61940e62-b73a-442b-bc78-7b518eef5566",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:05:03.000Z",
      "valid_until": "2026-04-17T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T10:42:34.232Z",
      "x_nadsec_last_seen": "2026-03-16T10:42:34.232Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-16T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--c13ea5fc-eba9-4698-9aa9-d5f34c00c3f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:05:03.000Z",
      "valid_until": "2026-04-17T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T10:42:09.186Z",
      "x_nadsec_last_seen": "2026-03-16T10:42:09.186Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-16T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=61621; asn_org=Norte.Net Telecomunicacoes Ltda",
      "id": "indicator--8a6d77c6-37d8-420e-bef1-e227d8b8db8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.231.208.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:05:02.000Z",
      "valid_until": "2026-04-17T12:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T11:58:06.134Z",
      "x_nadsec_last_seen": "2026-03-16T11:58:06.248Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "61621"
      ],
      "x_nadsec_orgs": [
        "Norte.Net Telecomunicacoes Ltda"
      ]
    },
    {
      "created": "2026-03-16T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--74913c86-76d9-40ab-a5f0-a67326e768bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.5.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:05:02.000Z",
      "valid_until": "2026-04-17T12:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T11:34:43.036Z",
      "x_nadsec_last_seen": "2026-03-16T11:44:22.121Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-16T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--431c0d28-3162-445b-af94-b5ca8e9f5b06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.181.149.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:05:02.000Z",
      "valid_until": "2026-04-17T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T11:50:15.583Z",
      "x_nadsec_last_seen": "2026-03-16T11:52:22.009Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-16T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--3bed4d8d-8829-4ac8-a356-7d8602f2ef28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.89.228.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:05:02.000Z",
      "valid_until": "2026-04-17T12:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-16T11:09:22.586Z",
      "x_nadsec_last_seen": "2026-03-18T05:49:54.984Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-16T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--acb385b0-ed15-4c9a-8965-86cecab39683",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.174.244.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:05:02.000Z",
      "valid_until": "2026-04-17T12:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T11:45:45.608Z",
      "x_nadsec_last_seen": "2026-03-16T11:45:45.608Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-16T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=19192; asn_org=Universidad Central de Venezuela",
      "id": "indicator--f717a45d-0d58-4b94-b7b1-88eb4ba88107",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.169.20.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:05:02.000Z",
      "valid_until": "2026-04-17T12:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-16T11:57:12.064Z",
      "x_nadsec_last_seen": "2026-03-19T15:13:31.708Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "19192"
      ],
      "x_nadsec_orgs": [
        "Universidad Central de Venezuela"
      ]
    },
    {
      "created": "2026-03-16T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=7738; asn_org=V tal",
      "id": "indicator--17160688-57fd-41d0-9f6e-417a457f1b07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.165.105.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:05:02.000Z",
      "valid_until": "2026-04-17T12:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T11:51:01.137Z",
      "x_nadsec_last_seen": "2026-03-16T11:58:54.726Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "7738"
      ],
      "x_nadsec_orgs": [
        "V tal"
      ]
    },
    {
      "created": "2026-03-16T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=40021; asn_org=Contabo Inc.; user(top)=**",
      "id": "indicator--a647e605-6730-4ba7-ad61-3b6c6c40f2b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '209.126.3.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:05:02.000Z",
      "valid_until": "2026-04-17T12:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T11:19:49.234Z",
      "x_nadsec_last_seen": "2026-03-16T11:19:49.234Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "40021"
      ],
      "x_nadsec_orgs": [
        "Contabo Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-16T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=42765; asn_org=Excellent Signalman LLC",
      "id": "indicator--56172a8c-f5cd-4b6d-9773-31d7d56f50c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.108.214.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:05:02.000Z",
      "valid_until": "2026-04-17T12:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T11:51:27.980Z",
      "x_nadsec_last_seen": "2026-03-16T12:00:43.568Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "42765"
      ],
      "x_nadsec_orgs": [
        "Excellent Signalman LLC"
      ]
    },
    {
      "created": "2026-03-16T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--3622e3e2-4ef6-484c-a01c-ddba5f4e5c07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.197.145.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:05:02.000Z",
      "valid_until": "2026-04-17T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T11:37:45.043Z",
      "x_nadsec_last_seen": "2026-03-16T11:39:49.602Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-03-16T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--18062449-f1f4-4dbb-9a80-b8769d34e62f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.125.213.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:05:02.000Z",
      "valid_until": "2026-04-17T12:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T11:23:36.003Z",
      "x_nadsec_last_seen": "2026-03-16T11:23:36.075Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-16T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--aa4b1c60-c60e-4ce3-86c1-44e1fa317a2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.48.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:05:02.000Z",
      "valid_until": "2026-04-17T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T12:21:55.018Z",
      "x_nadsec_last_seen": "2026-03-16T12:24:00.956Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-16T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--89141306-f812-4855-a451-79165be57b28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '145.255.28.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:05:02.000Z",
      "valid_until": "2026-04-17T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T12:48:15.050Z",
      "x_nadsec_last_seen": "2026-03-16T12:50:21.329Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-03-16T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EC; asn=27947; asn_org=Telconet S.A",
      "id": "indicator--5a9b1950-daef-4314-b466-4b031b2ac63d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.100.43.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:05:02.000Z",
      "valid_until": "2026-04-17T13:05:00.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-16T12:48:52.087Z",
      "x_nadsec_last_seen": "2026-03-20T13:01:46.223Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "27947"
      ],
      "x_nadsec_orgs": [
        "Telconet S.A"
      ]
    },
    {
      "created": "2026-03-16T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones",
      "id": "indicator--3e70b8ed-fd1a-4aa7-a696-b9edd9b39302",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.57.150.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:05:02.000Z",
      "valid_until": "2026-04-17T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T12:52:50.342Z",
      "x_nadsec_last_seen": "2026-03-16T12:54:57.407Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UY"
      ],
      "x_nadsec_asns": [
        "6057"
      ],
      "x_nadsec_orgs": [
        "Administracion Nacional de Telecomunicaciones"
      ]
    },
    {
      "created": "2026-03-16T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--1f4afdda-6646-4458-af9b-36ac7c7ef5b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.149.207.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:05:02.000Z",
      "valid_until": "2026-04-17T13:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T12:14:00.044Z",
      "x_nadsec_last_seen": "2026-03-16T12:21:33.934Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-16T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=6849; asn_org=JSC Ukrtelecom",
      "id": "indicator--2296bb63-4b69-471b-bb78-5c201216bea8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.5.15.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:05:02.000Z",
      "valid_until": "2026-04-17T13:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T12:35:01.305Z",
      "x_nadsec_last_seen": "2026-03-16T12:42:01.868Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "6849"
      ],
      "x_nadsec_orgs": [
        "JSC Ukrtelecom"
      ]
    },
    {
      "created": "2026-03-16T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--d5ff9dea-9a1c-4aa1-ad89-797229ce90ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.200.81.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:05:02.000Z",
      "valid_until": "2026-04-17T13:05:00.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-13T22:01:48.253Z",
      "x_nadsec_last_seen": "2026-03-16T13:08:30.087Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-03-16T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=44056; asn_org=Trytek LLC",
      "id": "indicator--bbec8e7f-5db6-4f74-8d97-f29a3c46e388",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.148.132.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:05:02.000Z",
      "valid_until": "2026-04-17T13:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T12:42:13.716Z",
      "x_nadsec_last_seen": "2026-03-16T12:49:56.478Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "44056"
      ],
      "x_nadsec_orgs": [
        "Trytek LLC"
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=139449; asn_org=PT Lintas Data Multimedia",
      "id": "indicator--f19ad781-49b8-40d2-8485-9fd22fca024a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.179.216.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T13:30:59.357Z",
      "x_nadsec_last_seen": "2026-03-16T13:33:05.890Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "139449"
      ],
      "x_nadsec_orgs": [
        "PT Lintas Data Multimedia"
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134021; asn_org=Airgenie Communications Private Limited",
      "id": "indicator--47591cb1-476f-4e34-98b2-e9230da2bd06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.96.45.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T13:34:52.127Z",
      "x_nadsec_last_seen": "2026-03-16T13:36:56.603Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134021"
      ],
      "x_nadsec_orgs": [
        "Airgenie Communications Private Limited"
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--e307a6b3-b354-4242-a111-8a491689569d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.99.254.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-16T13:24:39.377Z",
      "x_nadsec_last_seen": "2026-03-16T13:42:40.776Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--57914dea-3192-446f-b60f-7d6db9d827e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.59.144.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T13:21:18.836Z",
      "x_nadsec_last_seen": "2026-03-16T13:21:18.836Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--7defc777-892c-43ad-9161-af6494f5290f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.183.245.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T14:02:03.356Z",
      "x_nadsec_last_seen": "2026-03-16T14:08:56.851Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--b1cd4607-97eb-4e4d-8583-ac42e0529603",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.255.89.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T13:27:57.409Z",
      "x_nadsec_last_seen": "2026-03-16T13:30:04.367Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--461b13a2-1de1-4004-a20f-4d80f1aa1141",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.255.232.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-03-16T13:45:39.668Z",
      "x_nadsec_last_seen": "2026-03-16T13:46:35.673Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--b69aa64f-e31d-4c77-b16f-3370ab3ed54e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.90.208.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T13:10:08.914Z",
      "x_nadsec_last_seen": "2026-03-16T13:10:08.914Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PY; asn=23201; asn_org=Telecel S.A.",
      "id": "indicator--e0d494a7-921b-4174-9f2a-12eaa5c37f13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.127.136.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T14:00:17.768Z",
      "x_nadsec_last_seen": "2026-03-16T14:02:25.806Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "23201"
      ],
      "x_nadsec_orgs": [
        "Telecel S.A."
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PA; asn=11556; asn_org=Cable & Wireless Panama",
      "id": "indicator--c6c3b75b-d671-406f-945c-e5aeb2d2c24f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.178.84.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T13:59:55.515Z",
      "x_nadsec_last_seen": "2026-03-16T14:02:02.695Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PA"
      ],
      "x_nadsec_asns": [
        "11556"
      ],
      "x_nadsec_orgs": [
        "Cable & Wireless Panama"
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited; user(top)=**",
      "id": "indicator--dbc1c241-cb58-443f-8354-d1eb2a3cc745",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.176.186.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T14:02:37.450Z",
      "x_nadsec_last_seen": "2026-03-18T00:05:59.320Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--ae7b17d7-30bd-4647-9d84-45518730ff35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.74.80.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-16T13:13:39.849Z",
      "x_nadsec_last_seen": "2026-03-19T19:36:53.408Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4cabb1a2-67ea-4bdc-9c84-09a4c552f09e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.38.33.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T13:31:37.948Z",
      "x_nadsec_last_seen": "2026-03-16T13:31:48.091Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bb51ea1c-03af-4353-9f4f-449078a9af22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T13:11:23.724Z",
      "x_nadsec_last_seen": "2026-03-16T13:11:23.724Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--8c1a359a-2484-4cb3-b2d4-e00954bfc249",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '207.154.243.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T13:21:06.251Z",
      "x_nadsec_last_seen": "2026-03-16T13:21:17.555Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--3698c4fe-87f4-4a96-8e63-ea048b3b27b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '69.164.213.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T13:44:49.915Z",
      "x_nadsec_last_seen": "2026-03-31T10:09:21.466Z",
      "x_nadsec_ports": [
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "pptpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-16T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mirrorc; ports=38181; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--bde96bb2-b68a-470c-a777-868a2b18f1ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:05:02.000Z",
      "valid_until": "2026-04-17T14:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-16T13:05:17.390Z",
      "x_nadsec_last_seen": "2026-03-24T18:56:50.376Z",
      "x_nadsec_ports": [
        "42",
        "445",
        "35435",
        "38181"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-03-16T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--07717d90-caae-4245-9f7a-a62964518fbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.21.183.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:05:03.000Z",
      "valid_until": "2026-04-17T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T14:15:30.934Z",
      "x_nadsec_last_seen": "2026-03-16T14:17:38.563Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-16T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NL; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--276fe695-5422-4cb5-9261-722bb2946a9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.107.3.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:05:03.000Z",
      "valid_until": "2026-04-17T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T14:09:23.307Z",
      "x_nadsec_last_seen": "2026-03-16T14:11:29.046Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-16T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--610ca676-8123-4232-9915-98f580ef6f63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.185.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:05:03.000Z",
      "valid_until": "2026-04-17T15:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T14:23:13.678Z",
      "x_nadsec_last_seen": "2026-03-16T14:23:14.332Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-16T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--2a894a14-4aa6-4e8f-91a7-0a877fbf540a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.0.71.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:05:03.000Z",
      "valid_until": "2026-04-17T15:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-16T14:45:02.210Z",
      "x_nadsec_last_seen": "2026-03-25T02:07:25.721Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-03-16T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--4d6a6949-b429-41eb-8729-462bd52c1dff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.187.189.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:05:03.000Z",
      "valid_until": "2026-04-17T15:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T14:22:02.912Z",
      "x_nadsec_last_seen": "2026-03-19T18:54:34.915Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-16T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=21499; asn_org=Host Europe GmbH",
      "id": "indicator--584f033b-0f84-4b1d-b9be-a87c6edbb86b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.205.23.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:05:03.000Z",
      "valid_until": "2026-04-17T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T14:30:58.892Z",
      "x_nadsec_last_seen": "2026-03-16T14:30:58.892Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "21499"
      ],
      "x_nadsec_orgs": [
        "Host Europe GmbH"
      ]
    },
    {
      "created": "2026-03-16T17:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=38841; asn_org=kbro CO. Ltd.",
      "id": "indicator--6054b759-af00-42d2-9364-3a82217c5566",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T17:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.195.64.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T17:05:22.000Z",
      "valid_until": "2026-04-17T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T16:21:05.139Z",
      "x_nadsec_last_seen": "2026-03-16T16:23:09.869Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "38841"
      ],
      "x_nadsec_orgs": [
        "kbro CO. Ltd."
      ]
    },
    {
      "created": "2026-03-16T17:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=JP; asn=4685; asn_org=Asahi Net",
      "id": "indicator--6c6810c7-ffbf-43c5-bda2-9ad1b634531b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T17:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.64.115.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T17:05:22.000Z",
      "valid_until": "2026-04-17T17:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T16:54:48.503Z",
      "x_nadsec_last_seen": "2026-03-16T17:01:04.801Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "4685"
      ],
      "x_nadsec_orgs": [
        "Asahi Net"
      ]
    },
    {
      "created": "2026-03-16T17:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4e66bb3f-c0fd-479d-86ad-27ecedfe0697",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T17:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.170.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T17:05:22.000Z",
      "valid_until": "2026-04-17T17:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-16T16:59:26.336Z",
      "x_nadsec_last_seen": "2026-03-16T16:59:58.780Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-16T17:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--22e19a6f-857f-4323-b7f7-ebbe52dfcb1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T17:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T17:05:22.000Z",
      "valid_until": "2026-04-17T17:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T16:09:49.082Z",
      "x_nadsec_last_seen": "2026-03-18T01:35:21.607Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-16T17:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=27947; asn_org=Telconet S.A",
      "id": "indicator--d7a3e607-804e-43ed-a272-87f1e1d0c213",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T17:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.5.67.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T17:05:22.000Z",
      "valid_until": "2026-04-17T17:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-16T16:34:51.293Z",
      "x_nadsec_last_seen": "2026-03-19T15:04:35.294Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "27947"
      ],
      "x_nadsec_orgs": [
        "Telconet S.A"
      ]
    },
    {
      "created": "2026-03-16T17:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37693; asn_org=TUNISIANA",
      "id": "indicator--64db3107-60f2-4394-abef-ade749e251f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T17:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.179.246.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T17:05:22.000Z",
      "valid_until": "2026-04-17T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T16:44:16.241Z",
      "x_nadsec_last_seen": "2026-03-16T16:44:22.572Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37693"
      ],
      "x_nadsec_orgs": [
        "TUNISIANA"
      ]
    },
    {
      "created": "2026-03-16T17:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2dacaf5d-9bda-4f33-abf7-f9b4076f1d4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T17:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T17:05:22.000Z",
      "valid_until": "2026-04-17T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T16:58:34.458Z",
      "x_nadsec_last_seen": "2026-03-16T16:58:34.458Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-16T17:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=16223; asn_org=Maxnet Telecom, Ltd",
      "id": "indicator--bd5b5204-40be-4b29-9d05-6f96b551225e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T17:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.58.93.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T17:05:22.000Z",
      "valid_until": "2026-04-17T17:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T16:27:37.515Z",
      "x_nadsec_last_seen": "2026-03-16T16:32:36.999Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "16223"
      ],
      "x_nadsec_orgs": [
        "Maxnet Telecom, Ltd"
      ]
    },
    {
      "created": "2026-03-16T17:05:22.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8402; asn_org=PVimpelCom",
      "id": "indicator--d52510c6-18b1-4ddd-9dc9-4d22a2f70d0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T17:05:22.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.26.71.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T17:05:22.000Z",
      "valid_until": "2026-04-17T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T16:41:08.436Z",
      "x_nadsec_last_seen": "2026-03-16T16:43:15.979Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8402"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-03-16T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7eae5d78-5233-4009-a91a-4189366eb4b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.122.17.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:05:03.000Z",
      "valid_until": "2026-04-17T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T18:01:48.504Z",
      "x_nadsec_last_seen": "2026-03-16T18:01:48.504Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-16T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=22616; asn_org=ZSCALER, INC.",
      "id": "indicator--a3f2f23d-e855-494b-b43a-3f4756b2ceeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '136.226.59.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:05:03.000Z",
      "valid_until": "2026-04-17T18:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-16T18:00:42.528Z",
      "x_nadsec_last_seen": "2026-03-16T19:16:12.725Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "22616"
      ],
      "x_nadsec_orgs": [
        "ZSCALER, INC."
      ]
    },
    {
      "created": "2026-03-16T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--50309375-5818-4498-8f9b-73d307d7bdff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.33.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:05:03.000Z",
      "valid_until": "2026-04-17T18:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-16T15:51:25.545Z",
      "x_nadsec_last_seen": "2026-03-16T18:01:26.958Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-16T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--0db1c5ca-ad0f-4610-bf9a-28a79d950f66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.97.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:05:03.000Z",
      "valid_until": "2026-04-17T18:05:01.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-03-16T17:18:33.760Z",
      "x_nadsec_last_seen": "2026-03-22T18:59:19.491Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-16T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bb7bcd65-039b-462a-a21e-52cd66dc3853",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.14.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:05:03.000Z",
      "valid_until": "2026-04-17T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T18:01:49.254Z",
      "x_nadsec_last_seen": "2026-03-16T18:01:49.254Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-16T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=IN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ba3c0a63-ef24-4189-bbb6-2da5c242558c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.158.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:05:03.000Z",
      "valid_until": "2026-04-17T18:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T17:35:55.248Z",
      "x_nadsec_last_seen": "2026-03-16T17:36:16.396Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-16T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a1d59d4a-76ae-4998-b19b-b1029de806e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.35.4.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:05:03.000Z",
      "valid_until": "2026-04-17T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T17:33:13.234Z",
      "x_nadsec_last_seen": "2026-03-16T17:33:24.511Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-16T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=264830; asn_org=Coop. de Luz y Fuerza Elect. Industria y Otros Serv. Publicos,Vivienda y Credito de Punta A",
      "id": "indicator--e18a08a4-bb0b-489b-8a2e-0c7fca068c35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.190.189.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:05:03.000Z",
      "valid_until": "2026-04-17T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T17:59:28.518Z",
      "x_nadsec_last_seen": "2026-03-16T18:01:35.811Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "264830"
      ],
      "x_nadsec_orgs": [
        "Coop. de Luz y Fuerza Elect. Industria y Otros Serv. Publicos,Vivienda y Credito de Punta A"
      ]
    },
    {
      "created": "2026-03-16T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--8b2f431c-b975-47b3-b933-1db6030c73d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.170.67.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:05:03.000Z",
      "valid_until": "2026-04-17T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T17:45:42.091Z",
      "x_nadsec_last_seen": "2026-03-16T17:45:42.091Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-16T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--89808108-275d-4e16-bda9-40fc01e15ff2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:05:03.000Z",
      "valid_until": "2026-04-17T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T17:36:38.156Z",
      "x_nadsec_last_seen": "2026-03-16T17:37:11.038Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-16T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5b9afecc-705e-4697-ba51-9c1241f49706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.46.226.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:05:03.000Z",
      "valid_until": "2026-04-17T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T17:57:36.661Z",
      "x_nadsec_last_seen": "2026-03-16T17:57:36.661Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-16T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=QA; asn=48728; asn_org=Vodafone Qatar P.Q.S.C",
      "id": "indicator--ae721394-2bbe-4eef-8788-4f7ec274da41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.70.114.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:05:03.000Z",
      "valid_until": "2026-04-17T18:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T18:04:01.054Z",
      "x_nadsec_last_seen": "2026-03-16T18:12:11.486Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "QA"
      ],
      "x_nadsec_asns": [
        "48728"
      ],
      "x_nadsec_orgs": [
        "Vodafone Qatar P.Q.S.C"
      ]
    },
    {
      "created": "2026-03-16T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=35516; asn_org=Rostelecom",
      "id": "indicator--bec263e5-f761-480b-be99-854961c018f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.240.249.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:05:03.000Z",
      "valid_until": "2026-04-17T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T17:53:35.775Z",
      "x_nadsec_last_seen": "2026-03-16T17:55:42.663Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "35516"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-16T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--effc7c63-71f1-452f-ac78-23af0cf6311c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:05:03.000Z",
      "valid_until": "2026-04-17T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T17:25:55.919Z",
      "x_nadsec_last_seen": "2026-03-25T01:15:28.507Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-16T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--dda0682e-d213-4c3d-8536-2d5ef0639123",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-16T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T18:05:03.000Z",
      "valid_until": "2026-04-17T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-16T17:25:59.838Z",
      "x_nadsec_last_seen": "2026-03-16T17:25:59.838Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-17T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--03aa2619-da1d-4866-8934-a335a5499ae1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.52.219.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:05:04.000Z",
      "valid_until": "2026-04-18T05:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-13T09:00:43.463Z",
      "x_nadsec_last_seen": "2026-03-17T04:11:09.706Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-17T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--743761a8-9d2e-470b-94e3-5e3d88f2b48d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.38.174.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:05:04.000Z",
      "valid_until": "2026-04-18T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T04:28:06.116Z",
      "x_nadsec_last_seen": "2026-03-17T04:30:14.011Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-17T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=9829; asn_org=National Internet Backbone; user(top)=**",
      "id": "indicator--e8a690a6-bbd1-4efb-8588-95492c8ced95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.216.143.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:05:04.000Z",
      "valid_until": "2026-04-18T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T04:50:02.889Z",
      "x_nadsec_last_seen": "2026-03-17T04:50:02.889Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-17T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--11780a7d-4f39-48c0-b3ba-81c2282e6d97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.26.204.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:05:04.000Z",
      "valid_until": "2026-04-18T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T04:47:49.992Z",
      "x_nadsec_last_seen": "2026-03-17T04:47:50.164Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-17T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3151; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--31e05ad7-f421-4f38-af6d-5c24d58c6a55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.166.12.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:05:04.000Z",
      "valid_until": "2026-04-18T05:05:01.000Z",
      "x_nadsec_event_count": 3151,
      "x_nadsec_first_seen": "2026-03-17T04:26:07.959Z",
      "x_nadsec_last_seen": "2026-03-17T04:55:01.095Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-17T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--f401aa20-3f85-4e5f-81f8-7f3c517da48e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.9.1.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:05:04.000Z",
      "valid_until": "2026-04-18T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T04:37:36.771Z",
      "x_nadsec_last_seen": "2026-03-17T04:37:36.771Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-03-17T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--6a2582b4-645d-4aa0-816d-41ca86033681",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.243.228.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:05:04.000Z",
      "valid_until": "2026-04-18T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T04:36:31.689Z",
      "x_nadsec_last_seen": "2026-03-17T04:43:44.966Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-17T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--ece9c92e-4318-4aa3-a039-d82d91381e62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.202.22.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:05:04.000Z",
      "valid_until": "2026-04-18T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T04:43:28.234Z",
      "x_nadsec_last_seen": "2026-03-17T04:45:34.450Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-03-17T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--8ebcd856-ecd2-40ff-aea2-d785a2053443",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:05:04.000Z",
      "valid_until": "2026-04-18T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T04:20:45.158Z",
      "x_nadsec_last_seen": "2026-03-17T04:20:45.158Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-03-17T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--412152e4-4a82-400c-85d7-8bbfc29b42d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.16.145.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:05:04.000Z",
      "valid_until": "2026-04-18T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T04:35:36.365Z",
      "x_nadsec_last_seen": "2026-03-17T04:37:43.410Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-03-17T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=28716; asn_org=Retelit Digital Services S.p.A.",
      "id": "indicator--8f203b22-8d0d-452b-b233-2da93dd93b35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.19.155.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:05:04.000Z",
      "valid_until": "2026-04-18T05:05:01.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-17T01:17:32.832Z",
      "x_nadsec_last_seen": "2026-03-17T04:27:31.893Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "28716"
      ],
      "x_nadsec_orgs": [
        "Retelit Digital Services S.p.A."
      ]
    },
    {
      "created": "2026-03-17T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia; user(top)=**",
      "id": "indicator--a7ba1e32-4298-49a3-957c-4d8cdd8870e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.92.240.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:05:04.000Z",
      "valid_until": "2026-04-18T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T05:04:31.424Z",
      "x_nadsec_last_seen": "2026-03-28T23:36:13.824Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-17T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b583c4ee-bb35-4dcc-be78-634042c9207f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.119.40.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:05:04.000Z",
      "valid_until": "2026-04-18T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T04:05:56.250Z",
      "x_nadsec_last_seen": "2026-03-17T04:06:06.568Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-17T05:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T05:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:05:04.000Z",
      "valid_until": "2026-04-18T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T05:04:18.914Z",
      "x_nadsec_last_seen": "2026-03-22T08:04:05.302Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-17T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=139533; asn_org=Onquee Networks Pvt Ltd.",
      "id": "indicator--7c0cc863-a56d-44d8-9098-30e3036ee882",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.147.99.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:05:02.000Z",
      "valid_until": "2026-04-18T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T05:20:53.798Z",
      "x_nadsec_last_seen": "2026-03-17T05:22:58.466Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "139533"
      ],
      "x_nadsec_orgs": [
        "Onquee Networks Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-17T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--0c571e02-68f9-4713-a4a6-3e737082155a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '107.150.105.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:05:02.000Z",
      "valid_until": "2026-04-18T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T05:46:24.827Z",
      "x_nadsec_last_seen": "2026-03-17T05:46:24.827Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-17T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=45773; asn_org=PERN AS Content Servie Provider, Islamabad, Pakistan",
      "id": "indicator--ec205d76-de42-4c96-9b65-a84f622f8d15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.68.111.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:05:02.000Z",
      "valid_until": "2026-04-18T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T05:21:43.039Z",
      "x_nadsec_last_seen": "2026-03-17T05:28:49.379Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "45773"
      ],
      "x_nadsec_orgs": [
        "PERN AS Content Servie Provider, Islamabad, Pakistan"
      ]
    },
    {
      "created": "2026-03-17T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--b8f629f2-795f-4c12-85c0-6a9c44f98160",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.102.69.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:05:02.000Z",
      "valid_until": "2026-04-18T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T05:48:23.460Z",
      "x_nadsec_last_seen": "2026-03-17T05:48:58.363Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-03-17T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=132199; asn_org=Globe Telecom Inc.",
      "id": "indicator--01c4dc4f-9873-4241-8dc9-b82ca12e49e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.28.110.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:05:02.000Z",
      "valid_until": "2026-04-18T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T05:27:28.362Z",
      "x_nadsec_last_seen": "2026-03-17T05:29:34.529Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "132199"
      ],
      "x_nadsec_orgs": [
        "Globe Telecom Inc."
      ]
    },
    {
      "created": "2026-03-17T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--a56f0ad6-c928-43b1-b712-831bd4a7155a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.224.230.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:05:02.000Z",
      "valid_until": "2026-04-18T06:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-17T05:37:29.165Z",
      "x_nadsec_last_seen": "2026-03-17T06:17:57.132Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-17T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--fcbe1fde-4d57-4d1f-9d82-dc3634663931",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.245.132.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:05:02.000Z",
      "valid_until": "2026-04-18T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T05:50:49.976Z",
      "x_nadsec_last_seen": "2026-03-17T05:55:23.584Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-17T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--396b97c5-bfb1-46c2-8d62-b7ad622e3ea6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.88.209.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:05:02.000Z",
      "valid_until": "2026-04-18T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T05:40:38.812Z",
      "x_nadsec_last_seen": "2026-03-17T05:47:00.059Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-17T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--c4583e3a-e93b-4f01-9589-2956f65addf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.55.95.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:05:02.000Z",
      "valid_until": "2026-04-18T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T06:02:59.386Z",
      "x_nadsec_last_seen": "2026-03-17T06:05:06.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-17T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--4265f576-a618-4620-a46f-6a6d34ee0a98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.145.216.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:05:02.000Z",
      "valid_until": "2026-04-18T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T05:41:20.310Z",
      "x_nadsec_last_seen": "2026-03-17T05:43:25.583Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-17T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--fe1c2b21-ca88-4225-af67-954bedf2d52f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.187.46.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:05:02.000Z",
      "valid_until": "2026-04-18T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T05:58:33.365Z",
      "x_nadsec_last_seen": "2026-03-17T05:58:36.442Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-17T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=21127; asn_org=Joint Stock Company TransTeleCom",
      "id": "indicator--1d7c62ae-66cc-45d5-991b-e36ddcbf8e76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.1.203.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:05:02.000Z",
      "valid_until": "2026-04-18T06:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-17T05:53:56.641Z",
      "x_nadsec_last_seen": "2026-03-20T16:04:15.279Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "21127"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company TransTeleCom"
      ]
    },
    {
      "created": "2026-03-17T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=JO; asn=35656; asn_org=Jordanian Universities Network L.L.C.",
      "id": "indicator--4ec5ed96-636f-4f48-b405-bb52be2ebbc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.232.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T06:05:02.000Z",
      "valid_until": "2026-04-18T06:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-17T05:32:54.408Z",
      "x_nadsec_last_seen": "2026-03-26T04:43:47.266Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "35656"
      ],
      "x_nadsec_orgs": [
        "Jordanian Universities Network L.L.C."
      ]
    },
    {
      "created": "2026-03-17T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45536; asn_org=Readylink Internet Services Limited",
      "id": "indicator--1d9ae13d-dafc-4883-969e-0bef612a50af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.21.79.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:05:02.000Z",
      "valid_until": "2026-04-18T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T06:39:48.632Z",
      "x_nadsec_last_seen": "2026-03-17T06:41:53.572Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45536"
      ],
      "x_nadsec_orgs": [
        "Readylink Internet Services Limited"
      ]
    },
    {
      "created": "2026-03-17T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--2238778b-ba5d-47a5-80b7-d7de69427d6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.70.185.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:05:02.000Z",
      "valid_until": "2026-04-18T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-17T06:13:24.604Z",
      "x_nadsec_last_seen": "2026-03-17T06:20:02.505Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-17T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3d09cd69-e475-4773-8822-ba4a8583fdb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.174.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:05:02.000Z",
      "valid_until": "2026-04-18T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T06:49:18.502Z",
      "x_nadsec_last_seen": "2026-03-17T06:55:42.725Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-17T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--a836b247-07a8-42c1-b0ff-c11f5800c5cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.183.48.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:05:02.000Z",
      "valid_until": "2026-04-18T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T06:52:45.603Z",
      "x_nadsec_last_seen": "2026-03-17T06:54:52.105Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-17T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=4780; asn_org=Digital United Inc.",
      "id": "indicator--b85fcbda-5b78-40b1-bca7-77e529aababf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '175.181.99.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:05:02.000Z",
      "valid_until": "2026-04-18T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T06:19:10.782Z",
      "x_nadsec_last_seen": "2026-03-17T06:21:15.500Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "4780"
      ],
      "x_nadsec_orgs": [
        "Digital United Inc."
      ]
    },
    {
      "created": "2026-03-17T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--48b82671-be0a-4d89-88f5-af4dabefec99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.5.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:05:02.000Z",
      "valid_until": "2026-04-18T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T06:51:43.621Z",
      "x_nadsec_last_seen": "2026-03-17T06:53:51.413Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-17T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KG; asn=207369; asn_org=Skynet Telecom, LLC",
      "id": "indicator--d0ff125d-256c-4ca9-b06b-43fe5c841ec1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.138.187.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:05:02.000Z",
      "valid_until": "2026-04-18T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T06:29:12.330Z",
      "x_nadsec_last_seen": "2026-03-17T06:31:19.838Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "207369"
      ],
      "x_nadsec_orgs": [
        "Skynet Telecom, LLC"
      ]
    },
    {
      "created": "2026-03-17T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--2f012bb8-c92a-4ba0-80f5-82c8a4cc0d45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.188.113.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:05:02.000Z",
      "valid_until": "2026-04-18T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T07:03:55.385Z",
      "x_nadsec_last_seen": "2026-03-17T07:06:03.207Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-17T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--3ce14e53-dff2-43cb-a9f3-4abfb63f97e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.220.211.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:05:02.000Z",
      "valid_until": "2026-04-18T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-17T06:29:36.928Z",
      "x_nadsec_last_seen": "2026-03-17T06:31:41.896Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-17T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--fb7c450c-3ce4-4969-893d-803135f254cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.78.50.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:05:02.000Z",
      "valid_until": "2026-04-18T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-17T07:01:25.508Z",
      "x_nadsec_last_seen": "2026-03-25T02:11:47.052Z",
      "x_nadsec_ports": [
        "445",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-17T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KH; asn=55769; asn_org=SOUTH EAST ASIA TELECOM Cambodia Co., LTD",
      "id": "indicator--2f0dbbbc-0c4a-46ae-bb0c-c4f4d8071f7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.250.238.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:05:02.000Z",
      "valid_until": "2026-04-18T07:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-16T18:29:24.508Z",
      "x_nadsec_last_seen": "2026-03-17T06:24:32.478Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KH"
      ],
      "x_nadsec_asns": [
        "55769"
      ],
      "x_nadsec_orgs": [
        "SOUTH EAST ASIA TELECOM Cambodia Co., LTD"
      ]
    },
    {
      "created": "2026-03-17T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--53aa4f96-7bff-43da-ae61-9ad34796d0b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.181.177.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:05:02.000Z",
      "valid_until": "2026-04-18T07:05:01.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-03-17T07:03:52.868Z",
      "x_nadsec_last_seen": "2026-03-17T07:07:29.186Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-03-17T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=32244; asn_org=Liquid Web, L.L.C; user(top)=c**n",
      "id": "indicator--34433231-b911-454f-9bd4-7829ec295c5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '67.227.251.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:05:02.000Z",
      "valid_until": "2026-04-18T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T06:33:16.489Z",
      "x_nadsec_last_seen": "2026-03-21T17:23:34.780Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "32244"
      ],
      "x_nadsec_orgs": [
        "Liquid Web, L.L.C"
      ],
      "x_nadsec_usernames_attempted": [
        "c**n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-17T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=GE; asn=35805; asn_org=JSC Silknet",
      "id": "indicator--abab84b2-6577-4f53-9466-62e8b0b12367",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.241.89.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:05:02.000Z",
      "valid_until": "2026-04-18T07:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-17T06:14:12.790Z",
      "x_nadsec_last_seen": "2026-03-17T06:35:48.066Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "35805"
      ],
      "x_nadsec_orgs": [
        "JSC Silknet"
      ]
    },
    {
      "created": "2026-03-17T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=136092; asn_org=PT DAYA AKSES NUSANTARA",
      "id": "indicator--dc5069ec-d60e-4997-b541-c415274556a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.87.60.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:05:03.000Z",
      "valid_until": "2026-04-18T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T08:04:06.027Z",
      "x_nadsec_last_seen": "2026-03-17T08:06:10.105Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "136092"
      ],
      "x_nadsec_orgs": [
        "PT DAYA AKSES NUSANTARA"
      ]
    },
    {
      "created": "2026-03-17T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--96396258-6fe7-4533-8b67-60e32433ff59",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.51.126.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:05:03.000Z",
      "valid_until": "2026-04-18T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T07:26:07.073Z",
      "x_nadsec_last_seen": "2026-03-17T07:28:12.695Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-03-17T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7602; asn_org=Sai gon Postel Corporation",
      "id": "indicator--aac4009d-5844-402d-ab45-b7f9e5b08497",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.118.119.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:05:03.000Z",
      "valid_until": "2026-04-18T08:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-17T07:38:48.557Z",
      "x_nadsec_last_seen": "2026-03-17T07:43:05.488Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7602"
      ],
      "x_nadsec_orgs": [
        "Sai gon Postel Corporation"
      ]
    },
    {
      "created": "2026-03-17T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=7602; asn_org=Sai gon Postel Corporation",
      "id": "indicator--4078c1de-46bf-4288-9830-db0bfbba0292",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.118.96.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:05:03.000Z",
      "valid_until": "2026-04-18T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T07:42:11.141Z",
      "x_nadsec_last_seen": "2026-03-17T07:42:11.141Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7602"
      ],
      "x_nadsec_orgs": [
        "Sai gon Postel Corporation"
      ]
    },
    {
      "created": "2026-03-17T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--97b253de-c983-43f9-a498-0c9035b442ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.69.203.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:05:03.000Z",
      "valid_until": "2026-04-18T08:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-13T02:03:54.219Z",
      "x_nadsec_last_seen": "2026-03-17T07:15:59.063Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-17T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--ea98b80b-65b4-4dcd-8fc9-8bb0e339a4c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.71.204.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:05:03.000Z",
      "valid_until": "2026-04-18T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T07:44:38.645Z",
      "x_nadsec_last_seen": "2026-03-17T07:44:44.883Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-17T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7a520020-60c6-472e-850f-630ebda6113b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.191.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:05:03.000Z",
      "valid_until": "2026-04-18T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T07:35:42.815Z",
      "x_nadsec_last_seen": "2026-03-17T07:35:42.815Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-17T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--0efb18e1-b84b-44db-9348-fcd457548bb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.16.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:05:03.000Z",
      "valid_until": "2026-04-18T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T07:35:21.539Z",
      "x_nadsec_last_seen": "2026-03-17T07:37:28.938Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-17T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--478e5af9-620f-4512-aa5b-e8943f79efab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:05:03.000Z",
      "valid_until": "2026-04-18T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T07:36:06.640Z",
      "x_nadsec_last_seen": "2026-03-17T07:36:06.640Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-17T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--f793a1c2-a61c-4c9b-8b11-122a3c2edaab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '218.166.196.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:05:03.000Z",
      "valid_until": "2026-04-18T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T07:16:21.674Z",
      "x_nadsec_last_seen": "2026-03-17T07:18:26.387Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-17T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--7138ee43-8c76-4c3d-91fa-72b8d06acd84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.38.126.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:05:03.000Z",
      "valid_until": "2026-04-18T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T07:38:20.809Z",
      "x_nadsec_last_seen": "2026-03-17T07:42:14.054Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-17T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=3326; asn_org=Private Joint Stock Company datagroup",
      "id": "indicator--d9a602e4-abd7-4a81-bdaf-213e138bcd56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.164.169.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:05:03.000Z",
      "valid_until": "2026-04-18T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T07:18:15.105Z",
      "x_nadsec_last_seen": "2026-03-17T07:25:58.808Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "3326"
      ],
      "x_nadsec_orgs": [
        "Private Joint Stock Company datagroup"
      ]
    },
    {
      "created": "2026-03-17T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--08092dca-c7b4-4a48-aded-2bf27ef4852a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.105.11.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:05:03.000Z",
      "valid_until": "2026-04-18T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T07:34:14.863Z",
      "x_nadsec_last_seen": "2026-03-17T09:34:55.481Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-17T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=133255; asn_org=Elxer Communications Private Limited",
      "id": "indicator--c4e9d811-e173-4acb-ae10-a8878a4f5cc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.84.131.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:05:02.000Z",
      "valid_until": "2026-04-18T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T08:08:22.621Z",
      "x_nadsec_last_seen": "2026-03-17T08:14:52.671Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133255"
      ],
      "x_nadsec_orgs": [
        "Elxer Communications Private Limited"
      ]
    },
    {
      "created": "2026-03-17T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--792236cb-53c6-4db3-b271-3449c6360270",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.183.63.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:05:02.000Z",
      "valid_until": "2026-04-18T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T08:47:22.234Z",
      "x_nadsec_last_seen": "2026-03-17T08:53:48.467Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-17T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a7e2f7ff-f7e9-4a8c-bc91-83392a40804c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.123.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:05:02.000Z",
      "valid_until": "2026-04-18T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T08:17:18.990Z",
      "x_nadsec_last_seen": "2026-03-17T08:17:19.791Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-17T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--8e33ba81-0c4a-422c-b41b-f9d393342c62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.38.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:05:02.000Z",
      "valid_until": "2026-04-18T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T08:49:11.383Z",
      "x_nadsec_last_seen": "2026-03-17T08:51:16.277Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-17T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--6ec86440-235d-4eef-afa5-b5c937a53221",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.182.2.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:05:02.000Z",
      "valid_until": "2026-04-18T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T08:32:47.597Z",
      "x_nadsec_last_seen": "2026-03-17T08:39:50.486Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-17T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--b706e1ab-d286-4931-926a-039cf66fa8e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.54.156.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:05:02.000Z",
      "valid_until": "2026-04-18T09:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-06T11:52:27.577Z",
      "x_nadsec_last_seen": "2026-03-17T08:52:43.063Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-03-17T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2986; services=smbd; ports=445; cc=PK; asn=23750; asn_org=GERRYS INFORMATION TECHNOLOGY PVT LTD.",
      "id": "indicator--bab7b57d-b1fd-4748-aee7-c525da56ec5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.69.59.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:05:02.000Z",
      "valid_until": "2026-04-18T09:05:01.000Z",
      "x_nadsec_event_count": 3148,
      "x_nadsec_first_seen": "2026-03-17T08:10:02.327Z",
      "x_nadsec_last_seen": "2026-03-17T09:07:25.040Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23750"
      ],
      "x_nadsec_orgs": [
        "GERRYS INFORMATION TECHNOLOGY PVT LTD."
      ]
    },
    {
      "created": "2026-03-17T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--e7977b96-f324-4b30-8099-4d5f42f2fe5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.187.41.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:05:02.000Z",
      "valid_until": "2026-04-18T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T08:59:13.620Z",
      "x_nadsec_last_seen": "2026-03-17T09:06:06.746Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--f466a736-e1d2-4cc9-bbb7-8b9048be08f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.55.164.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T10:03:37.782Z",
      "x_nadsec_last_seen": "2026-03-17T10:10:21.726Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--4109c600-f273-4008-bb8d-230a64adeaa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.103.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T10:00:40.764Z",
      "x_nadsec_last_seen": "2026-03-17T10:00:40.764Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135818; asn_org=Green Tech Net Com Pvt Ltd",
      "id": "indicator--9accf37c-764d-4a4e-a0bd-87f0b81fe97b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.78.12.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-17T09:23:57.586Z",
      "x_nadsec_last_seen": "2026-03-24T09:50:12.802Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135818"
      ],
      "x_nadsec_orgs": [
        "Green Tech Net Com Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3bb6a3ae-c200-4a82-9040-79ba4d3ed414",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.181.78.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T09:56:15.934Z",
      "x_nadsec_last_seen": "2026-03-17T09:58:20.735Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=132165; asn_org=Connect Communications",
      "id": "indicator--ee60d5d2-032d-4ecf-8f18-ff406a530179",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.203.205.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T09:24:11.395Z",
      "x_nadsec_last_seen": "2026-03-17T09:26:18.628Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "132165"
      ],
      "x_nadsec_orgs": [
        "Connect Communications"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--9e6af3dd-e069-40ca-a8d6-11703375f034",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.108.128.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T09:55:50.484Z",
      "x_nadsec_last_seen": "2026-03-17T09:55:50.538Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--a6916193-bf3f-48ce-98f3-f909f4425d82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.123.171.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T10:04:25.242Z",
      "x_nadsec_last_seen": "2026-03-17T10:08:36.841Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d8098008-b66d-4482-a599-a8175285a8a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.64.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T09:28:40.589Z",
      "x_nadsec_last_seen": "2026-03-17T09:28:45.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--c138dc48-c86c-4dd5-99d0-04e5c407adf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.188.29.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T09:52:16.177Z",
      "x_nadsec_last_seen": "2026-03-17T09:54:22.279Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--f93cae81-050a-4ad6-a923-cf89367dd344",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.162.239.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T09:16:06.183Z",
      "x_nadsec_last_seen": "2026-03-17T09:18:14.071Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--e590f168-8421-471f-bb23-e27b140f5051",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.95.23.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-17T09:21:25.138Z",
      "x_nadsec_last_seen": "2026-03-17T09:22:30.551Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=12297; asn_org=Telecom Armenia OJSC",
      "id": "indicator--211af979-931f-41d8-881a-5455acdcea5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.73.87.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T09:11:37.938Z",
      "x_nadsec_last_seen": "2026-03-17T09:11:46.755Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "12297"
      ],
      "x_nadsec_orgs": [
        "Telecom Armenia OJSC"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--d906abc2-5101-489e-83e0-8cfdf40c38f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-17T09:57:08.163Z",
      "x_nadsec_last_seen": "2026-03-17T09:58:02.605Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--037bd19d-935e-44cf-8edc-ba598a60961b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.114.37.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T09:58:05.187Z",
      "x_nadsec_last_seen": "2026-03-17T10:02:56.784Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BG; asn=212652; asn_org=Boramax ltd",
      "id": "indicator--b74bc249-701e-454b-9225-4dea5d844bb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.213.208.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-17T09:40:01.303Z",
      "x_nadsec_last_seen": "2026-03-20T20:40:33.287Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "212652"
      ],
      "x_nadsec_orgs": [
        "Boramax ltd"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=57808; asn_org=SAT-DV LLC",
      "id": "indicator--6073fe45-7159-4fce-a87c-d96aaa2f1ca3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.235.147.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T09:18:05.665Z",
      "x_nadsec_last_seen": "2026-03-17T09:20:16.060Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57808"
      ],
      "x_nadsec_orgs": [
        "SAT-DV LLC"
      ]
    },
    {
      "created": "2026-03-17T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=48524; asn_org=INTERRA telecommunications group, Ltd.",
      "id": "indicator--414bd078-d019-463e-886c-706af1e14706",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.190.68.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:05:03.000Z",
      "valid_until": "2026-04-18T10:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-17T09:26:26.464Z",
      "x_nadsec_last_seen": "2026-03-23T22:42:00.456Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48524"
      ],
      "x_nadsec_orgs": [
        "INTERRA telecommunications group, Ltd."
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=58725; asn_org=ZYE TELECOM PVT LTD",
      "id": "indicator--26ba8f38-a3fe-4a4c-87ed-6db8e8fb3ad2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.12.119.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T10:10:30.250Z",
      "x_nadsec_last_seen": "2026-03-17T10:12:35.409Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "58725"
      ],
      "x_nadsec_orgs": [
        "ZYE TELECOM PVT LTD"
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--0f3eeacc-8584-4051-9e25-6ed56a9e6aed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.47.113.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T10:23:18.335Z",
      "x_nadsec_last_seen": "2026-03-17T10:25:23.669Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--5395d067-1d1d-4a60-97fc-82905ea6552d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.182.31.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T10:06:33.616Z",
      "x_nadsec_last_seen": "2026-03-17T10:06:33.800Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--7ec5d669-5629-4b30-ab34-3bdfcd64fcf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.210.120.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T10:19:01.646Z",
      "x_nadsec_last_seen": "2026-03-17T10:19:08.733Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--cfadc74a-9725-4251-81f6-f5bf570d3dab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.46.129.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 3110,
      "x_nadsec_first_seen": "2026-03-17T10:23:18.906Z",
      "x_nadsec_last_seen": "2026-03-17T13:48:53.679Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--a3bf3b3e-18c3-4ccf-9282-2ea996af90e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.82.146.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T10:43:01.562Z",
      "x_nadsec_last_seen": "2026-03-17T10:45:07.320Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6dabc999-3e85-481f-b61e-21484d046470",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.166.241.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-17T10:43:34.816Z",
      "x_nadsec_last_seen": "2026-03-22T18:15:16.399Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--0444e682-5311-4995-91b8-9218f315847b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.216.195.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-17T10:16:09.708Z",
      "x_nadsec_last_seen": "2026-03-30T18:56:09.965Z",
      "x_nadsec_ports": [
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--f32cce86-f57c-4892-b60d-d293cea22e7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.69.163.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T10:48:21.314Z",
      "x_nadsec_last_seen": "2026-03-17T10:48:21.538Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--8f4219d2-4ea2-4164-85ea-4a639da44db3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.38.148.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T10:57:09.604Z",
      "x_nadsec_last_seen": "2026-03-17T11:03:43.865Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--47a16119-fb6c-4ab6-842a-247316e74d1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T10:17:25.653Z",
      "x_nadsec_last_seen": "2026-03-18T02:29:52.115Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--38ec0345-51da-4144-9816-545b366fb01a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T10:29:13.650Z",
      "x_nadsec_last_seen": "2026-03-25T08:06:50.045Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--42a5cbd0-afda-45f0-88c6-3ea95d1413d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '68.183.238.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T11:04:12.434Z",
      "x_nadsec_last_seen": "2026-03-22T08:58:04.599Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RO; asn=204428; asn_org=SS-Net",
      "id": "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-17T10:44:54.857Z",
      "x_nadsec_last_seen": "2026-03-25T10:10:33.408Z",
      "x_nadsec_ports": [
        "135",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "204428"
      ],
      "x_nadsec_orgs": [
        "SS-Net"
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SE; asn=12552; asn_org=GlobalConnect AB",
      "id": "indicator--c541c4de-66c7-44e4-91c4-2921d957db0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.241.171.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T10:50:46.166Z",
      "x_nadsec_last_seen": "2026-03-17T10:52:52.628Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "12552"
      ],
      "x_nadsec_orgs": [
        "GlobalConnect AB"
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--4772237a-fa28-40e1-8393-24e4b4858a78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.57.248.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T10:50:11.856Z",
      "x_nadsec_last_seen": "2026-03-17T10:52:18.578Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-03-17T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=35104; asn_org=Jusan Mobile JSC",
      "id": "indicator--758901ab-e371-41d5-b6be-312aa454941d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.141.130.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:05:03.000Z",
      "valid_until": "2026-04-18T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T10:41:01.115Z",
      "x_nadsec_last_seen": "2026-03-17T10:43:08.664Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "35104"
      ],
      "x_nadsec_orgs": [
        "Jusan Mobile JSC"
      ]
    },
    {
      "created": "2026-03-17T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--80603f3b-aac9-4d9d-a675-6a69f27d448c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.160.233.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:05:02.000Z",
      "valid_until": "2026-04-18T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T11:19:23.834Z",
      "x_nadsec_last_seen": "2026-03-17T11:24:27.920Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-17T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1de5332b-ee3d-447e-bc48-caeac9dac626",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.164.197.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:05:02.000Z",
      "valid_until": "2026-04-18T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T11:49:23.388Z",
      "x_nadsec_last_seen": "2026-03-17T11:55:56.427Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-17T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--797e9093-73cd-4a49-b740-24eee5321225",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.97.191.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:05:02.000Z",
      "valid_until": "2026-04-18T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T11:19:35.150Z",
      "x_nadsec_last_seen": "2026-03-17T11:19:35.150Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-17T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--6578d392-6e60-43ec-bcc4-e6997287bdd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.185.107.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:05:02.000Z",
      "valid_until": "2026-04-18T12:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-17T11:32:34.273Z",
      "x_nadsec_last_seen": "2026-03-17T11:35:25.720Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-17T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--7a7203c3-ca70-4420-90bc-4b2d7e3fb1e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.144.28.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:05:02.000Z",
      "valid_until": "2026-04-18T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T11:19:35.932Z",
      "x_nadsec_last_seen": "2026-03-17T11:19:35.932Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-17T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--93bd5faf-c0fd-4320-b349-d452d8070791",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.82.78.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:05:02.000Z",
      "valid_until": "2026-04-18T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T11:08:03.204Z",
      "x_nadsec_last_seen": "2026-03-17T11:14:30.406Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-03-17T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--e1ce5c37-41ad-49bc-b6a2-ae2a6f61fac2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.96.151.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:05:02.000Z",
      "valid_until": "2026-04-18T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T11:26:04.674Z",
      "x_nadsec_last_seen": "2026-03-17T11:26:10.123Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-17T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--c4297078-22c9-45ee-8bab-97a581b55562",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.188.118.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:05:02.000Z",
      "valid_until": "2026-04-18T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T11:26:04.406Z",
      "x_nadsec_last_seen": "2026-03-17T11:26:08.978Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-17T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=28573; asn_org=Claro NXT Telecomunicacoes Ltda",
      "id": "indicator--8b4a70ae-2ced-40cd-a91a-59bee9f817ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.185.193.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:05:02.000Z",
      "valid_until": "2026-04-18T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T11:33:06.375Z",
      "x_nadsec_last_seen": "2026-03-23T07:40:25.242Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28573"
      ],
      "x_nadsec_orgs": [
        "Claro NXT Telecomunicacoes Ltda"
      ]
    },
    {
      "created": "2026-03-17T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=10834; asn_org=Telefonica de Argentina",
      "id": "indicator--e562fe8d-b1e0-4f0a-92dc-6955a16d0440",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.32.59.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:05:02.000Z",
      "valid_until": "2026-04-18T12:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-17T11:12:23.316Z",
      "x_nadsec_last_seen": "2026-03-23T18:32:38.204Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "10834"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-17T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=SV; asn=26617; asn_org=Navega.com S.A.",
      "id": "indicator--460c1652-d892-47a4-8fcc-9b25af8b1aa6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.35.189.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:05:02.000Z",
      "valid_until": "2026-04-18T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T11:09:00.229Z",
      "x_nadsec_last_seen": "2026-03-17T11:16:04.021Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SV"
      ],
      "x_nadsec_asns": [
        "26617"
      ],
      "x_nadsec_orgs": [
        "Navega.com S.A."
      ]
    },
    {
      "created": "2026-03-17T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=17622; asn_org=China Unicom Guangzhou network",
      "id": "indicator--0143124b-8319-42c2-93b1-e1138b3cc893",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.47.24.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:05:02.000Z",
      "valid_until": "2026-04-18T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T11:19:16.078Z",
      "x_nadsec_last_seen": "2026-03-17T11:19:16.078Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "17622"
      ],
      "x_nadsec_orgs": [
        "China Unicom Guangzhou network"
      ]
    },
    {
      "created": "2026-03-17T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=269795; asn_org=MLV SA",
      "id": "indicator--e0c30055-60a1-4ba0-99ca-5a2ebfda29b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.184.230.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:05:02.000Z",
      "valid_until": "2026-04-18T12:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-17T11:44:02.870Z",
      "x_nadsec_last_seen": "2026-03-17T13:44:34.711Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "269795"
      ],
      "x_nadsec_orgs": [
        "MLV SA"
      ]
    },
    {
      "created": "2026-03-17T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e6df7f43-b22a-4bf6-ac75-9c796d822cf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.180.146.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:05:02.000Z",
      "valid_until": "2026-04-18T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T11:37:26.336Z",
      "x_nadsec_last_seen": "2026-03-17T11:37:26.336Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-17T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--bd8bfaf3-cf8f-41eb-b898-09427d4a1922",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:05:02.000Z",
      "valid_until": "2026-04-18T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T11:54:16.588Z",
      "x_nadsec_last_seen": "2026-03-17T11:54:16.588Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-17T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=138754; asn_org=Kerala Vision Broad Band Private Limited",
      "id": "indicator--9807f87c-97c7-4cd4-a6ae-fb556ed3c007",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.178.205.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:05:03.000Z",
      "valid_until": "2026-04-18T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T12:44:25.472Z",
      "x_nadsec_last_seen": "2026-03-17T12:46:30.626Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138754"
      ],
      "x_nadsec_orgs": [
        "Kerala Vision Broad Band Private Limited"
      ]
    },
    {
      "created": "2026-03-17T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--0ffb0408-9aeb-4a5f-99a5-f5d10c4ba8c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.222.217.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:05:03.000Z",
      "valid_until": "2026-04-18T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T12:33:31.868Z",
      "x_nadsec_last_seen": "2026-03-17T12:40:32.249Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-17T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--590c3503-c2f1-4e33-ae47-7c92a387b1d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.58.227.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:05:03.000Z",
      "valid_until": "2026-04-18T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T12:11:01.501Z",
      "x_nadsec_last_seen": "2026-03-17T12:17:17.835Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-03-17T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--45aa392a-70b7-420a-aab6-8445be6bc8d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.59.72.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:05:03.000Z",
      "valid_until": "2026-04-18T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T12:42:50.404Z",
      "x_nadsec_last_seen": "2026-03-17T12:44:57.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-03-17T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--6bc0c74c-f8de-4700-9335-34e9ac8ce69d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.242.254.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:05:03.000Z",
      "valid_until": "2026-04-18T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T12:09:01.457Z",
      "x_nadsec_last_seen": "2026-03-17T12:11:07.871Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-17T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--0339ae06-874e-4db1-8e96-7cd93ee36520",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:05:03.000Z",
      "valid_until": "2026-04-18T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T12:57:45.755Z",
      "x_nadsec_last_seen": "2026-03-20T15:32:35.343Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-17T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c4d757f5-fecb-4090-91fa-9e264b708eb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.29.24.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:05:03.000Z",
      "valid_until": "2026-04-18T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T12:21:11.228Z",
      "x_nadsec_last_seen": "2026-03-17T12:21:11.586Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-17T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--bb6713e7-c527-4d54-89eb-0dbfb988eeae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.248.167.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:05:03.000Z",
      "valid_until": "2026-04-18T13:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-13T07:20:40.790Z",
      "x_nadsec_last_seen": "2026-03-17T12:19:53.146Z",
      "x_nadsec_ports": [
        "1433",
        "445"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-17T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=25513; asn_org=PJSC Moscow city telephone network",
      "id": "indicator--e0554651-be8f-47da-94ed-c8e8b01d9883",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.29.124.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T13:05:03.000Z",
      "valid_until": "2026-04-18T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T12:51:51.469Z",
      "x_nadsec_last_seen": "2026-03-17T12:58:22.688Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25513"
      ],
      "x_nadsec_orgs": [
        "PJSC Moscow city telephone network"
      ]
    },
    {
      "created": "2026-03-17T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=196949; asn_org=Natalia Sergeevna Filicheva",
      "id": "indicator--73881ec3-76bf-4abd-ae39-b9b8b0e92dbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.110.35.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:05:03.000Z",
      "valid_until": "2026-04-18T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T13:25:54.636Z",
      "x_nadsec_last_seen": "2026-03-17T13:25:54.766Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "196949"
      ],
      "x_nadsec_orgs": [
        "Natalia Sergeevna Filicheva"
      ]
    },
    {
      "created": "2026-03-17T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SG; asn=26496; asn_org=GoDaddy.com, LLC",
      "id": "indicator--084c83a3-ecb5-44c4-b7ca-acb04b55c985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.66.133.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:05:03.000Z",
      "valid_until": "2026-04-18T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T14:01:38.981Z",
      "x_nadsec_last_seen": "2026-03-17T14:01:38.981Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "26496"
      ],
      "x_nadsec_orgs": [
        "GoDaddy.com, LLC"
      ]
    },
    {
      "created": "2026-03-17T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--61d0d381-5cc5-4d8c-a4c5-be32e23011d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:05:03.000Z",
      "valid_until": "2026-04-18T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T13:34:13.349Z",
      "x_nadsec_last_seen": "2026-03-17T23:31:37.592Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-17T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--b9223952-0523-47be-9ccc-269d37b1b43a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.176.176.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:05:03.000Z",
      "valid_until": "2026-04-18T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T13:10:40.991Z",
      "x_nadsec_last_seen": "2026-03-17T13:12:48.072Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-17T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CO; asn=27837; asn_org=Dialnet de Colombia S.A. E.S.P.",
      "id": "indicator--2e6c9e44-af79-424d-9cff-cd1f975d8ce1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.1.174.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:05:03.000Z",
      "valid_until": "2026-04-18T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-17T13:17:44.211Z",
      "x_nadsec_last_seen": "2026-03-17T13:17:48.826Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "27837"
      ],
      "x_nadsec_orgs": [
        "Dialnet de Colombia S.A. E.S.P."
      ]
    },
    {
      "created": "2026-03-17T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=28186; asn_org=ITS TELECOMUNICACOES LTDA",
      "id": "indicator--5e6c6f09-f510-4c77-9021-9110b5c51f9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.44.227.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:05:03.000Z",
      "valid_until": "2026-04-18T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T13:25:57.579Z",
      "x_nadsec_last_seen": "2026-03-17T13:33:04.232Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28186"
      ],
      "x_nadsec_orgs": [
        "ITS TELECOMUNICACOES LTDA"
      ]
    },
    {
      "created": "2026-03-17T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=262773; asn_org=PROXXIMA TELECOMUNICACOES SA",
      "id": "indicator--aba4c110-9d34-41d5-979b-4bbf4222017b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.95.236.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:05:03.000Z",
      "valid_until": "2026-04-18T14:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-17T13:11:04.087Z",
      "x_nadsec_last_seen": "2026-03-17T18:52:51.702Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262773"
      ],
      "x_nadsec_orgs": [
        "PROXXIMA TELECOMUNICACOES SA"
      ]
    },
    {
      "created": "2026-03-17T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--5c8af818-2bdc-456f-912b-734815a760fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.206.75.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:05:03.000Z",
      "valid_until": "2026-04-18T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T13:15:07.233Z",
      "x_nadsec_last_seen": "2026-03-17T13:17:11.776Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-17T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:05:03.000Z",
      "valid_until": "2026-04-18T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T13:26:39.114Z",
      "x_nadsec_last_seen": "2026-03-17T13:26:39.114Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-17T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--5abda58d-b8a6-44f1-87c3-480d157957e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:05:03.000Z",
      "valid_until": "2026-04-18T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-17T13:33:35.437Z",
      "x_nadsec_last_seen": "2026-03-25T22:01:27.823Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-17T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RO; asn=34060; asn_org=Sc Telecomunicatii Cfr SA",
      "id": "indicator--fb874416-6335-4549-8800-6902b08ad519",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.181.81.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:05:03.000Z",
      "valid_until": "2026-04-18T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T13:45:13.694Z",
      "x_nadsec_last_seen": "2026-03-17T13:52:05.541Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "34060"
      ],
      "x_nadsec_orgs": [
        "Sc Telecomunicatii Cfr SA"
      ]
    },
    {
      "created": "2026-03-17T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BD; asn=152729; asn_org=Ha- Meem Denim Limited",
      "id": "indicator--0bbbf644-61ba-4612-8940-97f1f479a53c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.57.149.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:05:04.000Z",
      "valid_until": "2026-04-18T15:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-17T14:20:33.554Z",
      "x_nadsec_last_seen": "2026-03-17T14:22:37.464Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "152729"
      ],
      "x_nadsec_orgs": [
        "Ha- Meem Denim Limited"
      ]
    },
    {
      "created": "2026-03-17T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--041fcbb1-77ae-4b8c-8584-b0c6e405b90d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.164.64.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:05:04.000Z",
      "valid_until": "2026-04-18T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T14:14:10.742Z",
      "x_nadsec_last_seen": "2026-03-17T14:14:10.861Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-17T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=NL; asn=202412; asn_org=Omegatech LTD",
      "id": "indicator--564c478d-592c-4657-a37f-86552a17acd1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:05:04.000Z",
      "valid_until": "2026-04-18T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T14:06:02.654Z",
      "x_nadsec_last_seen": "2026-03-17T14:06:02.729Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202412"
      ],
      "x_nadsec_orgs": [
        "Omegatech LTD"
      ]
    },
    {
      "created": "2026-03-17T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--0d3acda3-cb8f-42f0-b679-d07fe7ca4f6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '144.172.103.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:05:04.000Z",
      "valid_until": "2026-04-18T15:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T14:20:51.311Z",
      "x_nadsec_last_seen": "2026-03-17T14:27:18.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-03-17T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=51004; asn_org=Sakhalin Cable Telesystems Ltd",
      "id": "indicator--08767915-557f-46c6-80b7-85378c2d4cf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.113.150.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:05:04.000Z",
      "valid_until": "2026-04-18T15:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T14:40:27.763Z",
      "x_nadsec_last_seen": "2026-03-17T14:47:40.178Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "51004"
      ],
      "x_nadsec_orgs": [
        "Sakhalin Cable Telesystems Ltd"
      ]
    },
    {
      "created": "2026-03-17T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--6d33d6e6-3fe7-4d63-8fa4-62ba6ab1537f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:05:04.000Z",
      "valid_until": "2026-04-18T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T14:52:31.323Z",
      "x_nadsec_last_seen": "2026-03-17T14:52:31.323Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-17T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--47e2a0e1-1286-42ed-a2d6-6f346ef20c7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:05:04.000Z",
      "valid_until": "2026-04-18T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T14:52:31.005Z",
      "x_nadsec_last_seen": "2026-03-17T14:52:31.005Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-17T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--c544a97d-1692-475a-91d9-2298264ad385",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.246.33.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:05:04.000Z",
      "valid_until": "2026-04-18T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T14:28:24.066Z",
      "x_nadsec_last_seen": "2026-03-17T14:28:24.234Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-17T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--fa35c074-c080-43de-8a98-988ab5f7056b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:05:04.000Z",
      "valid_until": "2026-04-18T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T14:40:51.159Z",
      "x_nadsec_last_seen": "2026-03-17T14:40:51.159Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-17T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=41055; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--dbaa7224-020b-4a7e-80ca-1f08d69eeb3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:05:04.000Z",
      "valid_until": "2026-04-18T15:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-17T14:21:52.778Z",
      "x_nadsec_last_seen": "2026-03-24T05:50:07.755Z",
      "x_nadsec_ports": [
        "42",
        "1433",
        "41055"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-17T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--15b07647-c025-4186-ae53-ea42f530b1d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:05:04.000Z",
      "valid_until": "2026-04-18T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T14:30:10.776Z",
      "x_nadsec_last_seen": "2026-03-17T14:30:10.776Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-17T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=37457; asn_org=Telkom-Internet",
      "id": "indicator--4d3a1b4d-4a37-4e4c-9e5e-b7280dc774a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.184.226.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T16:05:03.000Z",
      "valid_until": "2026-04-18T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T15:10:33.463Z",
      "x_nadsec_last_seen": "2026-03-17T15:12:41.578Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37457"
      ],
      "x_nadsec_orgs": [
        "Telkom-Internet"
      ]
    },
    {
      "created": "2026-03-17T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--ccd441e9-bbfc-4d94-8dff-d8bb7ad2f06c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.23.41.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T16:05:03.000Z",
      "valid_until": "2026-04-18T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T15:59:10.350Z",
      "x_nadsec_last_seen": "2026-03-17T16:01:15.978Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-17T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; user(top)=**",
      "id": "indicator--43330a85-731a-430b-9941-f7c8337cb247",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.59.114.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T16:05:03.000Z",
      "valid_until": "2026-04-18T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T15:51:46.027Z",
      "x_nadsec_last_seen": "2026-03-17T15:51:46.027Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-17T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=52705; asn_org=FRANET TELECOM; user(top)=**",
      "id": "indicator--c472a44e-e3fd-44d4-ba74-6cfefba06375",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '168.228.236.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T16:05:03.000Z",
      "valid_until": "2026-04-18T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T16:03:31.364Z",
      "x_nadsec_last_seen": "2026-03-17T16:03:31.364Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52705"
      ],
      "x_nadsec_orgs": [
        "FRANET TELECOM"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-17T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=205424; asn_org=Ulunet Internet ve Iletisim Hizmetleri San. ve Tic. Ltd. Sti.",
      "id": "indicator--d0965925-a449-40ed-ae09-4fa6ac7fb451",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.51.38.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T16:05:03.000Z",
      "valid_until": "2026-04-18T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T15:29:50.882Z",
      "x_nadsec_last_seen": "2026-03-17T15:31:57.383Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "205424"
      ],
      "x_nadsec_orgs": [
        "Ulunet Internet ve Iletisim Hizmetleri San. ve Tic. Ltd. Sti."
      ]
    },
    {
      "created": "2026-03-17T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=47236; asn_org=CityLink Ltd",
      "id": "indicator--77800885-fbc4-448f-aa93-68b098fd0def",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.90.101.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T16:05:03.000Z",
      "valid_until": "2026-04-18T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T15:27:00.417Z",
      "x_nadsec_last_seen": "2026-03-17T15:29:06.391Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "47236"
      ],
      "x_nadsec_orgs": [
        "CityLink Ltd"
      ]
    },
    {
      "created": "2026-03-17T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=GB; asn=2856; asn_org=British Telecommunications PLC",
      "id": "indicator--3a389170-2d2f-46b6-8299-fc2b9e19281a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.32.243.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T16:05:03.000Z",
      "valid_until": "2026-04-18T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T15:31:16.291Z",
      "x_nadsec_last_seen": "2026-03-17T15:31:16.571Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "2856"
      ],
      "x_nadsec_orgs": [
        "British Telecommunications PLC"
      ]
    },
    {
      "created": "2026-03-17T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--ec522969-2c10-4fc4-8252-d4142e29665a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.226.217.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T16:05:03.000Z",
      "valid_until": "2026-04-18T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T15:14:15.246Z",
      "x_nadsec_last_seen": "2026-03-17T15:16:22.498Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-17T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134929; asn_org=ORANGE CITY INTERNET SERVICES PVT. LTD.",
      "id": "indicator--2f6b27d2-c93e-4f4e-940d-bbed15c9d9f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.1.119.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T17:05:09.000Z",
      "valid_until": "2026-04-18T17:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-17T16:24:48.757Z",
      "x_nadsec_last_seen": "2026-03-22T15:21:32.266Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134929"
      ],
      "x_nadsec_orgs": [
        "ORANGE CITY INTERNET SERVICES PVT. LTD."
      ]
    },
    {
      "created": "2026-03-17T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T17:05:09.000Z",
      "valid_until": "2026-04-18T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T16:59:17.294Z",
      "x_nadsec_last_seen": "2026-03-17T16:59:17.294Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-17T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--68c62d3a-5f5f-4480-9258-ee069450fa84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.147.171.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T17:05:09.000Z",
      "valid_until": "2026-04-18T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T16:13:48.374Z",
      "x_nadsec_last_seen": "2026-03-17T16:13:57.006Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-17T17:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--eda8f56c-2e9f-4ea1-a7de-2515c795520e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T17:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.49.72.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T17:05:09.000Z",
      "valid_until": "2026-04-18T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T16:40:18.286Z",
      "x_nadsec_last_seen": "2026-03-17T16:42:22.668Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-03-17T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--5e7dc920-ff16-4a15-ad09-7e35ecc0d4a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.183.227.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:05:03.000Z",
      "valid_until": "2026-04-18T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T17:16:41.747Z",
      "x_nadsec_last_seen": "2026-03-17T17:18:46.729Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-03-17T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e1b4948a-51a0-4db3-8fc0-4629cd52f3bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.26.67.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:05:03.000Z",
      "valid_until": "2026-04-18T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T17:49:50.722Z",
      "x_nadsec_last_seen": "2026-03-17T17:51:55.321Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-17T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--789f8776-46e0-43f2-b494-098c85bdab3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.18.84.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:05:03.000Z",
      "valid_until": "2026-04-18T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T17:31:28.678Z",
      "x_nadsec_last_seen": "2026-03-17T17:33:33.255Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-17T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fef1023a-c242-4497-a2a5-5a3529a818b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.205.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:05:03.000Z",
      "valid_until": "2026-04-18T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T17:38:52.362Z",
      "x_nadsec_last_seen": "2026-03-17T17:40:57.083Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-17T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--56945d45-42e6-4288-92b5-710b2817ecb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:05:03.000Z",
      "valid_until": "2026-04-18T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T17:16:17.879Z",
      "x_nadsec_last_seen": "2026-03-17T17:16:17.879Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-17T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=265204; asn_org=LINKFIRE TELECOM LTDA",
      "id": "indicator--8cfa98f0-413b-4b09-bf8a-f497b1017bd2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.250.66.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:05:03.000Z",
      "valid_until": "2026-04-18T18:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T17:43:21.049Z",
      "x_nadsec_last_seen": "2026-03-17T17:50:58.619Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "265204"
      ],
      "x_nadsec_orgs": [
        "LINKFIRE TELECOM LTDA"
      ]
    },
    {
      "created": "2026-03-17T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--50418bf3-35f9-4435-957c-c95224863d5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.150.12.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:05:03.000Z",
      "valid_until": "2026-04-18T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T17:32:13.539Z",
      "x_nadsec_last_seen": "2026-03-17T17:32:13.539Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-17T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--b811b332-8016-4f6a-bac8-11e70d1d88ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.37.80.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:05:03.000Z",
      "valid_until": "2026-04-18T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T17:09:57.006Z",
      "x_nadsec_last_seen": "2026-03-17T17:12:03.983Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-03-17T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fdd555ff-7c3c-4267-8835-d47c507e5645",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:05:03.000Z",
      "valid_until": "2026-04-18T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T17:38:26.905Z",
      "x_nadsec_last_seen": "2026-03-17T17:38:26.905Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-17T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=196949; asn_org=Natalia Sergeevna Filicheva",
      "id": "indicator--9ded847d-e8ad-4370-a957-593949963fca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.150.75.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:05:03.000Z",
      "valid_until": "2026-04-18T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T17:49:30.205Z",
      "x_nadsec_last_seen": "2026-03-17T17:51:38.689Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "196949"
      ],
      "x_nadsec_orgs": [
        "Natalia Sergeevna Filicheva"
      ]
    },
    {
      "created": "2026-03-17T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17665; asn_org=ONEOTT INTERTAINMENT LIMITED",
      "id": "indicator--772096a9-5b49-4623-b5f2-132f04ff8fc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.118.104.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:05:03.000Z",
      "valid_until": "2026-04-18T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T17:18:54.893Z",
      "x_nadsec_last_seen": "2026-03-17T17:20:59.899Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17665"
      ],
      "x_nadsec_orgs": [
        "ONEOTT INTERTAINMENT LIMITED"
      ]
    },
    {
      "created": "2026-03-17T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--2ac8a35e-49e7-4d7f-881d-c0933e2c54d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.39.12.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:05:03.000Z",
      "valid_until": "2026-04-18T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T17:23:33.213Z",
      "x_nadsec_last_seen": "2026-03-17T17:23:33.213Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-03-17T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--ba4c4d04-64d9-4358-b608-b6d5f8987af0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.186.58.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T18:05:03.000Z",
      "valid_until": "2026-04-18T18:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-17T17:12:16.643Z",
      "x_nadsec_last_seen": "2026-03-27T18:36:49.009Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-17T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1c659db0-865a-4358-9ffc-58b2836ce2e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.240.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:05:03.000Z",
      "valid_until": "2026-04-18T19:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T19:00:11.015Z",
      "x_nadsec_last_seen": "2026-03-17T19:07:22.945Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-17T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--c6b1d61a-39db-4488-b176-42c40c0651cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.96.47.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:05:03.000Z",
      "valid_until": "2026-04-18T19:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T18:29:49.572Z",
      "x_nadsec_last_seen": "2026-03-17T18:36:25.503Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-17T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--7d9835c7-ff1e-4a30-b343-24e213c60012",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.233.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:05:03.000Z",
      "valid_until": "2026-04-18T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T18:16:04.996Z",
      "x_nadsec_last_seen": "2026-03-17T18:16:34.029Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-17T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=21713; asn_org=Bulloch County Rural Telephone Cooperative, Inc.",
      "id": "indicator--174d308b-c5a5-4c54-9fcf-1962084ec3ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.172.77.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:05:03.000Z",
      "valid_until": "2026-04-18T19:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T18:26:02.155Z",
      "x_nadsec_last_seen": "2026-03-17T18:32:49.899Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "21713"
      ],
      "x_nadsec_orgs": [
        "Bulloch County Rural Telephone Cooperative, Inc."
      ]
    },
    {
      "created": "2026-03-17T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--dfa2c145-3d94-4e6b-85e9-6e6c500815d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.186.190.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:05:03.000Z",
      "valid_until": "2026-04-18T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T18:15:28.320Z",
      "x_nadsec_last_seen": "2026-03-17T18:17:00.911Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-17T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=207490; asn_org=Individual Proprietor Boris L. Grigoryan",
      "id": "indicator--f0477934-bf91-442c-afa7-03d62114805c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.72.17.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:05:03.000Z",
      "valid_until": "2026-04-18T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T18:29:37.206Z",
      "x_nadsec_last_seen": "2026-03-17T18:31:43.849Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "207490"
      ],
      "x_nadsec_orgs": [
        "Individual Proprietor Boris L. Grigoryan"
      ]
    },
    {
      "created": "2026-03-17T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--898dd054-101e-4287-bb02-5784e24da36c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.77.148.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:05:02.000Z",
      "valid_until": "2026-04-18T20:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-17T19:39:57.633Z",
      "x_nadsec_last_seen": "2026-03-17T22:14:52.275Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-17T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--12686d89-9843-4e05-9dc9-036294b22b66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.68.150.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:05:02.000Z",
      "valid_until": "2026-04-18T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T19:39:58.681Z",
      "x_nadsec_last_seen": "2026-03-25T19:29:25.665Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-17T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=TW; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--dc293e99-bd08-490a-bbc7-fb01bffe6735",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.164.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:05:02.000Z",
      "valid_until": "2026-04-18T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T19:06:10.491Z",
      "x_nadsec_last_seen": "2026-03-17T19:06:30.023Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-17T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--f07ead9f-551c-403f-a72f-718243fdd0b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '168.121.221.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:05:02.000Z",
      "valid_until": "2026-04-18T20:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-17T19:19:00.161Z",
      "x_nadsec_last_seen": "2026-03-17T19:19:39.240Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ]
    },
    {
      "created": "2026-03-17T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MD; asn=31252; asn_org=StarNet Solutii SRL",
      "id": "indicator--e7a39860-7b48-4163-b1b6-5bbc54ffda05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.168.83.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:05:02.000Z",
      "valid_until": "2026-04-18T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T19:38:05.976Z",
      "x_nadsec_last_seen": "2026-03-17T19:38:05.976Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MD"
      ],
      "x_nadsec_asns": [
        "31252"
      ],
      "x_nadsec_orgs": [
        "StarNet Solutii SRL"
      ]
    },
    {
      "created": "2026-03-17T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=38841; asn_org=kbro CO. Ltd.",
      "id": "indicator--83553caa-9324-41cb-93eb-ddde864c3092",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.177.108.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:05:02.000Z",
      "valid_until": "2026-04-18T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T19:58:21.934Z",
      "x_nadsec_last_seen": "2026-03-17T20:00:26.943Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "38841"
      ],
      "x_nadsec_orgs": [
        "kbro CO. Ltd."
      ]
    },
    {
      "created": "2026-03-17T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=27951; asn_org=Media Commerce Partners S.A",
      "id": "indicator--fced9aa4-6717-4bec-9e52-943576fd54df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.0.241.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:05:02.000Z",
      "valid_until": "2026-04-18T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T19:50:45.873Z",
      "x_nadsec_last_seen": "2026-03-17T19:52:52.480Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "27951"
      ],
      "x_nadsec_orgs": [
        "Media Commerce Partners S.A"
      ]
    },
    {
      "created": "2026-03-17T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=24432; asn_org=TM International Bangladesh",
      "id": "indicator--3349a6c1-72a6-4a23-9afe-726ea5be6da3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.134.12.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:05:02.000Z",
      "valid_until": "2026-04-18T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T19:28:57.332Z",
      "x_nadsec_last_seen": "2026-03-17T19:31:04.724Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "24432"
      ],
      "x_nadsec_orgs": [
        "TM International Bangladesh"
      ]
    },
    {
      "created": "2026-03-17T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4f54a37c-8bec-4d22-9b47-2045fb3fdb4e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:05:02.000Z",
      "valid_until": "2026-04-18T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T19:09:02.907Z",
      "x_nadsec_last_seen": "2026-03-26T16:21:18.372Z",
      "x_nadsec_ports": [
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-17T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6f22bcf2-5657-4a8c-97ed-f02a9cf6d5ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:05:02.000Z",
      "valid_until": "2026-04-18T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T19:57:57.870Z",
      "x_nadsec_last_seen": "2026-03-17T19:57:57.870Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-17T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--9c4825e7-ec68-4e7b-8e02-0c623b0604d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.38.195.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:05:02.000Z",
      "valid_until": "2026-04-18T20:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-17T00:08:18.763Z",
      "x_nadsec_last_seen": "2026-03-31T07:52:01.074Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LA; asn=135059; asn_org=Lao Asia Pacific Satellite Co., Ltd.",
      "id": "indicator--c2aaa6d5-3df7-41a2-ae35-e7d301a51fe3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.145.48.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:05:02.000Z",
      "valid_until": "2026-04-18T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T20:12:56.069Z",
      "x_nadsec_last_seen": "2026-03-17T20:13:01.861Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "135059"
      ],
      "x_nadsec_orgs": [
        "Lao Asia Pacific Satellite Co., Ltd."
      ]
    },
    {
      "created": "2026-03-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--df8e65c5-d120-44e8-a328-c411879cd46e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.70.239.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:05:02.000Z",
      "valid_until": "2026-04-18T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T20:42:24.146Z",
      "x_nadsec_last_seen": "2026-03-17T20:44:29.300Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--fbc0ebdd-3a5c-4815-85ab-2fc24fcae75a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.207.176.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:05:02.000Z",
      "valid_until": "2026-04-18T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T20:13:09.068Z",
      "x_nadsec_last_seen": "2026-03-17T20:15:16.019Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4a2238ed-0d99-48e3-943b-ece5be97e33a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '164.90.191.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:05:02.000Z",
      "valid_until": "2026-04-18T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T20:33:11.875Z",
      "x_nadsec_last_seen": "2026-03-17T20:33:11.875Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--d50695d7-f844-4982-99bc-caf48de278a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.165.31.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:05:02.000Z",
      "valid_until": "2026-04-18T21:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-17T20:34:09.291Z",
      "x_nadsec_last_seen": "2026-03-17T22:53:33.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--15116625-4dac-495c-b60c-f688970b948e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.115.207.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:05:02.000Z",
      "valid_until": "2026-04-18T21:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-17T20:29:51.859Z",
      "x_nadsec_last_seen": "2026-03-17T20:31:56.632Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--cb0e9192-8e9e-48c9-9d0b-c2b3f26a2346",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.235.166.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:05:02.000Z",
      "valid_until": "2026-04-18T21:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T20:36:09.946Z",
      "x_nadsec_last_seen": "2026-03-17T20:43:05.186Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=262753; asn_org=VOCE TELECOMUNICACOES LTDA",
      "id": "indicator--6327ee9a-d2c0-49a5-a6f7-7bfe8ea7a7ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.6.121.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:05:02.000Z",
      "valid_until": "2026-04-18T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T20:04:59.292Z",
      "x_nadsec_last_seen": "2026-03-17T20:07:09.507Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262753"
      ],
      "x_nadsec_orgs": [
        "VOCE TELECOMUNICACOES LTDA"
      ]
    },
    {
      "created": "2026-03-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8c756592-df62-4def-95c9-6943719a981e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.15.201.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:05:02.000Z",
      "valid_until": "2026-04-18T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T20:59:28.985Z",
      "x_nadsec_last_seen": "2026-03-17T20:59:39.161Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--999fad93-74ef-4326-a943-df56bf81ce8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.206.81.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:05:02.000Z",
      "valid_until": "2026-04-18T21:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-17T20:09:02.752Z",
      "x_nadsec_last_seen": "2026-03-26T23:30:26.809Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10429"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--294e2f48-6bde-44c1-8e0f-8878810d66a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.115.19.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:05:02.000Z",
      "valid_until": "2026-04-18T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T20:36:28.597Z",
      "x_nadsec_last_seen": "2026-03-17T20:37:17.297Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-03-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=8393; asn_org=astel Jsc",
      "id": "indicator--da8956d6-8e7a-4e9f-b511-bbda85228e0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.157.44.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:05:02.000Z",
      "valid_until": "2026-04-18T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T20:29:40.216Z",
      "x_nadsec_last_seen": "2026-03-17T20:31:47.764Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "8393"
      ],
      "x_nadsec_orgs": [
        "astel Jsc"
      ]
    },
    {
      "created": "2026-03-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--5b1c311e-8424-47e7-a22a-cd162ddbffca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.165.187.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:05:02.000Z",
      "valid_until": "2026-04-18T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T22:38:33.733Z",
      "x_nadsec_last_seen": "2026-03-17T20:36:28.905Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-03-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--fa130b52-32ca-451f-b56a-049402c9806d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.249.249.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:05:02.000Z",
      "valid_until": "2026-04-18T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T20:17:52.612Z",
      "x_nadsec_last_seen": "2026-03-17T20:17:52.612Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-17T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BG; asn=50360; asn_org=Tamatiya EOOD",
      "id": "indicator--4f010ccb-917e-4d42-acb4-bded6d83fd2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.58.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T21:05:02.000Z",
      "valid_until": "2026-04-18T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T20:25:18.890Z",
      "x_nadsec_last_seen": "2026-03-17T20:25:18.890Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "50360"
      ],
      "x_nadsec_orgs": [
        "Tamatiya EOOD"
      ]
    },
    {
      "created": "2026-03-17T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e906fba4-af67-4397-aa49-0dd5c7e9fd0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.224.170.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:05:03.000Z",
      "valid_until": "2026-04-18T22:05:01.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-03-17T21:51:58.071Z",
      "x_nadsec_last_seen": "2026-03-31T03:18:04.191Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-17T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=36352; asn_org=HostPapa",
      "id": "indicator--8a3a7654-1f83-49fb-9fda-29dccd41b9da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.227.159.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:05:03.000Z",
      "valid_until": "2026-04-18T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T21:32:04.989Z",
      "x_nadsec_last_seen": "2026-03-18T04:01:08.215Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "36352"
      ],
      "x_nadsec_orgs": [
        "HostPapa"
      ]
    },
    {
      "created": "2026-03-17T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--3f65e120-8a56-4310-8b2b-afde534359a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.20.144.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:05:03.000Z",
      "valid_until": "2026-04-18T22:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-17T22:03:18.702Z",
      "x_nadsec_last_seen": "2026-03-22T04:22:29.852Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-17T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mysqld; ports=3306; cc=PA; asn=64107; asn_org=RACK SPHERE HOSTING S.A.",
      "id": "indicator--20a0a4a5-3219-4947-abe4-af9ee7800c8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.225.135.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:05:03.000Z",
      "valid_until": "2026-04-18T22:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-17T21:22:11.895Z",
      "x_nadsec_last_seen": "2026-03-17T22:02:29.975Z",
      "x_nadsec_ports": [
        "135",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "PA"
      ],
      "x_nadsec_asns": [
        "64107"
      ],
      "x_nadsec_orgs": [
        "RACK SPHERE HOSTING S.A."
      ]
    },
    {
      "created": "2026-03-17T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=SC; asn=42624; asn_org=Global-Data System IT Corporation",
      "id": "indicator--d714e171-0b50-4a05-9cda-fd709e34908f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '69.5.189.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:05:03.000Z",
      "valid_until": "2026-04-18T22:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-17T21:54:04.034Z",
      "x_nadsec_last_seen": "2026-03-17T21:54:47.346Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "42624"
      ],
      "x_nadsec_orgs": [
        "Global-Data System IT Corporation"
      ]
    },
    {
      "created": "2026-03-17T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mssqld; ports=1433; cc=SC; asn=42624; asn_org=Global-Data System IT Corporation",
      "id": "indicator--413af945-1597-4f21-8fed-3896f86e0a66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '69.5.189.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:05:03.000Z",
      "valid_until": "2026-04-18T22:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-17T21:14:48.903Z",
      "x_nadsec_last_seen": "2026-03-17T21:49:14.957Z",
      "x_nadsec_ports": [
        "1433",
        "1723",
        "21"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "42624"
      ],
      "x_nadsec_orgs": [
        "Global-Data System IT Corporation"
      ]
    },
    {
      "created": "2026-03-17T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b5b16dc6-c44f-47eb-9db9-21c6bbcc64fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.235.203.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:05:03.000Z",
      "valid_until": "2026-04-18T22:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-17T21:49:58.117Z",
      "x_nadsec_last_seen": "2026-03-17T21:49:58.929Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-17T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=41435; asn_org=UnderNet LLC",
      "id": "indicator--d8a558e9-f16f-4d93-93cf-a422fab367d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.110.132.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:05:03.000Z",
      "valid_until": "2026-04-18T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T21:40:20.989Z",
      "x_nadsec_last_seen": "2026-03-17T21:42:27.552Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "41435"
      ],
      "x_nadsec_orgs": [
        "UnderNet LLC"
      ]
    },
    {
      "created": "2026-03-17T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--1c1f6392-9f4d-4cd6-b996-f0617f154ddc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.42.231.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:05:03.000Z",
      "valid_until": "2026-04-18T22:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-17T21:11:24.680Z",
      "x_nadsec_last_seen": "2026-03-26T09:48:23.366Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "445",
        "1433",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mqttd",
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-03-17T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--09daa750-b3c3-4735-846e-305c49626cea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.172.143.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:05:03.000Z",
      "valid_until": "2026-04-18T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T22:24:35.539Z",
      "x_nadsec_last_seen": "2026-03-17T22:26:40.235Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-17T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--d4f0ef82-ef5c-48ec-a57a-ba0d485dc51f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.78.161.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:05:03.000Z",
      "valid_until": "2026-04-18T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T22:07:15.895Z",
      "x_nadsec_last_seen": "2026-03-17T22:09:23.334Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-03-17T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--8ce20261-2687-4f47-98c2-5d44db7821c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.80.215.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:05:03.000Z",
      "valid_until": "2026-04-18T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T22:49:42.705Z",
      "x_nadsec_last_seen": "2026-03-17T22:51:50.642Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-03-17T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MD; asn=31252; asn_org=StarNet Solutii SRL",
      "id": "indicator--208b494b-cee5-45d6-a3ec-0be330017c1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.244.26.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:05:03.000Z",
      "valid_until": "2026-04-18T23:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-17T22:16:20.032Z",
      "x_nadsec_last_seen": "2026-03-26T21:17:54.174Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MD"
      ],
      "x_nadsec_asns": [
        "31252"
      ],
      "x_nadsec_orgs": [
        "StarNet Solutii SRL"
      ]
    },
    {
      "created": "2026-03-17T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=MX; asn=6503; asn_org=Axtel, S.A.B. de C.V.",
      "id": "indicator--7e04e99b-92e7-47cd-9202-229b5f43fd51",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.211.111.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:05:03.000Z",
      "valid_until": "2026-04-18T23:05:01.000Z",
      "x_nadsec_event_count": 14,
      "x_nadsec_first_seen": "2026-03-17T22:16:54.497Z",
      "x_nadsec_last_seen": "2026-03-23T00:13:02.459Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "6503"
      ],
      "x_nadsec_orgs": [
        "Axtel, S.A.B. de C.V."
      ]
    },
    {
      "created": "2026-03-17T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f0c94dff-d3d8-4686-a186-8d122a7044ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:05:03.000Z",
      "valid_until": "2026-04-18T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T22:05:46.084Z",
      "x_nadsec_last_seen": "2026-03-17T22:05:46.084Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-17T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--efe75e83-4ee2-40e5-b9e2-a378d8301132",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:05:03.000Z",
      "valid_until": "2026-04-18T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T22:05:35.757Z",
      "x_nadsec_last_seen": "2026-03-17T22:05:35.757Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-17T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--15fe0488-4eec-45d8-883e-9bf9e55ddef6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:05:03.000Z",
      "valid_until": "2026-04-18T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T22:05:15.169Z",
      "x_nadsec_last_seen": "2026-03-17T22:05:15.169Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-17T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ce6ce735-435b-4cb0-b9e2-13bf2f306a47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:05:03.000Z",
      "valid_until": "2026-04-18T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-17T22:05:13.829Z",
      "x_nadsec_last_seen": "2026-03-17T22:05:13.829Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-17T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--1bf5578b-c9a1-452b-9d5b-db794959765f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.156.71.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:05:03.000Z",
      "valid_until": "2026-04-18T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T22:56:28.993Z",
      "x_nadsec_last_seen": "2026-03-17T22:56:35.865Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-17T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--5f200c1f-14f5-41b7-a943-099d52329263",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-17T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.33.50.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:05:03.000Z",
      "valid_until": "2026-04-18T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T22:47:38.367Z",
      "x_nadsec_last_seen": "2026-03-17T22:49:44.758Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-18T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KH; asn=38235; asn_org=ANGKOR DATA COMMUNICATION",
      "id": "indicator--5c535a69-346b-4799-b16e-1d5befee7c81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.206.79.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:05:03.000Z",
      "valid_until": "2026-04-19T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T23:34:50.123Z",
      "x_nadsec_last_seen": "2026-03-17T23:36:54.721Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KH"
      ],
      "x_nadsec_asns": [
        "38235"
      ],
      "x_nadsec_orgs": [
        "ANGKOR DATA COMMUNICATION"
      ]
    },
    {
      "created": "2026-03-18T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--e2ad7ef7-2995-4ca3-bb02-54de77d4cf2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.78.128.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:05:03.000Z",
      "valid_until": "2026-04-19T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T00:04:45.094Z",
      "x_nadsec_last_seen": "2026-03-18T00:06:49.349Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-03-18T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--15e4b662-9efd-4fdc-9ba1-f624fd2b96a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.241.46.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:05:03.000Z",
      "valid_until": "2026-04-19T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T23:42:36.791Z",
      "x_nadsec_last_seen": "2026-03-17T23:44:43.293Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-18T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--6591d104-3569-4837-8b42-559428e52b29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.52.22.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:05:03.000Z",
      "valid_until": "2026-04-19T00:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-17T23:16:36.529Z",
      "x_nadsec_last_seen": "2026-03-27T13:53:04.120Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-18T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--93211c5c-56cf-48d2-b2dc-73b75c1ad68c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.231.148.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:05:03.000Z",
      "valid_until": "2026-04-19T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T23:06:47.672Z",
      "x_nadsec_last_seen": "2026-03-17T23:08:52.588Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-18T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e17095f7-ba49-4ffb-80aa-407591d785d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:05:03.000Z",
      "valid_until": "2026-04-19T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T00:01:27.830Z",
      "x_nadsec_last_seen": "2026-03-18T00:01:27.830Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-18T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GB; asn=208781; asn_org=Smart Ct Limited",
      "id": "indicator--fe66c29b-6dfb-4637-bde7-fa247a3f4186",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.57.196.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:05:03.000Z",
      "valid_until": "2026-04-19T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-17T23:51:38.708Z",
      "x_nadsec_last_seen": "2026-03-17T23:53:44.671Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "208781"
      ],
      "x_nadsec_orgs": [
        "Smart Ct Limited"
      ]
    },
    {
      "created": "2026-03-18T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--db91ed01-60c6-43d7-a84a-b383ea6f83ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.49.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:05:03.000Z",
      "valid_until": "2026-04-19T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T23:45:55.118Z",
      "x_nadsec_last_seen": "2026-03-17T23:46:05.260Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-18T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AU; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5d1841cd-7774-4a14-b423-526c7c5ec261",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.58.139.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:05:03.000Z",
      "valid_until": "2026-04-19T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T23:10:21.201Z",
      "x_nadsec_last_seen": "2026-03-17T23:12:24.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-18T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AU; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8803e283-484a-4188-b6c6-84c90b945ccb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '4.197.95.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:05:03.000Z",
      "valid_until": "2026-04-19T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-17T23:10:21.208Z",
      "x_nadsec_last_seen": "2026-03-17T23:12:24.241Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-18T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--5a823ec5-1233-4f81-a400-bbbd64c46960",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.10.231.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:05:03.000Z",
      "valid_until": "2026-04-19T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T01:04:35.725Z",
      "x_nadsec_last_seen": "2026-03-18T01:07:58.321Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-18T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--57400dac-d812-4f81-96d1-1df14ce927a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.169.31.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:05:03.000Z",
      "valid_until": "2026-04-19T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T00:39:44.114Z",
      "x_nadsec_last_seen": "2026-03-18T00:39:44.114Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-18T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--35a4377c-4098-4c3b-bcff-8feebcdc9cd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.222.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:05:03.000Z",
      "valid_until": "2026-04-19T01:05:01.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-03-18T00:30:06.321Z",
      "x_nadsec_last_seen": "2026-03-18T00:32:55.031Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-18T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--916c9d00-bfe4-4005-bcd1-18ead28fd26a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:05:03.000Z",
      "valid_until": "2026-04-19T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T00:31:51.003Z",
      "x_nadsec_last_seen": "2026-03-18T00:31:51.003Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-18T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--b27d7006-b8dc-40c4-8a22-a4bc96a01da2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.65.44.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:05:03.000Z",
      "valid_until": "2026-04-19T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T00:54:32.663Z",
      "x_nadsec_last_seen": "2026-03-18T00:54:38.511Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-18T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--48b434d0-446d-41ff-bb83-e14a171295fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.42.221.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:05:03.000Z",
      "valid_until": "2026-04-19T01:05:01.000Z",
      "x_nadsec_event_count": 3153,
      "x_nadsec_first_seen": "2026-03-18T00:30:20.623Z",
      "x_nadsec_last_seen": "2026-03-18T01:54:56.742Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-18T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--90fffd40-7847-47a7-ae90-cdb8c1acfcc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:05:03.000Z",
      "valid_until": "2026-04-19T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T00:31:44.825Z",
      "x_nadsec_last_seen": "2026-03-18T00:31:44.825Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-18T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--ade465b2-4b33-4f96-ba84-7a491a769b8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.83.106.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:05:03.000Z",
      "valid_until": "2026-04-19T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T00:59:33.686Z",
      "x_nadsec_last_seen": "2026-03-18T00:59:33.686Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-18T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TG; asn=24691; asn_org=TOGOTEL-AS TogoTelecom, Togo",
      "id": "indicator--1f66a59a-d422-4f18-8324-1b8091f81217",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.207.182.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:05:03.000Z",
      "valid_until": "2026-04-19T01:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-18T00:36:15.229Z",
      "x_nadsec_last_seen": "2026-03-18T02:02:02.588Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TG"
      ],
      "x_nadsec_asns": [
        "24691"
      ],
      "x_nadsec_orgs": [
        "TOGOTEL-AS TogoTelecom, Togo"
      ]
    },
    {
      "created": "2026-03-18T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--4dd90f92-454d-4124-8f01-88c8fe0e76b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.9.83.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:05:03.000Z",
      "valid_until": "2026-04-19T01:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-18T00:32:49.889Z",
      "x_nadsec_last_seen": "2026-03-18T03:08:55.834Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-18T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KR; asn=17853; asn_org=LGTELECOM",
      "id": "indicator--b4468008-74a2-4cd6-b39d-21d432f25ced",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.96.47.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:05:03.000Z",
      "valid_until": "2026-04-19T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T01:35:28.510Z",
      "x_nadsec_last_seen": "2026-03-18T01:37:33.639Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "17853"
      ],
      "x_nadsec_orgs": [
        "LGTELECOM"
      ]
    },
    {
      "created": "2026-03-18T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6a87a7d9-e54c-4256-a23f-adcc7cf7e788",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.176.112.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:05:03.000Z",
      "valid_until": "2026-04-19T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T01:48:58.078Z",
      "x_nadsec_last_seen": "2026-03-18T01:51:02.868Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-18T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--198b008b-de57-4119-8a1d-a5539db93185",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.236.77.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:05:03.000Z",
      "valid_until": "2026-04-19T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T01:28:23.480Z",
      "x_nadsec_last_seen": "2026-03-18T01:33:01.849Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-18T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--b6fbcaf9-bb3b-4b40-8be7-6c51048ceac5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.176.84.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:05:03.000Z",
      "valid_until": "2026-04-19T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T01:56:21.149Z",
      "x_nadsec_last_seen": "2026-03-18T01:58:28.225Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-18T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BZ; asn=10269; asn_org=Belize Telemedia Limited",
      "id": "indicator--1074a1e3-a905-49e4-b547-54b657349f42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.197.30.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:05:03.000Z",
      "valid_until": "2026-04-19T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T01:38:30.332Z",
      "x_nadsec_last_seen": "2026-03-18T01:40:36.468Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BZ"
      ],
      "x_nadsec_asns": [
        "10269"
      ],
      "x_nadsec_orgs": [
        "Belize Telemedia Limited"
      ]
    },
    {
      "created": "2026-03-18T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--d4e29410-df98-4d17-af7d-fe0a622ec6c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.31.158.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:05:03.000Z",
      "valid_until": "2026-04-19T02:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-18T01:41:37.601Z",
      "x_nadsec_last_seen": "2026-03-22T07:12:27.007Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-03-18T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9b8a9da8-b719-42bd-821a-582954bb0894",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.127.203.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:05:03.000Z",
      "valid_until": "2026-04-19T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T01:31:14.458Z",
      "x_nadsec_last_seen": "2026-03-18T01:31:14.458Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-18T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=151690; asn_org=FAB FIVE NETWORK PRIVATE LIMITED",
      "id": "indicator--c12b58a5-0aed-446f-afb1-23d83052da88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.109.221.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T03:05:03.000Z",
      "valid_until": "2026-04-19T03:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-18T02:38:07.825Z",
      "x_nadsec_last_seen": "2026-03-27T08:25:58.754Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151690"
      ],
      "x_nadsec_orgs": [
        "FAB FIVE NETWORK PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-18T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--0994d90a-d181-468e-9a41-c8e20965d175",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.236.227.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T03:05:03.000Z",
      "valid_until": "2026-04-19T03:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-18T02:12:08.939Z",
      "x_nadsec_last_seen": "2026-03-19T15:03:47.602Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-18T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--59f4744c-896e-4f84-a45d-1d90185e9768",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.14.127.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T03:05:03.000Z",
      "valid_until": "2026-04-19T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T02:51:48.287Z",
      "x_nadsec_last_seen": "2026-03-18T02:51:48.287Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-18T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--f32ef30f-40cb-4874-8994-d98b2d609c89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.136.137.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T03:05:03.000Z",
      "valid_until": "2026-04-19T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T02:18:36.092Z",
      "x_nadsec_last_seen": "2026-03-18T02:18:36.092Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-18T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=7590; asn_org=Commission on Science and Technology for",
      "id": "indicator--5d6a9a9c-560e-49d3-8403-fcf990461533",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.124.61.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T03:05:03.000Z",
      "valid_until": "2026-04-19T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T03:02:33.254Z",
      "x_nadsec_last_seen": "2026-03-18T03:09:29.343Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "7590"
      ],
      "x_nadsec_orgs": [
        "Commission on Science and Technology for"
      ]
    },
    {
      "created": "2026-03-18T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--1434fd8a-bfaf-4c84-a83e-6ef4e8ce7c1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.197.136.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T03:05:03.000Z",
      "valid_until": "2026-04-19T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T02:05:08.556Z",
      "x_nadsec_last_seen": "2026-03-18T02:05:08.556Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-03-18T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--a4a4535e-5c46-4324-875b-d98b6205f85e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.240.223.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T03:05:03.000Z",
      "valid_until": "2026-04-19T03:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T02:31:51.873Z",
      "x_nadsec_last_seen": "2026-03-25T09:23:45.864Z",
      "x_nadsec_ports": [
        "27017",
        "1433"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-18T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=136873; asn_org=MEGADATA-ISP",
      "id": "indicator--fc6bfbe9-e1c2-4aaa-8ba3-00dd22745bcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.213.234.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:05:02.000Z",
      "valid_until": "2026-04-19T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T03:09:28.204Z",
      "x_nadsec_last_seen": "2026-03-18T03:11:33.211Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "136873"
      ],
      "x_nadsec_orgs": [
        "MEGADATA-ISP"
      ]
    },
    {
      "created": "2026-03-18T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UZ; asn=8193; asn_org=Uzbektelekom Joint Stock Company",
      "id": "indicator--af125564-8288-431e-ba2b-e6699d6d8f6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.94.174.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:05:02.000Z",
      "valid_until": "2026-04-19T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T03:56:27.953Z",
      "x_nadsec_last_seen": "2026-03-18T03:58:34.308Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "8193"
      ],
      "x_nadsec_orgs": [
        "Uzbektelekom Joint Stock Company"
      ]
    },
    {
      "created": "2026-03-18T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6e502fb4-445c-4719-a19c-cc553fb55266",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.170.126.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:05:02.000Z",
      "valid_until": "2026-04-19T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T03:12:44.025Z",
      "x_nadsec_last_seen": "2026-03-18T03:14:50.191Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-18T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6650c1ed-531a-499e-9dd6-6c4ac22480ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.176.118.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:05:02.000Z",
      "valid_until": "2026-04-19T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T03:47:13.623Z",
      "x_nadsec_last_seen": "2026-03-18T03:49:18.481Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-18T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--3cecd910-21fe-4b22-83e9-3c49e623ee1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.227.157.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:05:02.000Z",
      "valid_until": "2026-04-19T04:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T03:54:57.597Z",
      "x_nadsec_last_seen": "2026-03-18T03:55:44.143Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-18T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=135607; asn_org=Infinivan Incorporated",
      "id": "indicator--44afb50a-dc42-44a5-b7d1-30d277acc89f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '126.209.105.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:05:02.000Z",
      "valid_until": "2026-04-19T04:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T03:05:17.569Z",
      "x_nadsec_last_seen": "2026-03-18T03:11:33.192Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135607"
      ],
      "x_nadsec_orgs": [
        "Infinivan Incorporated"
      ]
    },
    {
      "created": "2026-03-18T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--b50163f4-100d-40da-85f3-485af9568c32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.241.20.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:05:02.000Z",
      "valid_until": "2026-04-19T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T03:56:35.204Z",
      "x_nadsec_last_seen": "2026-03-18T03:58:41.453Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-18T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--3858c6bc-74fd-452f-a23b-db0e57ec995e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.158.26.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:05:02.000Z",
      "valid_until": "2026-04-19T04:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-18T03:33:01.842Z",
      "x_nadsec_last_seen": "2026-03-19T01:12:56.927Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-18T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=25403; asn_org=Firm Delta PE",
      "id": "indicator--78493126-f11b-4a6c-b169-6f6328322686",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.20.125.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:05:02.000Z",
      "valid_until": "2026-04-19T04:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-18T03:39:41.559Z",
      "x_nadsec_last_seen": "2026-03-25T08:59:16.553Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "25403"
      ],
      "x_nadsec_orgs": [
        "Firm Delta PE"
      ]
    },
    {
      "created": "2026-03-18T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5bf0dbc9-9a3c-4cce-9778-358c0145142a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:05:02.000Z",
      "valid_until": "2026-04-19T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T03:57:45.670Z",
      "x_nadsec_last_seen": "2026-03-18T03:57:45.670Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-18T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--7c7edea7-e242-4ee3-92d4-47c4d5cde459",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.70.147.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:05:02.000Z",
      "valid_until": "2026-04-19T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T03:54:25.405Z",
      "x_nadsec_last_seen": "2026-03-18T03:56:31.452Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-18T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45557; asn_org=Vietnam Technology and Telecommunication JSC",
      "id": "indicator--1f8723d7-1ab8-4418-8837-5f4c8721ef79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.118.136.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:05:02.000Z",
      "valid_until": "2026-04-19T04:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-18T03:14:09.903Z",
      "x_nadsec_last_seen": "2026-03-18T05:06:03.389Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45557"
      ],
      "x_nadsec_orgs": [
        "Vietnam Technology and Telecommunication JSC"
      ]
    },
    {
      "created": "2026-03-18T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited",
      "id": "indicator--fbedbd12-88ff-416c-83bc-c4ae61ea5502",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:05:02.000Z",
      "valid_until": "2026-04-19T04:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-18T03:50:10.183Z",
      "x_nadsec_last_seen": "2026-03-30T09:36:55.571Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "212512"
      ],
      "x_nadsec_orgs": [
        "Detai Prosperous Technologies Limited"
      ]
    },
    {
      "created": "2026-03-18T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--b3a977fc-366c-4196-8ced-b85c740011db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.7.154.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:05:02.000Z",
      "valid_until": "2026-04-19T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T03:06:01.731Z",
      "x_nadsec_last_seen": "2026-03-18T03:08:06.750Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-18T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--22f4b833-a7a0-4622-8759-ccf29284c1e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.53.239.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:05:03.000Z",
      "valid_until": "2026-04-19T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T04:55:52.795Z",
      "x_nadsec_last_seen": "2026-03-18T04:57:58.278Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-18T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=33771; asn_org=SAFARICOM-LIMITED",
      "id": "indicator--0ee52e5e-fb20-48da-b81d-2da377f15a17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.165.199.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:05:03.000Z",
      "valid_until": "2026-04-19T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T04:10:28.492Z",
      "x_nadsec_last_seen": "2026-03-18T04:12:36.599Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "33771"
      ],
      "x_nadsec_orgs": [
        "SAFARICOM-LIMITED"
      ]
    },
    {
      "created": "2026-03-18T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--dfad6f31-a693-4054-b327-6cad23f28c47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.160.211.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:05:03.000Z",
      "valid_until": "2026-04-19T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T05:01:39.502Z",
      "x_nadsec_last_seen": "2026-03-18T05:05:47.599Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-18T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--2159c48d-fdd6-44c6-8ac2-b253d1f598cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.70.80.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:05:03.000Z",
      "valid_until": "2026-04-19T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T04:27:45.916Z",
      "x_nadsec_last_seen": "2026-03-18T04:34:32.790Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-18T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--966c9758-1ee1-4b45-83fb-0c52fbae654a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.252.174.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:05:03.000Z",
      "valid_until": "2026-04-19T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T04:53:41.519Z",
      "x_nadsec_last_seen": "2026-03-18T06:45:46.725Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-03-18T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--2d43185f-e2df-406a-bbd1-a61379548e64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.158.171.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:05:03.000Z",
      "valid_until": "2026-04-19T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T04:50:18.774Z",
      "x_nadsec_last_seen": "2026-03-18T06:46:20.832Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-03-18T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=9381; asn_org=HKBN Enterprise Solutions HK Limited",
      "id": "indicator--e6fe80de-2109-4040-a2f3-d5656a419f90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.126.220.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:05:03.000Z",
      "valid_until": "2026-04-19T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T04:49:26.323Z",
      "x_nadsec_last_seen": "2026-03-18T04:51:34.446Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9381"
      ],
      "x_nadsec_orgs": [
        "HKBN Enterprise Solutions HK Limited"
      ]
    },
    {
      "created": "2026-03-18T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BD; asn=24323; asn_org=aamra networks limited",
      "id": "indicator--90cacfe0-68c8-48e4-90ab-9b0f717fc8f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.202.247.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:05:03.000Z",
      "valid_until": "2026-04-19T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T04:51:13.558Z",
      "x_nadsec_last_seen": "2026-03-18T04:53:18.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "24323"
      ],
      "x_nadsec_orgs": [
        "aamra networks limited"
      ]
    },
    {
      "created": "2026-03-18T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--216f28ac-ec98-472f-a2b3-f3e4fc70709f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:05:03.000Z",
      "valid_until": "2026-04-19T05:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T04:54:04.060Z",
      "x_nadsec_last_seen": "2026-03-22T12:39:14.686Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-18T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=16637; asn_org=MTN Business Solutions",
      "id": "indicator--ec28ee9f-03d2-4c06-9a7e-82d05e381f1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.8.6.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:05:03.000Z",
      "valid_until": "2026-04-19T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T04:53:02.107Z",
      "x_nadsec_last_seen": "2026-03-18T04:55:18.324Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "16637"
      ],
      "x_nadsec_orgs": [
        "MTN Business Solutions"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--df444881-1bba-497c-bb1c-5115453b7c5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.0.45.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T05:20:47.337Z",
      "x_nadsec_last_seen": "2026-03-18T05:27:19.266Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--aa2266ef-9d9e-4e67-9b7f-74c891fab854",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.108.214.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T05:58:49.103Z",
      "x_nadsec_last_seen": "2026-03-18T06:00:55.374Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--b6b10844-c074-4cd6-95c7-6e9dc1177326",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.46.67.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T05:22:24.790Z",
      "x_nadsec_last_seen": "2026-03-18T05:22:25.140Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--52e63c82-2194-4fa5-ba12-e3308ed332cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.10.231.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T05:23:47.471Z",
      "x_nadsec_last_seen": "2026-03-18T05:23:47.652Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--62ca9b06-bc4b-40c3-abc5-ec2e7dcc8681",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.103.133.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T05:31:30.428Z",
      "x_nadsec_last_seen": "2026-03-18T05:33:35.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--8587a260-611f-4d98-b46f-5065d822e5c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.233.177.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T05:28:19.271Z",
      "x_nadsec_last_seen": "2026-03-18T05:31:04.668Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--650f97dd-6462-4274-910c-f78390654e36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.175.201.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T05:59:36.081Z",
      "x_nadsec_last_seen": "2026-03-18T06:01:40.872Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--e69bcd7d-fcff-4c6c-aa6f-5dcc81766b44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.42.86.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T05:17:17.873Z",
      "x_nadsec_last_seen": "2026-03-18T05:24:02.206Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--089d23aa-281b-4e5a-afe7-7ba48bab0d8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.20.211.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T05:23:50.678Z",
      "x_nadsec_last_seen": "2026-03-18T05:25:55.339Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=13188; asn_org=Content Delivery Network Ltd",
      "id": "indicator--6c9580c8-8840-4e48-83c7-e62e62d305de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.224.199.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-18T05:07:59.450Z",
      "x_nadsec_last_seen": "2026-03-18T10:48:32.465Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "13188"
      ],
      "x_nadsec_orgs": [
        "Content Delivery Network Ltd"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UZ; asn=202660; asn_org=Uzbektelekom Joint Stock Company",
      "id": "indicator--5b5653e4-59ad-4108-b3a1-8378867aced5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.74.4.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-18T05:59:43.571Z",
      "x_nadsec_last_seen": "2026-03-21T02:42:20.575Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "202660"
      ],
      "x_nadsec_orgs": [
        "Uzbektelekom Joint Stock Company"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=55699; asn_org=PT. Cemerlang Multimedia",
      "id": "indicator--b464767c-c89c-4f61-97c0-c8e4fb2c6214",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.210.84.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-18T05:08:24.157Z",
      "x_nadsec_last_seen": "2026-03-18T06:22:01.365Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "55699"
      ],
      "x_nadsec_orgs": [
        "PT. Cemerlang Multimedia"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=GE; asn=16010; asn_org=Magticom Ltd.",
      "id": "indicator--f95f2284-6554-42ee-aa07-9f498265aff3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.72.152.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T05:58:35.740Z",
      "x_nadsec_last_seen": "2026-03-18T06:05:43.322Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "16010"
      ],
      "x_nadsec_orgs": [
        "Magticom Ltd."
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=56044; asn_org=China Mobile communications corporation",
      "id": "indicator--fd9f3d8a-1c77-4eb3-b22f-45a6fc51f8b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.152.155.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T05:19:54.925Z",
      "x_nadsec_last_seen": "2026-03-18T05:22:00.132Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56044"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--4fa5fb99-c488-49cb-887e-d87febf2cb29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.48.138.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T05:25:51.512Z",
      "x_nadsec_last_seen": "2026-03-18T05:25:52.218Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=29456; asn_org=Rostelecom",
      "id": "indicator--b336225d-bc15-4b6d-8831-4b573f5b1172",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.151.97.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T05:19:45.681Z",
      "x_nadsec_last_seen": "2026-03-18T05:21:18.926Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "29456"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7bc45370-ec3a-4b8f-9ef8-18179ce540c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T05:35:35.974Z",
      "x_nadsec_last_seen": "2026-03-18T05:35:35.974Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--852080fc-41ee-40ce-95ee-083a85beb897",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T05:35:35.141Z",
      "x_nadsec_last_seen": "2026-03-18T05:35:35.141Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--0eef90cf-4328-4450-9e04-8b4d1089dfc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T05:57:06.006Z",
      "x_nadsec_last_seen": "2026-03-18T05:57:06.006Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-18T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--067f7eda-1979-48e7-99e7-ce5530e8c81f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T06:05:02.000Z",
      "valid_until": "2026-04-19T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T05:57:05.383Z",
      "x_nadsec_last_seen": "2026-03-18T05:57:05.383Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-18T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--56535e4d-2332-4986-8ed8-60b17ae811c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.55.241.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:05:03.000Z",
      "valid_until": "2026-04-19T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T06:06:08.635Z",
      "x_nadsec_last_seen": "2026-03-18T06:10:21.456Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-18T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=136342; asn_org=Winux Communications Pvt. Ltd.",
      "id": "indicator--490f7958-a9e3-4528-bbbc-083a21fb1e13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.127.187.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:05:03.000Z",
      "valid_until": "2026-04-19T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T06:10:50.463Z",
      "x_nadsec_last_seen": "2026-03-18T06:10:56.750Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "136342"
      ],
      "x_nadsec_orgs": [
        "Winux Communications Pvt. Ltd."
      ]
    },
    {
      "created": "2026-03-18T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2355948d-83bd-432b-8021-85e31b6aa489",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.180.63.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:05:03.000Z",
      "valid_until": "2026-04-19T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T06:26:56.335Z",
      "x_nadsec_last_seen": "2026-03-18T06:29:01.105Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-18T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--85634332-39b0-4a3e-9a22-23330b8d8574",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.156.108.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:05:03.000Z",
      "valid_until": "2026-04-19T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T06:36:01.546Z",
      "x_nadsec_last_seen": "2026-03-18T06:38:07.553Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-18T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--8307f2bf-c820-4e24-9fda-1950e51a83b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.226.145.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:05:03.000Z",
      "valid_until": "2026-04-19T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T06:56:45.952Z",
      "x_nadsec_last_seen": "2026-03-18T06:58:52.296Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-18T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--9b6f6943-9bb4-46c0-ae66-20b8b2dafc7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.206.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:05:03.000Z",
      "valid_until": "2026-04-19T07:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-18T06:12:55.431Z",
      "x_nadsec_last_seen": "2026-03-18T06:13:48.697Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-18T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4d568e3c-7368-44e0-9646-c788b906a8d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.106.48.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:05:03.000Z",
      "valid_until": "2026-04-19T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-16T23:11:38.862Z",
      "x_nadsec_last_seen": "2026-03-18T06:48:16.941Z",
      "x_nadsec_ports": [
        "21",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-18T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e3035322-2f18-47b7-ac53-4121b2c1b977",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.171.8.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:05:03.000Z",
      "valid_until": "2026-04-19T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T06:53:09.315Z",
      "x_nadsec_last_seen": "2026-03-18T06:53:09.315Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-18T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=5033; asn_org=Key Information Systems, Inc.",
      "id": "indicator--3f106623-0656-4fb8-b28f-b792ce457f7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '207.178.209.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:05:03.000Z",
      "valid_until": "2026-04-19T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T06:54:31.379Z",
      "x_nadsec_last_seen": "2026-03-18T06:54:31.537Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "5033"
      ],
      "x_nadsec_orgs": [
        "Key Information Systems, Inc."
      ]
    },
    {
      "created": "2026-03-18T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=RU; asn=202799; asn_org=Sysect D.o.o.",
      "id": "indicator--f137c435-0f3e-4837-ae60-0decd31c3a22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.19.223.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:05:03.000Z",
      "valid_until": "2026-04-19T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T15:31:13.905Z",
      "x_nadsec_last_seen": "2026-03-18T06:53:34.340Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "202799"
      ],
      "x_nadsec_orgs": [
        "Sysect D.o.o."
      ]
    },
    {
      "created": "2026-03-18T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NO; asn=29695; asn_org=Lyse Tele",
      "id": "indicator--64479603-0f6f-485e-96bc-269f6b84ee4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.221.136.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:05:03.000Z",
      "valid_until": "2026-04-19T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T06:20:32.807Z",
      "x_nadsec_last_seen": "2026-03-18T06:22:39.780Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NO"
      ],
      "x_nadsec_asns": [
        "29695"
      ],
      "x_nadsec_orgs": [
        "Lyse Tele"
      ]
    },
    {
      "created": "2026-03-18T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--617adf06-934a-48b8-8514-625c20a3820b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.156.116.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:05:03.000Z",
      "valid_until": "2026-04-19T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T06:39:07.924Z",
      "x_nadsec_last_seen": "2026-03-18T06:41:14.856Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-18T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134877; asn_org=Sri Vari Network Private Limited",
      "id": "indicator--b0a4494d-312e-4938-bfe4-07f3fc0b33c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.148.33.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:05:02.000Z",
      "valid_until": "2026-04-19T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T07:54:45.778Z",
      "x_nadsec_last_seen": "2026-03-18T07:56:51.210Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134877"
      ],
      "x_nadsec_orgs": [
        "Sri Vari Network Private Limited"
      ]
    },
    {
      "created": "2026-03-18T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--23706074-3d56-4d3b-81be-4f743ca72c78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.23.6.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:05:02.000Z",
      "valid_until": "2026-04-19T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T07:05:20.618Z",
      "x_nadsec_last_seen": "2026-03-18T07:12:03.285Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-18T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b613b15d-9d6a-4d29-8c31-cb71404e0202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.88.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:05:02.000Z",
      "valid_until": "2026-04-19T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T07:48:52.781Z",
      "x_nadsec_last_seen": "2026-03-20T18:25:12.233Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-18T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--6cd046dc-bc0a-4d4e-82a2-33ca6861923b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.12.77.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:05:02.000Z",
      "valid_until": "2026-04-19T08:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T07:13:32.663Z",
      "x_nadsec_last_seen": "2026-03-18T07:15:37.308Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ]
    },
    {
      "created": "2026-03-18T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--136457b1-50fc-4b77-880b-eaa0846ac949",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.93.183.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:05:02.000Z",
      "valid_until": "2026-04-19T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T07:08:29.568Z",
      "x_nadsec_last_seen": "2026-03-18T07:15:55.922Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-18T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--f3876572-096a-4484-aaec-dee063b72055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.204.166.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:05:02.000Z",
      "valid_until": "2026-04-19T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T07:23:26.801Z",
      "x_nadsec_last_seen": "2026-03-18T07:29:45.616Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-18T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=45804; asn_org=MEGHBELA BROADBAND",
      "id": "indicator--f9bb3408-fbf6-4d79-a449-23f4ecd2679d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.29.202.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:05:02.000Z",
      "valid_until": "2026-04-19T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T07:16:23.858Z",
      "x_nadsec_last_seen": "2026-03-18T07:23:07.371Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45804"
      ],
      "x_nadsec_orgs": [
        "MEGHBELA BROADBAND"
      ]
    },
    {
      "created": "2026-03-18T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fc599b0e-590c-4c24-8768-f0004215552e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.68.96.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:05:02.000Z",
      "valid_until": "2026-04-19T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T07:35:59.716Z",
      "x_nadsec_last_seen": "2026-03-18T07:35:59.843Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-18T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CL; asn=269733; asn_org=REDCENTRAL TELECOMUNICACIONES LTDA",
      "id": "indicator--39b4cbf3-5191-4c6f-a7e1-3d783e053a6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.181.122.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:05:02.000Z",
      "valid_until": "2026-04-19T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T07:12:53.806Z",
      "x_nadsec_last_seen": "2026-03-18T07:19:56.537Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "269733"
      ],
      "x_nadsec_orgs": [
        "REDCENTRAL TELECOMUNICACIONES LTDA"
      ]
    },
    {
      "created": "2026-03-18T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JO; asn=8376; asn_org=Jordan Data Communications Company LLC",
      "id": "indicator--85fb35ff-72de-4383-8e33-293215dcfdd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.249.113.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:05:02.000Z",
      "valid_until": "2026-04-19T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T07:28:18.561Z",
      "x_nadsec_last_seen": "2026-03-18T07:32:05.500Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JO"
      ],
      "x_nadsec_asns": [
        "8376"
      ],
      "x_nadsec_orgs": [
        "Jordan Data Communications Company LLC"
      ]
    },
    {
      "created": "2026-03-18T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=25513; asn_org=PJSC Moscow city telephone network",
      "id": "indicator--2f2e1374-18e0-4588-ae21-867ad4599642",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.29.124.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:05:02.000Z",
      "valid_until": "2026-04-19T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T07:51:21.604Z",
      "x_nadsec_last_seen": "2026-03-18T07:59:24.908Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25513"
      ],
      "x_nadsec_orgs": [
        "PJSC Moscow city telephone network"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--bbc157f7-2ac9-436d-bca1-2ed57fba273a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.101.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T09:03:35.320Z",
      "x_nadsec_last_seen": "2026-03-18T09:03:43.044Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45557; asn_org=Vietnam Technology and Telecommunication JSC",
      "id": "indicator--8a17b14f-2994-418b-a7df-3559114085f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.17.91.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T08:58:23.374Z",
      "x_nadsec_last_seen": "2026-03-18T09:00:28.134Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45557"
      ],
      "x_nadsec_orgs": [
        "Vietnam Technology and Telecommunication JSC"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BY; asn=25106; asn_org=Mobile TeleSystems JLLC",
      "id": "indicator--a2b1c40a-4676-4e32-8145-d459ae7f7eb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.17.38.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T08:44:58.857Z",
      "x_nadsec_last_seen": "2026-03-18T08:52:01.930Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "25106"
      ],
      "x_nadsec_orgs": [
        "Mobile TeleSystems JLLC"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e264f860-3b53-4d98-bc2b-6f743d978f5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.106.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T08:49:22.308Z",
      "x_nadsec_last_seen": "2026-03-18T08:51:28.678Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9bdf95a4-404e-4a43-af2c-8aaa6289ce33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.62.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T08:39:32.299Z",
      "x_nadsec_last_seen": "2026-03-18T08:39:32.299Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--2fee66ce-1463-45b4-bb4c-bfc16de29746",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.22.72.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T08:21:44.579Z",
      "x_nadsec_last_seen": "2026-03-25T08:22:15.728Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--28a51ff9-e954-45ae-9938-6681a45259bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.184.118.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T08:14:52.375Z",
      "x_nadsec_last_seen": "2026-03-18T08:14:52.375Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--a6049f24-8650-4273-9511-0542ebef210c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T08:47:42.763Z",
      "x_nadsec_last_seen": "2026-03-18T08:47:42.763Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--4164bcce-5381-43d5-b69f-d589d532dc0c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-14T16:04:29.194Z",
      "x_nadsec_last_seen": "2026-03-18T08:41:02.680Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--61157442-eb1c-45b0-918d-fb6e27ae0fc1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '209.38.135.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T08:39:47.322Z",
      "x_nadsec_last_seen": "2026-03-18T08:39:47.322Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--4495702b-9b27-40b7-a7ca-a17472bc1e7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.130.253.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T08:55:47.291Z",
      "x_nadsec_last_seen": "2026-03-18T09:02:43.479Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--855a83bc-3566-4ca3-994c-0f847ff25209",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.93.100.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T08:26:41.140Z",
      "x_nadsec_last_seen": "2026-03-18T08:27:31.440Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--374eb7e7-55fa-44fd-9fc9-542387b0e5b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.58.48.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T08:12:46.451Z",
      "x_nadsec_last_seen": "2026-03-18T08:14:51.056Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--1a799f61-9cf6-491a-b766-59682c4a1814",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.63.54.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T08:56:11.128Z",
      "x_nadsec_last_seen": "2026-03-18T09:01:04.154Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--a37b510b-57ed-41e1-99a7-32d34ac03483",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T08:31:17.724Z",
      "x_nadsec_last_seen": "2026-03-18T08:31:17.724Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PL; asn=12741; asn_org=Netia SA",
      "id": "indicator--306287fb-6c84-430f-88fd-9ede282e9d26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.10.183.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-18T09:02:25.968Z",
      "x_nadsec_last_seen": "2026-03-23T07:20:15.268Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "12741"
      ],
      "x_nadsec_orgs": [
        "Netia SA"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=45167; cc=RO; asn=204428; asn_org=SS-Net",
      "id": "indicator--cb290b49-f3e9-4e99-84a4-83c9fb0630c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T08:27:42.483Z",
      "x_nadsec_last_seen": "2026-03-25T04:59:08.833Z",
      "x_nadsec_ports": [
        "3306",
        "42",
        "45167"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "204428"
      ],
      "x_nadsec_orgs": [
        "SS-Net"
      ]
    },
    {
      "created": "2026-03-18T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--4ee00dee-5c0e-4552-9135-aa37a5ced0c4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.100.114.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:05:03.000Z",
      "valid_until": "2026-04-19T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T08:32:07.509Z",
      "x_nadsec_last_seen": "2026-03-18T08:39:21.452Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-18T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=24086; asn_org=Viettel Corporation",
      "id": "indicator--b39fd16a-4515-4c10-976c-a5c7104f5677",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.97.218.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:05:02.000Z",
      "valid_until": "2026-04-19T10:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T09:14:45.854Z",
      "x_nadsec_last_seen": "2026-03-18T09:21:13.608Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24086"
      ],
      "x_nadsec_orgs": [
        "Viettel Corporation"
      ]
    },
    {
      "created": "2026-03-18T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262890; asn_org=SARTORI TECNOLOGIA DA INFORMACAO LTDA ME",
      "id": "indicator--a00fc43b-04c3-41dc-91e4-bc54f7da9398",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.22.66.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:05:02.000Z",
      "valid_until": "2026-04-19T10:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-18T09:40:27.568Z",
      "x_nadsec_last_seen": "2026-03-18T11:38:52.269Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262890"
      ],
      "x_nadsec_orgs": [
        "SARTORI TECNOLOGIA DA INFORMACAO LTDA ME"
      ]
    },
    {
      "created": "2026-03-18T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--5420c685-1426-4ce0-a96a-a9d633addeda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.22.255.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:05:02.000Z",
      "valid_until": "2026-04-19T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T09:33:50.550Z",
      "x_nadsec_last_seen": "2026-03-18T09:35:54.953Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-03-18T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f5e18404-d533-4490-854c-9a3c24a3cccc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:05:02.000Z",
      "valid_until": "2026-04-19T10:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T09:38:17.373Z",
      "x_nadsec_last_seen": "2026-03-18T09:38:27.515Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-18T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=17665; asn_org=ONEOTT INTERTAINMENT LIMITED; user(top)=**",
      "id": "indicator--67064104-ff20-40d6-b9da-86c890cd468f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.192.224.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:05:02.000Z",
      "valid_until": "2026-04-19T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T09:14:36.368Z",
      "x_nadsec_last_seen": "2026-03-18T09:14:36.368Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17665"
      ],
      "x_nadsec_orgs": [
        "ONEOTT INTERTAINMENT LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-18T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=RU; asn=29124; asn_org=Iskratelecom JSC",
      "id": "indicator--73bfb66e-9452-4f7b-b06e-41bf21fb5beb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.39.251.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:05:02.000Z",
      "valid_until": "2026-04-19T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T09:20:47.825Z",
      "x_nadsec_last_seen": "2026-03-18T09:20:47.825Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "29124"
      ],
      "x_nadsec_orgs": [
        "Iskratelecom JSC"
      ]
    },
    {
      "created": "2026-03-18T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--89442728-e116-49b6-8fe3-926549456edb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.43.58.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:05:02.000Z",
      "valid_until": "2026-04-19T10:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-16T19:37:58.200Z",
      "x_nadsec_last_seen": "2026-03-18T09:36:58.717Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-03-18T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--ce060406-c0c5-4993-a8a0-ad09c1bd7c08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:05:02.000Z",
      "valid_until": "2026-04-19T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T09:53:48.599Z",
      "x_nadsec_last_seen": "2026-03-18T09:53:48.599Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-18T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--428ea883-2490-4616-b125-2f3f2193da2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.0.18.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:05:02.000Z",
      "valid_until": "2026-04-19T10:05:00.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-18T09:37:30.430Z",
      "x_nadsec_last_seen": "2026-03-26T13:25:59.970Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--b92820d7-b397-4faa-bd0e-ab1443e7fbf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.10.162.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T11:02:24.722Z",
      "x_nadsec_last_seen": "2026-03-18T11:02:24.722Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--301bb4c1-1196-4040-a9ae-9886b2421296",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.171.97.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T10:21:38.749Z",
      "x_nadsec_last_seen": "2026-03-18T10:26:01.849Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=141329; asn_org=Udupi Fastnet Private Limited",
      "id": "indicator--d3add855-2cb8-4269-854a-c53a2fe60c14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.200.74.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T10:15:43.063Z",
      "x_nadsec_last_seen": "2026-03-18T10:17:47.828Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141329"
      ],
      "x_nadsec_orgs": [
        "Udupi Fastnet Private Limited"
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45582; asn_org=VAINAVI INDUSTIES LTD, INTERNET SERVICE PROVIDER, INDIA",
      "id": "indicator--07e5c54f-bd04-421f-9a5c-6192f6468c11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.217.215.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-18T10:34:04.929Z",
      "x_nadsec_last_seen": "2026-03-26T06:40:30.152Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45582"
      ],
      "x_nadsec_orgs": [
        "VAINAVI INDUSTIES LTD, INTERNET SERVICE PROVIDER, INDIA"
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--e5175429-453e-4a18-b226-55e338ddcbc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.77.221.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T10:27:17.597Z",
      "x_nadsec_last_seen": "2026-03-18T10:29:22.491Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--bd0e7007-3663-4d6f-ac52-43503485df9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.165.7.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-18T10:37:36.048Z",
      "x_nadsec_last_seen": "2026-03-18T11:19:48.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=139994; asn_org=PT XL Axiata Tbk",
      "id": "indicator--2a3582a7-8fb1-4ecd-8bfa-7b4a363c02f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.85.206.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T10:30:45.479Z",
      "x_nadsec_last_seen": "2026-03-18T10:32:49.855Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "139994"
      ],
      "x_nadsec_orgs": [
        "PT XL Axiata Tbk"
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=43139; asn_org=Maximum-Net LLC",
      "id": "indicator--92784b2d-5321-4179-a815-6dd0f16e5052",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.158.224.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T10:22:07.919Z",
      "x_nadsec_last_seen": "2026-03-18T10:27:06.088Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "43139"
      ],
      "x_nadsec_orgs": [
        "Maximum-Net LLC"
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=21228; asn_org=Vinasterisk, Pp",
      "id": "indicator--58e8b0b8-1b81-4188-94f6-d6c0784590fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.162.238.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T10:23:57.060Z",
      "x_nadsec_last_seen": "2026-03-18T10:26:03.511Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "21228"
      ],
      "x_nadsec_orgs": [
        "Vinasterisk, Pp"
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=BG; asn=48090; asn_org=Techoff Srv Limited",
      "id": "indicator--4a37b7e5-1aab-44d1-9f4f-ff6237c8e21e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.178.110.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T10:08:47.801Z",
      "x_nadsec_last_seen": "2026-03-18T10:08:47.801Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "48090"
      ],
      "x_nadsec_orgs": [
        "Techoff Srv Limited"
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PH; asn=4775; asn_org=Globe Telecoms",
      "id": "indicator--678dc12a-22ce-4f7d-bd97-17fe9997db8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.127.103.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T11:04:39.501Z",
      "x_nadsec_last_seen": "2026-03-18T11:11:09.839Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "4775"
      ],
      "x_nadsec_orgs": [
        "Globe Telecoms"
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--8378a1c3-ac1e-4332-8a6b-d3609f44404b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T10:30:44.615Z",
      "x_nadsec_last_seen": "2026-03-18T10:30:44.615Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=21479; asn_org=Rostelecom",
      "id": "indicator--378310ac-cc42-4994-b75e-74557937c06e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.221.222.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-18T10:31:55.144Z",
      "x_nadsec_last_seen": "2026-03-26T11:05:42.031Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "21479"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HU; asn=35311; asn_org=PR-TELECOM Zrt.",
      "id": "indicator--6ee27039-63d1-4fa9-af28-69a5419627e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.132.96.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T10:39:24.317Z",
      "x_nadsec_last_seen": "2026-03-18T10:41:30.508Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HU"
      ],
      "x_nadsec_asns": [
        "35311"
      ],
      "x_nadsec_orgs": [
        "PR-TELECOM Zrt."
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--6acafd50-51f4-414e-b1a4-f6c1a020f0ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.241.39.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T10:54:35.042Z",
      "x_nadsec_last_seen": "2026-03-18T10:56:41.741Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-18T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=16010; asn_org=Magticom Ltd.",
      "id": "indicator--048d1db3-e15b-4676-bb2b-af1626886e8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.104.26.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T11:05:03.000Z",
      "valid_until": "2026-04-19T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T10:47:15.116Z",
      "x_nadsec_last_seen": "2026-03-18T10:49:21.979Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "16010"
      ],
      "x_nadsec_orgs": [
        "Magticom Ltd."
      ]
    },
    {
      "created": "2026-03-18T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AO; asn=37119; asn_org=UNITEL",
      "id": "indicator--78d48ccf-3469-49ca-98d3-505b301374ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.172.122.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T12:05:03.000Z",
      "valid_until": "2026-04-19T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T11:43:08.414Z",
      "x_nadsec_last_seen": "2026-03-18T11:45:16.075Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AO"
      ],
      "x_nadsec_asns": [
        "37119"
      ],
      "x_nadsec_orgs": [
        "UNITEL"
      ]
    },
    {
      "created": "2026-03-18T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--cd344406-80ae-495c-b1ac-088397ff3a91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.211.212.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T12:05:03.000Z",
      "valid_until": "2026-04-19T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T11:39:10.349Z",
      "x_nadsec_last_seen": "2026-03-18T11:39:10.349Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-03-18T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b60c4593-2b36-4fb5-bec0-99e21235d8a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.170.153.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T12:05:03.000Z",
      "valid_until": "2026-04-19T12:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-18T11:08:40.768Z",
      "x_nadsec_last_seen": "2026-03-18T11:26:13.862Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-18T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=263432; asn_org=CORPORATIVA TELECOMUNICACOES EIRELI ME",
      "id": "indicator--e4822d4d-639a-4341-bfc6-d4f106e4b469",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.91.76.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T12:05:03.000Z",
      "valid_until": "2026-04-19T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T11:40:59.385Z",
      "x_nadsec_last_seen": "2026-03-18T11:45:38.430Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263432"
      ],
      "x_nadsec_orgs": [
        "CORPORATIVA TELECOMUNICACOES EIRELI ME"
      ]
    },
    {
      "created": "2026-03-18T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ecd95a0f-7153-4b54-9ddd-4caf8613184f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.128.214.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T12:05:03.000Z",
      "valid_until": "2026-04-19T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T11:58:17.666Z",
      "x_nadsec_last_seen": "2026-03-21T10:47:15.764Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-18T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--6e94842c-9408-4dfe-9ad4-5d977d74b58d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.83.220.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T12:05:03.000Z",
      "valid_until": "2026-04-19T12:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-18T11:39:27.193Z",
      "x_nadsec_last_seen": "2026-03-28T09:07:32.357Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-18T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones; user(top)=**",
      "id": "indicator--6c32a000-467c-4a60-984f-61e5aa218d44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.50.118.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T12:05:03.000Z",
      "valid_until": "2026-04-19T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T11:08:09.334Z",
      "x_nadsec_last_seen": "2026-03-18T11:08:09.334Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UY"
      ],
      "x_nadsec_asns": [
        "6057"
      ],
      "x_nadsec_orgs": [
        "Administracion Nacional de Telecomunicaciones"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-18T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--0a9b0d7e-5b06-40c6-8202-039d3f25145d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.30.227.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T12:05:03.000Z",
      "valid_until": "2026-04-19T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T12:03:17.622Z",
      "x_nadsec_last_seen": "2026-03-18T12:15:36.776Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-03-18T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--d9338a73-c514-4c69-bcde-98f629992c56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.32.37.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T12:05:03.000Z",
      "valid_until": "2026-04-19T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T11:50:02.592Z",
      "x_nadsec_last_seen": "2026-03-18T11:50:02.853Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-18T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--1dfd02ec-4786-48df-a892-cb452b3d3a7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.112.78.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T12:05:03.000Z",
      "valid_until": "2026-04-19T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T11:44:59.241Z",
      "x_nadsec_last_seen": "2026-03-18T11:47:05.099Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-18T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--653a046c-050d-4855-b05c-5e7f8fdb5282",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.40.50.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T12:05:03.000Z",
      "valid_until": "2026-04-19T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T11:11:36.128Z",
      "x_nadsec_last_seen": "2026-03-18T11:19:27.750Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-18T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--cfe0fb65-1599-40b9-841d-ea08ce348667",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.109.36.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T12:05:03.000Z",
      "valid_until": "2026-04-19T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T11:27:36.897Z",
      "x_nadsec_last_seen": "2026-03-18T11:29:44.010Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-18T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--5e86bf0d-2422-4a44-bc7a-dbbcc57f7f37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.89.22.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:05:02.000Z",
      "valid_until": "2026-04-19T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T12:06:00.127Z",
      "x_nadsec_last_seen": "2026-03-18T12:08:07.350Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-18T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--ce9ca5c4-f767-480b-be36-8906dde7cf17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.89.68.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:05:02.000Z",
      "valid_until": "2026-04-19T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T12:21:36.340Z",
      "x_nadsec_last_seen": "2026-03-18T12:23:45.410Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-18T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=4800; asn_org=PT Aplikanusa Lintasarta",
      "id": "indicator--2beafb57-d228-4b76-9de3-43a2bb257206",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.168.137.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:05:02.000Z",
      "valid_until": "2026-04-19T13:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T12:26:28.579Z",
      "x_nadsec_last_seen": "2026-03-18T12:26:53.806Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4800"
      ],
      "x_nadsec_orgs": [
        "PT Aplikanusa Lintasarta"
      ]
    },
    {
      "created": "2026-03-18T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=SG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--a8404862-26cf-44b5-9e40-3813c14b1cbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.72.147.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:05:02.000Z",
      "valid_until": "2026-04-19T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T12:54:15.764Z",
      "x_nadsec_last_seen": "2026-03-18T12:54:16.203Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-18T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5e181fac-3d9e-4561-b56b-1ef240f74949",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.59.116.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:05:02.000Z",
      "valid_until": "2026-04-19T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T12:32:53.553Z",
      "x_nadsec_last_seen": "2026-03-21T10:01:48.486Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-18T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--2b71caa2-046b-4818-b7d2-875947da1b5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.242.143.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:05:02.000Z",
      "valid_until": "2026-04-19T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T12:37:38.460Z",
      "x_nadsec_last_seen": "2026-03-18T12:39:44.977Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-18T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--49c4953e-b0e9-4f87-9671-3a78177ce59d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.91.94.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:05:02.000Z",
      "valid_until": "2026-04-19T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T12:27:00.410Z",
      "x_nadsec_last_seen": "2026-03-18T12:27:00.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-18T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--510d13ce-f45c-46ac-90c7-f47368e759e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:05:02.000Z",
      "valid_until": "2026-04-19T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T12:37:34.409Z",
      "x_nadsec_last_seen": "2026-03-18T12:37:44.728Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-18T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37671; asn_org=GLOBALNET-AS",
      "id": "indicator--734b011f-75c5-49b1-bfa6-8f8051d752cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.225.105.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:05:02.000Z",
      "valid_until": "2026-04-19T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T12:34:36.220Z",
      "x_nadsec_last_seen": "2026-03-18T12:36:42.807Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37671"
      ],
      "x_nadsec_orgs": [
        "GLOBALNET-AS"
      ]
    },
    {
      "created": "2026-03-18T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--7ee49255-dd72-4d64-9ca0-81b255a99fe9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:05:02.000Z",
      "valid_until": "2026-04-19T13:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T12:51:50.728Z",
      "x_nadsec_last_seen": "2026-03-24T04:58:09.247Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-18T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:05:02.000Z",
      "valid_until": "2026-04-19T13:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T12:53:39.101Z",
      "x_nadsec_last_seen": "2026-03-30T11:05:58.136Z",
      "x_nadsec_ports": [
        "135",
        "81"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-18T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--7ba0f6a1-5fe1-479b-adc0-342138601235",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.10.223.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:05:02.000Z",
      "valid_until": "2026-04-19T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T13:22:12.850Z",
      "x_nadsec_last_seen": "2026-03-18T13:24:17.712Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-18T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--23e88d5d-b7c7-4702-b188-487badaeb9b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.88.109.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:05:02.000Z",
      "valid_until": "2026-04-19T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T13:21:37.324Z",
      "x_nadsec_last_seen": "2026-03-18T13:25:46.977Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-18T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--3b5efd30-e6b7-4f7b-8120-d95cab574cf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.77.162.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:05:02.000Z",
      "valid_until": "2026-04-19T14:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-13T02:18:35.450Z",
      "x_nadsec_last_seen": "2026-03-18T13:50:30.715Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-18T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--31b9caa8-8410-4eb7-afb2-29bcc64d79f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.19.104.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:05:02.000Z",
      "valid_until": "2026-04-19T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T14:01:12.725Z",
      "x_nadsec_last_seen": "2026-03-18T14:02:09.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-03-18T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--e423ddee-1a00-4100-b04d-38cdbc30189c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.43.237.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:05:02.000Z",
      "valid_until": "2026-04-19T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T14:03:55.905Z",
      "x_nadsec_last_seen": "2026-03-18T14:06:02.320Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-03-18T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--252d284e-65c6-4306-8637-95a54a76c5d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.83.10.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:05:02.000Z",
      "valid_until": "2026-04-19T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T13:53:35.618Z",
      "x_nadsec_last_seen": "2026-03-18T14:00:35.243Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-18T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KR; asn=53813; asn_org=ZSCALER, INC.",
      "id": "indicator--b9815a5d-0c7a-4854-a7ae-069269cac28a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.103.97.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:05:02.000Z",
      "valid_until": "2026-04-19T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T13:45:31.964Z",
      "x_nadsec_last_seen": "2026-03-18T13:47:36.625Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "53813"
      ],
      "x_nadsec_orgs": [
        "ZSCALER, INC."
      ]
    },
    {
      "created": "2026-03-18T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--c3140961-9191-4059-9455-baffc0d30f8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.243.155.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:05:02.000Z",
      "valid_until": "2026-04-19T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T13:59:06.903Z",
      "x_nadsec_last_seen": "2026-03-18T14:01:11.707Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-18T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mirrorc; ports=43829; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c6fbd370-fcac-4eff-b97a-bf965897fcde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.128.66.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:05:02.000Z",
      "valid_until": "2026-04-19T14:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-18T13:50:31.098Z",
      "x_nadsec_last_seen": "2026-03-22T02:06:37.336Z",
      "x_nadsec_ports": [
        "1723",
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "pptpd",
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-18T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--eee7b9cd-9775-4a7f-b38e-a252add2c1a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.37.21.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:05:02.000Z",
      "valid_until": "2026-04-19T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T13:20:22.134Z",
      "x_nadsec_last_seen": "2026-03-18T13:22:29.515Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-18T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=27747; asn_org=Telecentro S.A.",
      "id": "indicator--4ff70dcd-5e2a-4e74-a971-5ad51fea380c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.44.126.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:05:02.000Z",
      "valid_until": "2026-04-19T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T13:14:42.658Z",
      "x_nadsec_last_seen": "2026-03-18T13:14:42.658Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27747"
      ],
      "x_nadsec_orgs": [
        "Telecentro S.A."
      ]
    },
    {
      "created": "2026-03-18T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25513; asn_org=PJSC Moscow city telephone network",
      "id": "indicator--439c502f-126d-4d81-b4a8-d32225c25e4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.135.123.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:05:02.000Z",
      "valid_until": "2026-04-19T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T13:08:40.098Z",
      "x_nadsec_last_seen": "2026-03-18T13:10:46.822Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25513"
      ],
      "x_nadsec_orgs": [
        "PJSC Moscow city telephone network"
      ]
    },
    {
      "created": "2026-03-18T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=24342; asn_org=BRACNet Limited",
      "id": "indicator--c01af967-beea-4bd6-97af-0a888cc29f68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.168.254.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:05:02.000Z",
      "valid_until": "2026-04-19T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T13:35:04.564Z",
      "x_nadsec_last_seen": "2026-03-18T13:37:09.440Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "24342"
      ],
      "x_nadsec_orgs": [
        "BRACNet Limited"
      ]
    },
    {
      "created": "2026-03-18T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--8e740351-7e85-465a-85e3-348f8f20fee6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.49.230.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:05:02.000Z",
      "valid_until": "2026-04-19T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T13:28:14.236Z",
      "x_nadsec_last_seen": "2026-03-18T13:34:34.526Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-18T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--99954f96-e84b-4d60-aa76-bd34d8389206",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.186.165.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T14:05:02.000Z",
      "valid_until": "2026-04-19T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T13:10:09.633Z",
      "x_nadsec_last_seen": "2026-03-18T13:16:54.069Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-18T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--e030fe62-d618-4920-8f30-38fdfb3989c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.123.14.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:05:05.000Z",
      "valid_until": "2026-04-19T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T14:13:37.991Z",
      "x_nadsec_last_seen": "2026-03-18T14:15:43.687Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-18T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--21d17b11-47b7-4647-b031-41b95b0efab9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:05:05.000Z",
      "valid_until": "2026-04-19T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T14:30:37.870Z",
      "x_nadsec_last_seen": "2026-03-18T14:30:37.870Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-18T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=11706; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--bbade563-2dc8-438d-8a4f-c545f721d69f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.176.14.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:05:05.000Z",
      "valid_until": "2026-04-19T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T14:42:47.178Z",
      "x_nadsec_last_seen": "2026-03-18T14:42:47.277Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "11706"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-18T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=46058; asn_org=PT. Triwahana Gemasakti",
      "id": "indicator--2947b3c9-f6ad-4c55-9676-26c0ddc7ec45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.52.59.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:05:05.000Z",
      "valid_until": "2026-04-19T15:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T15:00:58.433Z",
      "x_nadsec_last_seen": "2026-03-18T15:07:50.597Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "46058"
      ],
      "x_nadsec_orgs": [
        "PT. Triwahana Gemasakti"
      ]
    },
    {
      "created": "2026-03-18T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--47abb98b-3e30-468e-b0b9-82f8e18e1def",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '209.9.207.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:05:05.000Z",
      "valid_until": "2026-04-19T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T14:39:02.077Z",
      "x_nadsec_last_seen": "2026-03-18T14:41:07.438Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-03-18T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--a8951c50-8414-4e6e-a7ed-8754d96195d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.6.148.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:05:05.000Z",
      "valid_until": "2026-04-19T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T14:56:08.586Z",
      "x_nadsec_last_seen": "2026-03-18T14:58:15.102Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-03-18T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=39891; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--72bf963f-58f6-4651-a928-d87ca9791623",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.156.38.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:05:05.000Z",
      "valid_until": "2026-04-19T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T14:34:16.013Z",
      "x_nadsec_last_seen": "2026-03-18T14:36:25.574Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "39891"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-18T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=12430; asn_org=Vodafone Spain",
      "id": "indicator--d657d789-80c3-41b1-bf11-365d9fe962ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.224.250.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:05:05.000Z",
      "valid_until": "2026-04-19T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T14:38:29.942Z",
      "x_nadsec_last_seen": "2026-03-18T14:38:35.998Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "12430"
      ],
      "x_nadsec_orgs": [
        "Vodafone Spain"
      ]
    },
    {
      "created": "2026-03-18T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:05:05.000Z",
      "valid_until": "2026-04-19T15:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T14:06:26.351Z",
      "x_nadsec_last_seen": "2026-03-31T14:01:03.275Z",
      "x_nadsec_ports": [
        "21",
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-18T15:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BG; asn=8866; asn_org=Vivacom Bulgaria EAD",
      "id": "indicator--a3c84a51-df14-4953-b935-150fb4b3b180",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T15:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.78.51.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:05:05.000Z",
      "valid_until": "2026-04-19T15:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-18T14:24:10.402Z",
      "x_nadsec_last_seen": "2026-03-23T16:08:16.665Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "8866"
      ],
      "x_nadsec_orgs": [
        "Vivacom Bulgaria EAD"
      ]
    },
    {
      "created": "2026-03-18T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=58498; asn_org=PT Infrastruktur Bisnis Sejahtera",
      "id": "indicator--7be03097-2cec-403f-abb5-617330e1ae50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.225.88.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:05:02.000Z",
      "valid_until": "2026-04-19T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T15:14:42.009Z",
      "x_nadsec_last_seen": "2026-03-18T15:16:46.242Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "58498"
      ],
      "x_nadsec_orgs": [
        "PT Infrastruktur Bisnis Sejahtera"
      ]
    },
    {
      "created": "2026-03-18T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--ae3fe226-9e25-4f11-9f36-a69292b25aee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:05:02.000Z",
      "valid_until": "2026-04-19T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T15:57:06.170Z",
      "x_nadsec_last_seen": "2026-03-18T15:57:06.170Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-18T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--10961372-a463-4deb-a6be-68057033713a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:05:02.000Z",
      "valid_until": "2026-04-19T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T15:49:22.440Z",
      "x_nadsec_last_seen": "2026-03-18T15:49:22.440Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-18T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f0748849-658e-4bf7-bc48-408dc19ab6da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:05:02.000Z",
      "valid_until": "2026-04-19T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T15:48:56.660Z",
      "x_nadsec_last_seen": "2026-03-18T15:48:56.660Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-18T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--1b7264d9-bc20-4d9b-bc52-19cc4b656da4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:05:02.000Z",
      "valid_until": "2026-04-19T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T15:49:23.151Z",
      "x_nadsec_last_seen": "2026-03-18T15:49:23.151Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-18T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=131111; asn_org=PT Mora Telematika Indonesia",
      "id": "indicator--2236e247-6347-4f90-9760-68c9868a777c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.43.178.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:05:02.000Z",
      "valid_until": "2026-04-19T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T15:18:21.088Z",
      "x_nadsec_last_seen": "2026-03-18T15:20:25.374Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "131111"
      ],
      "x_nadsec_orgs": [
        "PT Mora Telematika Indonesia"
      ]
    },
    {
      "created": "2026-03-18T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--cdc03754-4d3b-4a85-b974-8d094a7adf0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.64.169.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:05:02.000Z",
      "valid_until": "2026-04-19T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T15:52:43.502Z",
      "x_nadsec_last_seen": "2026-03-18T15:54:48.240Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-18T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4a4ffe4d-9613-4bf6-940f-83539c5c1dbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.146.90.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:05:02.000Z",
      "valid_until": "2026-04-19T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T15:14:29.687Z",
      "x_nadsec_last_seen": "2026-03-27T10:32:48.139Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-18T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--75f66ae2-0f2c-46d7-997d-2f19298d09ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '96.228.49.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:05:02.000Z",
      "valid_until": "2026-04-19T16:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-18T15:07:57.161Z",
      "x_nadsec_last_seen": "2026-03-23T03:47:18.152Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-03-18T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--71d13357-f7e0-45d1-b0b5-24a3701afe14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.88.110.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T17:05:03.000Z",
      "valid_until": "2026-04-19T17:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T16:35:46.900Z",
      "x_nadsec_last_seen": "2026-03-18T16:43:08.181Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-18T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--34448fd2-97db-4dc8-93d2-8ca5b84fbe63",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.59.111.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T17:05:03.000Z",
      "valid_until": "2026-04-19T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T16:34:40.597Z",
      "x_nadsec_last_seen": "2026-03-21T18:02:27.110Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-18T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--02b561bd-cd8c-4ed5-aa51-16adbd93f4fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.115.214.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T17:05:03.000Z",
      "valid_until": "2026-04-19T17:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T16:41:40.227Z",
      "x_nadsec_last_seen": "2026-03-18T16:41:40.518Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-18T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--61abe61c-d7c8-4c24-b061-fe6897f8a110",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T17:05:03.000Z",
      "valid_until": "2026-04-19T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T16:45:34.402Z",
      "x_nadsec_last_seen": "2026-03-18T16:45:34.402Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-03-18T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--3b1f1acb-9a86-4538-aef6-e5653c715f41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.82.24.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T17:05:03.000Z",
      "valid_until": "2026-04-19T17:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T17:02:12.635Z",
      "x_nadsec_last_seen": "2026-03-18T18:04:15.457Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-03-18T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=11191; asn_org=Cal.net, Inc.",
      "id": "indicator--ecb68190-210a-4170-a432-72106eda54eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.86.186.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T17:05:03.000Z",
      "valid_until": "2026-04-19T17:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T16:12:52.855Z",
      "x_nadsec_last_seen": "2026-03-18T16:19:22.841Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11191"
      ],
      "x_nadsec_orgs": [
        "Cal.net, Inc."
      ]
    },
    {
      "created": "2026-03-18T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=266571; asn_org=PROFIBER TELECOM LTDA",
      "id": "indicator--2ce6f439-b59e-4578-b12c-62c8bc9ba473",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.7.108.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T17:05:03.000Z",
      "valid_until": "2026-04-19T17:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-18T16:14:53.606Z",
      "x_nadsec_last_seen": "2026-03-24T20:03:03.315Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "266571"
      ],
      "x_nadsec_orgs": [
        "PROFIBER TELECOM LTDA"
      ]
    },
    {
      "created": "2026-03-18T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--3f780a4f-bb95-4143-ae99-c546c9dee662",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.111.88.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T17:05:03.000Z",
      "valid_until": "2026-04-19T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T16:08:41.472Z",
      "x_nadsec_last_seen": "2026-03-18T16:10:46.454Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-03-18T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=137172; asn_org=ALL CONNECT NETWORK SERVICES PRIVATE LIMITED",
      "id": "indicator--8d3f3b83-70b3-44bb-bf22-f08a009d0ed5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.112.214.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T18:05:04.000Z",
      "valid_until": "2026-04-19T18:05:02.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-18T17:06:27.545Z",
      "x_nadsec_last_seen": "2026-03-20T15:37:32.278Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "137172"
      ],
      "x_nadsec_orgs": [
        "ALL CONNECT NETWORK SERVICES PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-18T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--9f710bbf-1b98-43d3-a83d-751aa1966496",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.75.36.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T18:05:04.000Z",
      "valid_until": "2026-04-19T18:05:02.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-18T17:14:44.781Z",
      "x_nadsec_last_seen": "2026-03-23T13:34:08.472Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-03-18T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--76d16c67-87d9-4520-8041-4680150cf303",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.27.178.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T18:05:04.000Z",
      "valid_until": "2026-04-19T18:05:02.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-18T17:10:16.477Z",
      "x_nadsec_last_seen": "2026-03-27T07:44:35.015Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-18T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CH; asn=212238; asn_org=Datacamp Limited",
      "id": "indicator--68b55e35-03e4-4549-82bb-163b2b251319",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '158.173.152.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T18:05:04.000Z",
      "valid_until": "2026-04-19T18:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-16T23:21:25.893Z",
      "x_nadsec_last_seen": "2026-03-18T17:42:41.023Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "212238"
      ],
      "x_nadsec_orgs": [
        "Datacamp Limited"
      ]
    },
    {
      "created": "2026-03-18T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.; user(top)=**",
      "id": "indicator--b26951bf-f97f-48fa-bd38-0b1b51d54686",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.195.176.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T18:05:04.000Z",
      "valid_until": "2026-04-19T18:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T17:46:56.443Z",
      "x_nadsec_last_seen": "2026-03-18T17:46:56.443Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-18T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ba79c6bc-c539-4fc2-be5b-c2b52d2c8281",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T18:05:04.000Z",
      "valid_until": "2026-04-19T18:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T17:37:56.357Z",
      "x_nadsec_last_seen": "2026-03-18T17:37:56.357Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-18T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b8cf2cd4-940b-469e-8544-7b1db4bb9d43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T18:05:04.000Z",
      "valid_until": "2026-04-19T18:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T17:25:25.724Z",
      "x_nadsec_last_seen": "2026-03-18T17:25:25.724Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-18T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--e7ff4d17-da19-4232-9e29-e5d0d4248148",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T18:05:04.000Z",
      "valid_until": "2026-04-19T18:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T17:18:50.923Z",
      "x_nadsec_last_seen": "2026-03-18T17:18:50.923Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-18T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=39657; asn_org=Comeser S.r.l.",
      "id": "indicator--54e8ace5-66f1-413e-807b-8164bd5971f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.30.29.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T18:05:04.000Z",
      "valid_until": "2026-04-19T18:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T17:42:22.476Z",
      "x_nadsec_last_seen": "2026-03-18T17:44:29.471Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "39657"
      ],
      "x_nadsec_orgs": [
        "Comeser S.r.l."
      ]
    },
    {
      "created": "2026-03-18T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=JP; asn=2518; asn_org=BIGLOBE Inc.",
      "id": "indicator--75ba27ff-d0db-448f-bcde-2ee004817cdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.196.95.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T19:05:03.000Z",
      "valid_until": "2026-04-19T19:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-18T18:05:34.353Z",
      "x_nadsec_last_seen": "2026-03-18T20:09:35.394Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "2518"
      ],
      "x_nadsec_orgs": [
        "BIGLOBE Inc."
      ]
    },
    {
      "created": "2026-03-18T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BW; asn=37678; asn_org=BOFINET",
      "id": "indicator--73618724-b303-4dc7-a7cd-8cb3aeedcd17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '129.205.245.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T19:05:03.000Z",
      "valid_until": "2026-04-19T19:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-18T19:00:07.543Z",
      "x_nadsec_last_seen": "2026-03-25T17:15:08.768Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BW"
      ],
      "x_nadsec_asns": [
        "37678"
      ],
      "x_nadsec_orgs": [
        "BOFINET"
      ]
    },
    {
      "created": "2026-03-18T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=IN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--5284e861-ae70-49ff-b828-3687e08385e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.159.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T19:05:03.000Z",
      "valid_until": "2026-04-19T19:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T19:04:01.713Z",
      "x_nadsec_last_seen": "2026-03-18T19:04:22.481Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-18T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=PH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e0cb8a6b-c1c2-468e-89d0-1adc44d2b610",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.59.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T19:05:03.000Z",
      "valid_until": "2026-04-19T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T18:51:38.283Z",
      "x_nadsec_last_seen": "2026-03-18T18:52:07.440Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-18T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--2414dd7e-ff90-4d7c-b699-0f14db5af2b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T19:05:03.000Z",
      "valid_until": "2026-04-19T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T18:17:56.360Z",
      "x_nadsec_last_seen": "2026-03-18T18:18:26.361Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-18T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c046778d-3313-4599-bd8c-a7665eca08e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T19:05:03.000Z",
      "valid_until": "2026-04-19T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T18:38:31.378Z",
      "x_nadsec_last_seen": "2026-03-18T18:38:32.894Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-18T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--e0376fa5-6a8a-4aad-a8a6-ee02e78abad6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.189.227.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T19:05:03.000Z",
      "valid_until": "2026-04-19T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T19:02:56.420Z",
      "x_nadsec_last_seen": "2026-03-26T00:20:43.024Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-18T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--cd8cdb13-f822-481d-a672-6e77fe22a1eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.216.140.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T19:05:03.000Z",
      "valid_until": "2026-04-19T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T18:47:06.522Z",
      "x_nadsec_last_seen": "2026-03-18T18:47:12.800Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-18T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--175a7ac2-7d2b-4166-92de-2166f9995fd4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.168.193.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:05:03.000Z",
      "valid_until": "2026-04-19T20:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T19:24:55.951Z",
      "x_nadsec_last_seen": "2026-03-18T19:31:20.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-18T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=58563; asn_org=CHINANET Hubei province network",
      "id": "indicator--3edb8c59-23fe-4366-8639-40173e30cc23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.96.55.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:05:03.000Z",
      "valid_until": "2026-04-19T20:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-16T21:35:23.768Z",
      "x_nadsec_last_seen": "2026-03-27T23:50:37.705Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "58563"
      ],
      "x_nadsec_orgs": [
        "CHINANET Hubei province network"
      ]
    },
    {
      "created": "2026-03-18T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=GB; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d4d2d010-d546-4266-9634-71c46fecd6c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.35.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:05:03.000Z",
      "valid_until": "2026-04-19T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T19:29:12.220Z",
      "x_nadsec_last_seen": "2026-03-18T19:29:12.220Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-18T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--f949b02a-8da3-409f-85a2-28ac47138245",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.54.228.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:05:03.000Z",
      "valid_until": "2026-04-19T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T19:46:38.380Z",
      "x_nadsec_last_seen": "2026-03-18T19:48:45.307Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-18T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--258b4091-8c64-4cb6-9634-395f508293b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:05:03.000Z",
      "valid_until": "2026-04-19T20:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-12T23:46:46.352Z",
      "x_nadsec_last_seen": "2026-03-31T19:10:31.343Z",
      "x_nadsec_ports": [
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-18T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1c5f3e8f-92dd-4d94-a03e-9c515f511092",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.67.161.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:05:03.000Z",
      "valid_until": "2026-04-19T20:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T19:49:21.400Z",
      "x_nadsec_last_seen": "2026-03-20T03:39:20.040Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-18T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--cf0bc264-fc37-4ff7-9434-bcc4334baab8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.188.61.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:05:03.000Z",
      "valid_until": "2026-04-19T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T19:27:30.739Z",
      "x_nadsec_last_seen": "2026-03-18T19:29:40.179Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-18T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--000e7147-b14d-46bc-b6c4-dc91a4511b64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:05:03.000Z",
      "valid_until": "2026-04-19T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T19:22:14.483Z",
      "x_nadsec_last_seen": "2026-03-25T19:16:12.617Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-18T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3e0129f8-5efa-4de1-9aec-04f56c1f36ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:05:03.000Z",
      "valid_until": "2026-04-19T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T19:21:40.457Z",
      "x_nadsec_last_seen": "2026-03-18T19:21:40.688Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-18T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=15468; asn_org=KLGELECS-AS PJSC Rostelecom. Kaluga branch",
      "id": "indicator--cdeb1449-bd38-479f-b813-bf264641be84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.242.160.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:05:03.000Z",
      "valid_until": "2026-04-19T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T19:32:14.005Z",
      "x_nadsec_last_seen": "2026-03-18T19:34:20.943Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "15468"
      ],
      "x_nadsec_orgs": [
        "KLGELECS-AS PJSC Rostelecom. Kaluga branch"
      ]
    },
    {
      "created": "2026-03-18T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--1ec6b7d2-2287-4f2e-9166-a8e2505353b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.188.82.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:05:03.000Z",
      "valid_until": "2026-04-19T20:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T19:50:58.249Z",
      "x_nadsec_last_seen": "2026-03-18T19:57:00.173Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-18T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MY; asn=9534; asn_org=Binariang Berhad",
      "id": "indicator--1aabc80e-0d81-404f-8791-0241c6be49d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.122.29.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T21:05:02.000Z",
      "valid_until": "2026-04-19T21:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-18T20:16:03.326Z",
      "x_nadsec_last_seen": "2026-03-24T05:38:52.409Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9534"
      ],
      "x_nadsec_orgs": [
        "Binariang Berhad"
      ]
    },
    {
      "created": "2026-03-18T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0e3a72f9-4251-480e-8c04-9011921e2c06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.163.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T21:05:02.000Z",
      "valid_until": "2026-04-19T21:05:01.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-03-18T20:37:15.110Z",
      "x_nadsec_last_seen": "2026-03-18T20:40:03.934Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-18T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=35805; asn_org=JSC Silknet",
      "id": "indicator--1ebb64e2-8bf5-4838-93c3-ba652ec1cdbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.255.242.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T21:05:02.000Z",
      "valid_until": "2026-04-19T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T20:40:19.970Z",
      "x_nadsec_last_seen": "2026-03-18T20:42:26.758Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "35805"
      ],
      "x_nadsec_orgs": [
        "JSC Silknet"
      ]
    },
    {
      "created": "2026-03-18T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2f5937b2-b984-4c17-a562-0a7388fc1f80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.185.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T21:05:02.000Z",
      "valid_until": "2026-04-19T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T20:37:03.556Z",
      "x_nadsec_last_seen": "2026-03-18T20:37:23.092Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-18T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0b2ec72e-b29d-4e79-adfb-368dad3585ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.223.177.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T21:05:02.000Z",
      "valid_until": "2026-04-19T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T20:40:07.124Z",
      "x_nadsec_last_seen": "2026-03-18T20:40:07.124Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-18T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--2dc950cc-2456-4638-94c8-2d349f7bc1b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.54.202.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T21:05:02.000Z",
      "valid_until": "2026-04-19T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T20:23:50.965Z",
      "x_nadsec_last_seen": "2026-03-18T20:25:57.487Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-18T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA",
      "id": "indicator--5f8710b4-d55d-4db1-83ae-653144b8c8cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.53.102.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T21:05:02.000Z",
      "valid_until": "2026-04-19T21:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-18T20:05:40.078Z",
      "x_nadsec_last_seen": "2026-03-19T00:48:23.361Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ]
    },
    {
      "created": "2026-03-18T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--73f0407e-9189-4fe7-b485-a3bcbf8999bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.135.194.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T21:05:02.000Z",
      "valid_until": "2026-04-19T21:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-18T20:31:20.024Z",
      "x_nadsec_last_seen": "2026-03-19T08:31:53.221Z",
      "x_nadsec_ports": [
        "81",
        "3306",
        "21",
        "445",
        "1433",
        "1723",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld",
        "ftpd",
        "mongod",
        "mqttd",
        "mssqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-18T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--d5bce797-55a8-4964-81c5-a87616743e02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.61.129.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T21:05:02.000Z",
      "valid_until": "2026-04-19T21:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T20:09:10.953Z",
      "x_nadsec_last_seen": "2026-03-18T20:15:36.514Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-03-18T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--ab8cc3c2-f709-4eb1-a925-6975597da342",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.96.56.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:05:03.000Z",
      "valid_until": "2026-04-19T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T21:15:18.714Z",
      "x_nadsec_last_seen": "2026-03-18T21:17:25.412Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-18T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--38185fa0-626a-49e0-85c0-5f9f2fcf1abc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:05:03.000Z",
      "valid_until": "2026-04-19T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T21:06:32.317Z",
      "x_nadsec_last_seen": "2026-03-18T21:06:32.317Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-18T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c4143c81-ca52-4a5e-b429-ebc75490dbe6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:05:03.000Z",
      "valid_until": "2026-04-19T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T21:18:23.063Z",
      "x_nadsec_last_seen": "2026-03-18T21:18:23.063Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-18T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--32cc76ad-90fd-4039-b719-0dd7f0573996",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.6.144.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:05:03.000Z",
      "valid_until": "2026-04-19T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T21:07:09.092Z",
      "x_nadsec_last_seen": "2026-03-18T21:07:11.464Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-03-18T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--515bd823-4a4f-4fa7-9f75-522433cccf85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.184.146.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:05:03.000Z",
      "valid_until": "2026-04-19T22:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T21:19:32.172Z",
      "x_nadsec_last_seen": "2026-03-18T21:26:00.341Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-03-18T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5203c22e-a03f-41b7-b7d9-07ff6b7cfa1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:05:03.000Z",
      "valid_until": "2026-04-19T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-18T21:58:49.318Z",
      "x_nadsec_last_seen": "2026-03-18T21:58:59.479Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-18T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--a8e34f7f-cc92-4175-be97-598ad0dbbb3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.10.0.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:05:03.000Z",
      "valid_until": "2026-04-19T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T21:23:23.711Z",
      "x_nadsec_last_seen": "2026-03-18T21:25:30.921Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-18T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--54997895-a903-4e1d-a3fa-4d770f6fde15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:05:03.000Z",
      "valid_until": "2026-04-19T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T22:00:37.182Z",
      "x_nadsec_last_seen": "2026-03-18T22:00:37.182Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-18T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--94ce3fdc-03ba-4fb3-86f5-9e575211baf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:05:03.000Z",
      "valid_until": "2026-04-19T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T22:00:47.518Z",
      "x_nadsec_last_seen": "2026-03-18T22:00:47.518Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-18T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NP; asn=23752; asn_org=Nepal Telecommunications Corporation, Internet Services",
      "id": "indicator--d2880846-a4a1-411a-8adf-3c1d2394f426",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.199.227.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T23:05:03.000Z",
      "valid_until": "2026-04-19T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T22:33:24.933Z",
      "x_nadsec_last_seen": "2026-03-18T22:35:29.836Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "23752"
      ],
      "x_nadsec_orgs": [
        "Nepal Telecommunications Corporation, Internet Services"
      ]
    },
    {
      "created": "2026-03-18T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited",
      "id": "indicator--6db4cfac-25af-438b-9b25-6db787122fca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.207.199.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T23:05:03.000Z",
      "valid_until": "2026-04-19T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T22:55:13.700Z",
      "x_nadsec_last_seen": "2026-03-18T22:57:20.255Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "45090"
      ],
      "x_nadsec_orgs": [
        "Shenzhen Tencent Computer Systems Company Limited"
      ]
    },
    {
      "created": "2026-03-18T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=5650; asn_org=Frontier Communications of America, Inc.",
      "id": "indicator--69a4e2e8-e081-448d-b867-ef148fcbbe91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.109.218.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T23:05:03.000Z",
      "valid_until": "2026-04-19T23:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-18T22:54:09.618Z",
      "x_nadsec_last_seen": "2026-03-30T02:17:17.209Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "5650"
      ],
      "x_nadsec_orgs": [
        "Frontier Communications of America, Inc."
      ]
    },
    {
      "created": "2026-03-18T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=27831; asn_org=Colombia Movil",
      "id": "indicator--946057fd-49f3-4d44-b69a-fc0aaa252b90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.204.84.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T23:05:03.000Z",
      "valid_until": "2026-04-19T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-18T22:08:04.085Z",
      "x_nadsec_last_seen": "2026-03-18T22:10:10.465Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "27831"
      ],
      "x_nadsec_orgs": [
        "Colombia Movil"
      ]
    },
    {
      "created": "2026-03-18T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--c187ebe0-ed98-466f-ab6f-ed3abdd47f08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.235.175.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T23:05:03.000Z",
      "valid_until": "2026-04-19T23:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T22:52:06.172Z",
      "x_nadsec_last_seen": "2026-03-18T22:58:56.553Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-18T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--21e6f3cd-84af-4861-be6b-e490bd51ae2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T23:05:03.000Z",
      "valid_until": "2026-04-19T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T22:23:48.387Z",
      "x_nadsec_last_seen": "2026-03-18T22:23:48.387Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-18T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NP; asn=23752; asn_org=Nepal Telecommunications Corporation, Internet Services",
      "id": "indicator--3526a36d-fc6a-456e-9a33-e90118034c06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.244.68.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T23:05:03.000Z",
      "valid_until": "2026-04-19T23:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-18T22:22:12.860Z",
      "x_nadsec_last_seen": "2026-03-19T08:04:38.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "23752"
      ],
      "x_nadsec_orgs": [
        "Nepal Telecommunications Corporation, Internet Services"
      ]
    },
    {
      "created": "2026-03-18T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=ftpd; ports=21; cc=RU; asn=34665; asn_org=Petersburg Internet Network ltd.",
      "id": "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-18T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.101.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T23:05:03.000Z",
      "valid_until": "2026-04-19T23:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-18T22:05:15.186Z",
      "x_nadsec_last_seen": "2026-03-18T22:09:39.085Z",
      "x_nadsec_ports": [
        "1723",
        "3306",
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd",
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "34665"
      ],
      "x_nadsec_orgs": [
        "Petersburg Internet Network ltd."
      ]
    },
    {
      "created": "2026-03-19T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=138754; asn_org=Kerala Vision Broad Band Private Limited",
      "id": "indicator--f87cbb16-908d-470e-ab38-6e54f9b68dde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.42.199.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:05:03.000Z",
      "valid_until": "2026-04-20T00:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T23:58:02.150Z",
      "x_nadsec_last_seen": "2026-03-18T23:58:27.502Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138754"
      ],
      "x_nadsec_orgs": [
        "Kerala Vision Broad Band Private Limited"
      ]
    },
    {
      "created": "2026-03-19T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--fee3b844-e0ff-4f00-a50a-de39a83ca50b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.183.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:05:03.000Z",
      "valid_until": "2026-04-20T00:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-19T00:04:05.879Z",
      "x_nadsec_last_seen": "2026-03-19T00:25:14.816Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-19T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--050a5304-0715-4091-9e48-b6d2b33abcaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:05:03.000Z",
      "valid_until": "2026-04-20T00:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-19T00:02:54.059Z",
      "x_nadsec_last_seen": "2026-03-29T15:52:40.317Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-03-19T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=LB; asn=9051; asn_org=IncoNet Data Management sal",
      "id": "indicator--e7b60f2f-e5d1-4d87-96d8-0a4957937ce2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.124.213.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:05:03.000Z",
      "valid_until": "2026-04-20T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T00:00:11.522Z",
      "x_nadsec_last_seen": "2026-03-19T00:02:18.115Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LB"
      ],
      "x_nadsec_asns": [
        "9051"
      ],
      "x_nadsec_orgs": [
        "IncoNet Data Management sal"
      ]
    },
    {
      "created": "2026-03-19T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=264628; asn_org=CORPORACION FIBEX TELECOM, C.A.",
      "id": "indicator--46ecefa5-ea10-48b5-b73d-59d94c9205a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.89.29.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:05:03.000Z",
      "valid_until": "2026-04-20T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T23:07:09.577Z",
      "x_nadsec_last_seen": "2026-03-18T23:11:19.565Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "264628"
      ],
      "x_nadsec_orgs": [
        "CORPORACION FIBEX TELECOM, C.A."
      ]
    },
    {
      "created": "2026-03-19T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--42c7b512-c14f-49e1-a66f-47427f965acf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:05:03.000Z",
      "valid_until": "2026-04-20T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T23:48:07.791Z",
      "x_nadsec_last_seen": "2026-03-18T23:48:07.791Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-19T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--88c5c34f-570d-447c-9f62-978a795349c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.106.57.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:05:03.000Z",
      "valid_until": "2026-04-20T00:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T23:13:21.600Z",
      "x_nadsec_last_seen": "2026-03-28T06:58:32.615Z",
      "x_nadsec_ports": [
        "81",
        "1433"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-19T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--95053c99-e110-45f9-b28f-95102538951d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.22.117.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:05:03.000Z",
      "valid_until": "2026-04-20T00:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-13T00:21:47.482Z",
      "x_nadsec_last_seen": "2026-03-19T00:57:20.046Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-19T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=29975; asn_org=VODACOM",
      "id": "indicator--b90218c3-2c29-4db2-bcfb-87f11ce5f824",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.13.164.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:05:03.000Z",
      "valid_until": "2026-04-20T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-18T23:44:56.132Z",
      "x_nadsec_last_seen": "2026-03-18T23:52:55.978Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "29975"
      ],
      "x_nadsec_orgs": [
        "VODACOM"
      ]
    },
    {
      "created": "2026-03-19T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--97c841d5-9a19-424f-926f-7fca01106312",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:05:03.000Z",
      "valid_until": "2026-04-20T00:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T23:36:52.318Z",
      "x_nadsec_last_seen": "2026-03-26T16:42:51.031Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-19T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--9133bb7a-3fdc-4fd0-be55-d5f9ef46471b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:05:03.000Z",
      "valid_until": "2026-04-20T00:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-18T23:18:11.909Z",
      "x_nadsec_last_seen": "2026-03-20T13:32:22.053Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-19T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=215925; asn_org=Vpsvault.host Ltd",
      "id": "indicator--c0bdf5da-4a08-430e-bcf2-cfb34950e254",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.120.191.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:05:03.000Z",
      "valid_until": "2026-04-20T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-18T23:05:47.133Z",
      "x_nadsec_last_seen": "2026-03-18T23:05:47.133Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215925"
      ],
      "x_nadsec_orgs": [
        "Vpsvault.host Ltd"
      ]
    },
    {
      "created": "2026-03-19T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=50439; asn_org=City Telephone Network Ltd.",
      "id": "indicator--c56dbf3b-46b6-4fa6-bbd5-66483ac3633a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.196.215.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:05:03.000Z",
      "valid_until": "2026-04-20T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T00:57:54.860Z",
      "x_nadsec_last_seen": "2026-03-19T01:00:01.844Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50439"
      ],
      "x_nadsec_orgs": [
        "City Telephone Network Ltd."
      ]
    },
    {
      "created": "2026-03-19T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--f926ee41-9643-424b-b253-4cdf7ebba7a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.193.188.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:05:03.000Z",
      "valid_until": "2026-04-20T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T00:55:42.969Z",
      "x_nadsec_last_seen": "2026-03-19T00:57:49.069Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-19T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--a5d16a08-5c0f-429c-9d46-b3948f11b275",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.253.79.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:05:03.000Z",
      "valid_until": "2026-04-20T01:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-19T00:55:00.602Z",
      "x_nadsec_last_seen": "2026-03-29T23:58:05.590Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-19T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2c536675-133d-4c66-a940-cd5cb1ec00ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.203.200.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:05:03.000Z",
      "valid_until": "2026-04-20T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T00:13:24.165Z",
      "x_nadsec_last_seen": "2026-03-19T00:13:24.516Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-19T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--535e7574-02a6-471c-ac07-f140d84fb061",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.185.223.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:05:03.000Z",
      "valid_until": "2026-04-20T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T00:07:04.846Z",
      "x_nadsec_last_seen": "2026-03-19T00:08:28.150Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-19T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.",
      "id": "indicator--c30edf42-d9b2-459e-9ccb-953fc68570a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.52.113.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:05:03.000Z",
      "valid_until": "2026-04-20T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T00:32:46.489Z",
      "x_nadsec_last_seen": "2026-03-19T00:32:46.662Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11172"
      ],
      "x_nadsec_orgs": [
        "Alestra, S. de R.L. de C.V."
      ]
    },
    {
      "created": "2026-03-19T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--f8a3d1bf-aeea-44f7-aaa7-6ad34a4c213d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.23.241.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:05:03.000Z",
      "valid_until": "2026-04-20T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T00:55:27.560Z",
      "x_nadsec_last_seen": "2026-03-19T00:55:27.560Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-19T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--62e3c9d0-e6b6-4ff8-8347-2824d01ddb7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:05:03.000Z",
      "valid_until": "2026-04-20T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T01:02:25.085Z",
      "x_nadsec_last_seen": "2026-03-19T01:02:25.085Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-19T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=196797; asn_org=Joint Stock Company TransTeleCom",
      "id": "indicator--8a4edbf8-2b33-4d16-834e-41cc5349788f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.125.95.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:05:03.000Z",
      "valid_until": "2026-04-20T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T00:54:52.737Z",
      "x_nadsec_last_seen": "2026-03-19T00:56:59.905Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "196797"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company TransTeleCom"
      ]
    },
    {
      "created": "2026-03-19T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--7b8d96c0-2dd2-4ab3-9edf-98be1e44dcbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.190.223.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:05:03.000Z",
      "valid_until": "2026-04-20T01:05:01.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-03-19T00:07:55.520Z",
      "x_nadsec_last_seen": "2026-03-19T00:10:47.974Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-03-19T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--f4d89026-7423-426d-993a-04736a6aeeac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.117.111.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:05:03.000Z",
      "valid_until": "2026-04-20T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T01:24:26.900Z",
      "x_nadsec_last_seen": "2026-03-19T01:24:26.900Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-19T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--bee55ddc-e79a-41e6-a2f1-6b1f28de4176",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.87.254.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:05:03.000Z",
      "valid_until": "2026-04-20T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T01:52:29.797Z",
      "x_nadsec_last_seen": "2026-03-19T01:52:29.797Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-19T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MY; asn=9534; asn_org=Binariang Berhad",
      "id": "indicator--da9e30b3-f140-4e59-8f34-31f785e60fcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.123.6.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:05:03.000Z",
      "valid_until": "2026-04-20T02:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-19T01:22:15.711Z",
      "x_nadsec_last_seen": "2026-03-19T01:22:20.263Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9534"
      ],
      "x_nadsec_orgs": [
        "Binariang Berhad"
      ]
    },
    {
      "created": "2026-03-19T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=264111; asn_org=RedeBr Telecom",
      "id": "indicator--0c474e9c-adca-4422-aeda-0ce4b404f9f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.97.14.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:05:03.000Z",
      "valid_until": "2026-04-20T02:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-19T01:13:58.274Z",
      "x_nadsec_last_seen": "2026-03-29T11:42:58.351Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264111"
      ],
      "x_nadsec_orgs": [
        "RedeBr Telecom"
      ]
    },
    {
      "created": "2026-03-19T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--80a81e52-7c3d-4d97-ac2c-0fec7cf52961",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:05:03.000Z",
      "valid_until": "2026-04-20T02:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T01:31:56.672Z",
      "x_nadsec_last_seen": "2026-03-19T11:37:58.954Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-19T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--6df485d9-c5a1-4a6d-ac49-93c2b1dcd892",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.82.121.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:05:03.000Z",
      "valid_until": "2026-04-20T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T01:24:59.490Z",
      "x_nadsec_last_seen": "2026-03-19T01:27:05.167Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-19T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ES; asn=56882; asn_org=Aire Networks Del Mediterraneo Sl Unipersonal",
      "id": "indicator--f06f068c-aa66-465c-b1d5-98251e0cc42b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.130.153.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:05:03.000Z",
      "valid_until": "2026-04-20T02:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T01:42:48.701Z",
      "x_nadsec_last_seen": "2026-03-19T01:42:49.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "56882"
      ],
      "x_nadsec_orgs": [
        "Aire Networks Del Mediterraneo Sl Unipersonal"
      ]
    },
    {
      "created": "2026-03-19T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--0d716378-bd35-4af0-bb53-8c16cd96b7e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '90.188.12.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:05:03.000Z",
      "valid_until": "2026-04-20T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T01:06:29.919Z",
      "x_nadsec_last_seen": "2026-03-19T01:08:37.004Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-19T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--337003d6-58fe-4dd7-9979-7bcae10ef315",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.28.194.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:05:05.000Z",
      "valid_until": "2026-04-20T03:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-19T03:01:16.764Z",
      "x_nadsec_last_seen": "2026-03-22T18:36:03.455Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-03-19T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--0eca8bac-067d-4365-88ca-d22fd41b64f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.6.198.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:05:05.000Z",
      "valid_until": "2026-04-20T03:05:01.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-03-19T02:44:33.401Z",
      "x_nadsec_last_seen": "2026-03-19T02:48:23.809Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-19T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MO; asn=4609; asn_org=Companhia de Telecomunicacoes de Macau SARL",
      "id": "indicator--da042559-9f1b-46f9-b704-bd5ee5d18c1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.31.42.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:05:05.000Z",
      "valid_until": "2026-04-20T03:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-19T02:36:30.590Z",
      "x_nadsec_last_seen": "2026-03-19T04:33:56.715Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MO"
      ],
      "x_nadsec_asns": [
        "4609"
      ],
      "x_nadsec_orgs": [
        "Companhia de Telecomunicacoes de Macau SARL"
      ]
    },
    {
      "created": "2026-03-19T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d6e414cf-9fd6-474e-99b2-2dc5809c91ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.179.231.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:05:05.000Z",
      "valid_until": "2026-04-20T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T02:47:21.101Z",
      "x_nadsec_last_seen": "2026-03-19T02:53:58.711Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-19T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--9af29618-46f6-4364-8fa4-0c542724fd7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.191.38.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:05:05.000Z",
      "valid_until": "2026-04-20T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T02:55:51.658Z",
      "x_nadsec_last_seen": "2026-03-19T02:55:56.490Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-19T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=22689; asn_org=SERCOMTEL SA TELECOMUNICACOES",
      "id": "indicator--2557b3f1-5eef-407e-8df2-d3aa44ef980b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.76.42.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:05:05.000Z",
      "valid_until": "2026-04-20T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T02:58:42.994Z",
      "x_nadsec_last_seen": "2026-03-19T03:00:49.606Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "22689"
      ],
      "x_nadsec_orgs": [
        "SERCOMTEL SA TELECOMUNICACOES"
      ]
    },
    {
      "created": "2026-03-19T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=ftpd; ports=21; cc=AU; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--d4225d28-8876-461a-88dd-495a045f11ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.46.221.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:05:05.000Z",
      "valid_until": "2026-04-20T03:05:01.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-03-19T02:23:44.065Z",
      "x_nadsec_last_seen": "2026-03-19T07:16:55.254Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-19T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mongod; ports=27017; cc=US; asn=36352; asn_org=HostPapa",
      "id": "indicator--e09fa7cf-c404-4c30-84c3-0bb61e7aef37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '23.95.86.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:05:05.000Z",
      "valid_until": "2026-04-20T03:05:01.000Z",
      "x_nadsec_event_count": 26,
      "x_nadsec_first_seen": "2026-03-19T02:11:17.421Z",
      "x_nadsec_last_seen": "2026-03-28T10:46:27.807Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "36352"
      ],
      "x_nadsec_orgs": [
        "HostPapa"
      ]
    },
    {
      "created": "2026-03-19T03:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=36914; asn_org=Kenya Education Network",
      "id": "indicator--addf46aa-10e4-4dd1-9098-427afdb9b722",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T03:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.89.71.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:05:05.000Z",
      "valid_until": "2026-04-20T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T02:51:13.568Z",
      "x_nadsec_last_seen": "2026-03-19T02:56:39.171Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "36914"
      ],
      "x_nadsec_orgs": [
        "Kenya Education Network"
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b5b40168-9f56-4c5a-bcfe-09ed319d0234",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.131.64.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T03:10:33.019Z",
      "x_nadsec_last_seen": "2026-03-19T03:10:33.019Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--704a5706-f717-4dc1-b6d5-c4fd9c7ee53a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.4.90.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T03:55:39.076Z",
      "x_nadsec_last_seen": "2026-03-19T03:57:43.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--ddabe150-d5ef-4d64-8046-8804ab9a46f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.106.232.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T03:13:11.263Z",
      "x_nadsec_last_seen": "2026-03-19T03:13:18.442Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--bb051d08-854d-4939-a022-ac4a1b5f9dee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.62.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T03:33:41.924Z",
      "x_nadsec_last_seen": "2026-03-19T03:35:46.704Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--16823d29-3a0c-49b6-ad85-a0eca21976bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.245.182.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T03:23:55.409Z",
      "x_nadsec_last_seen": "2026-03-19T03:23:55.409Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--31749a30-ec0b-4f7d-adf1-c39f64eac6ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.48.108.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T03:40:16.898Z",
      "x_nadsec_last_seen": "2026-03-19T03:51:11.809Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--904ff349-5cb8-4e26-a7a8-d339bef9bd15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-16T20:04:52.938Z",
      "x_nadsec_last_seen": "2026-03-21T09:55:02.588Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=LA; asn=9873; asn_org=Lao Telecom Communication, LTC",
      "id": "indicator--13e6a3a9-c439-478d-89aa-82878a59f709",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.137.138.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T04:01:42.354Z",
      "x_nadsec_last_seen": "2026-03-19T04:01:42.501Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "9873"
      ],
      "x_nadsec_orgs": [
        "Lao Telecom Communication, LTC"
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17747; asn_org=SITI NETWORKS LIMITED",
      "id": "indicator--bc22c27a-db6c-4400-8f95-486111e58a9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.81.243.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-19T03:48:50.734Z",
      "x_nadsec_last_seen": "2026-03-19T05:20:35.825Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17747"
      ],
      "x_nadsec_orgs": [
        "SITI NETWORKS LIMITED"
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--63aa6367-bb2c-4c4f-9bf0-cf15ba0fcf2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.53.178.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-19T03:50:58.716Z",
      "x_nadsec_last_seen": "2026-03-23T03:25:52.911Z",
      "x_nadsec_ports": [
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--28505e21-022e-43f0-8b55-6b886ae2ced0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T03:25:33.729Z",
      "x_nadsec_last_seen": "2026-03-23T17:39:29.449Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=64419; asn_org=Ecotel, Ltd.",
      "id": "indicator--0ddac989-6d0b-46f6-92b8-0bad5df2d96e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.137.159.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-19T03:14:24.555Z",
      "x_nadsec_last_seen": "2026-03-19T03:15:17.454Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "64419"
      ],
      "x_nadsec_orgs": [
        "Ecotel, Ltd."
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--23b7ace1-b291-424e-aefc-399da70bcfb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.213.16.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T03:25:04.509Z",
      "x_nadsec_last_seen": "2026-03-19T03:32:10.201Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=215925; asn_org=Vpsvault.host Ltd",
      "id": "indicator--3eb925bb-85cc-47f1-804f-1207e98bc219",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T03:22:37.693Z",
      "x_nadsec_last_seen": "2026-03-21T15:16:21.085Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215925"
      ],
      "x_nadsec_orgs": [
        "Vpsvault.host Ltd"
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e48dfab6-b6ef-449a-b00c-bb44bfe86533",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.109.13.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T03:32:51.378Z",
      "x_nadsec_last_seen": "2026-03-19T03:34:58.117Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-19T04:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=12479; asn_org=Orange Espagne SA",
      "id": "indicator--98545668-c8dd-4373-bbb6-8cc58c55190f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T04:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '90.166.11.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:05:13.000Z",
      "valid_until": "2026-04-20T04:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T03:29:40.997Z",
      "x_nadsec_last_seen": "2026-03-19T03:31:47.236Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "12479"
      ],
      "x_nadsec_orgs": [
        "Orange Espagne SA"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--313935ac-f98f-46a9-ac63-2f19fd9394a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.20.94.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T04:35:00.925Z",
      "x_nadsec_last_seen": "2026-03-19T04:37:05.719Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--f9c4c21e-2b2b-4f21-aa85-e734a1c82232",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T04:20:48.286Z",
      "x_nadsec_last_seen": "2026-03-30T06:46:21.118Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--1aa812d8-e164-42b7-8a0c-7852f468f9d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-19T04:20:14.284Z",
      "x_nadsec_last_seen": "2026-03-30T06:45:44.286Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--b14d71db-65fc-4a86-a62e-469c0f1f367e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T04:20:52.282Z",
      "x_nadsec_last_seen": "2026-03-30T06:46:41.473Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--3d9735df-879b-4019-a3fb-d2c966e4099e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-19T04:20:12.550Z",
      "x_nadsec_last_seen": "2026-03-30T06:46:34.593Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--ef130b56-9060-487c-b4dc-4a7a6bd6e568",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T04:20:27.205Z",
      "x_nadsec_last_seen": "2026-03-30T06:46:38.033Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--390bcfd4-01ce-4c36-9645-210285ea704b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T04:20:22.045Z",
      "x_nadsec_last_seen": "2026-03-30T06:46:27.714Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--a9a6b920-36c9-4f66-8990-8c3bb10c9269",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T04:20:30.643Z",
      "x_nadsec_last_seen": "2026-03-30T06:46:31.155Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--8ae986bb-bcf0-4a2f-bf53-edf47951fffd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-19T04:20:25.484Z",
      "x_nadsec_last_seen": "2026-03-30T06:46:14.229Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--0fa2c768-e83d-4109-929a-c34f226230cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-19T04:20:20.325Z",
      "x_nadsec_last_seen": "2026-03-30T06:46:39.754Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--64f1ba26-6cca-46c8-82b6-63a3fae9d5a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T04:20:34.077Z",
      "x_nadsec_last_seen": "2026-03-30T06:46:07.325Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--305bf0b6-974a-414e-a967-57b61403f65d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T04:20:41.399Z",
      "x_nadsec_last_seen": "2026-03-19T04:20:56.606Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--d1d0d699-e6cf-4155-9f60-fec036734202",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-19T04:20:54.884Z",
      "x_nadsec_last_seen": "2026-03-30T06:46:32.874Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--004562f3-3435-4d02-9220-c40e55934492",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T04:20:16.017Z",
      "x_nadsec_last_seen": "2026-03-30T06:46:12.507Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--52ab71c7-7685-4b56-92db-506419c2bf48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.253.14.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T04:12:39.215Z",
      "x_nadsec_last_seen": "2026-03-19T04:12:46.903Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BY; asn=25106; asn_org=Mobile TeleSystems JLLC",
      "id": "indicator--4d13c442-990d-4be8-b657-b2a9d26f312e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.17.212.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T04:05:12.968Z",
      "x_nadsec_last_seen": "2026-03-19T04:10:29.905Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "25106"
      ],
      "x_nadsec_orgs": [
        "Mobile TeleSystems JLLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=DO; asn=6400; asn_org=Compania Dominicana de Telefonos S. A.",
      "id": "indicator--8d2a103c-5682-4d3e-837f-d82afaa82669",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.0.45.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-19T05:00:55.282Z",
      "x_nadsec_last_seen": "2026-03-19T12:35:29.578Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "6400"
      ],
      "x_nadsec_orgs": [
        "Compania Dominicana de Telefonos S. A."
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--17b1ab4c-6c96-4b12-8f27-b4104f2dc17e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.242.92.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T05:00:23.330Z",
      "x_nadsec_last_seen": "2026-03-19T05:07:34.393Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d67a795f-8060-4cd1-a86b-9543d29b287d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.22.243.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T04:51:18.192Z",
      "x_nadsec_last_seen": "2026-03-21T07:44:40.365Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--6dde5d5a-b490-4e3b-91a6-78c8c7cd309b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.28.155.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T04:15:16.374Z",
      "x_nadsec_last_seen": "2026-03-19T04:17:23.031Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--0f2fadc4-7b39-4db4-b42c-1b49830b43de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.35.128.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T05:04:39.607Z",
      "x_nadsec_last_seen": "2026-03-19T05:11:56.781Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7c8550e4-1c8a-4d87-9779-5d245e2e7fe3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T04:18:02.807Z",
      "x_nadsec_last_seen": "2026-03-19T04:18:02.807Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2373e69d-4f11-4936-8b4a-c952a2eadbf3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T04:18:03.327Z",
      "x_nadsec_last_seen": "2026-03-19T04:18:03.327Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=httpd; ports=81; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--5cf49f30-b480-4e30-ad7c-e3df116c9c65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T04:13:15.533Z",
      "x_nadsec_last_seen": "2026-03-19T04:13:36.935Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--46dd60ae-a47f-4156-99d0-2d82bcbc7ffd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.145.154.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T04:59:16.278Z",
      "x_nadsec_last_seen": "2026-03-19T05:01:21.138Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--5195ed3a-cff6-450b-92f0-2bd3d183ebb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.79.124.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-19T05:01:17.727Z",
      "x_nadsec_last_seen": "2026-03-19T06:08:26.807Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--4edd22f2-8006-4f3f-8327-1b93a0217c39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T04:40:30.464Z",
      "x_nadsec_last_seen": "2026-03-19T04:40:30.464Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=3356; asn_org=Level 3 Parent, LLC",
      "id": "indicator--1e0f5250-f41d-4d03-a948-5a86869e63f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '67.29.133.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T04:33:27.054Z",
      "x_nadsec_last_seen": "2026-03-19T04:33:27.054Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "3356"
      ],
      "x_nadsec_orgs": [
        "Level 3 Parent, LLC"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--118cd920-24be-41a7-883f-522bfdb9a379",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.173.25.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T04:53:42.545Z",
      "x_nadsec_last_seen": "2026-03-19T05:00:50.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-19T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=HR; asn=34594; asn_org=Telemach Hrvatska d.o.o.",
      "id": "indicator--c416fef7-aedd-45a2-b3d0-a6b308e9d54b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.17.11.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:05:03.000Z",
      "valid_until": "2026-04-20T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T04:10:19.830Z",
      "x_nadsec_last_seen": "2026-03-19T04:17:09.152Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HR"
      ],
      "x_nadsec_asns": [
        "34594"
      ],
      "x_nadsec_orgs": [
        "Telemach Hrvatska d.o.o."
      ]
    },
    {
      "created": "2026-03-19T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135780; asn_org=AirFiber Networks Pvt Ltd",
      "id": "indicator--3b1e46d9-c0dc-43a7-a2b4-90d30354de4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.82.208.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:05:02.000Z",
      "valid_until": "2026-04-20T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T05:49:57.240Z",
      "x_nadsec_last_seen": "2026-03-19T05:52:02.329Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135780"
      ],
      "x_nadsec_orgs": [
        "AirFiber Networks Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-19T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=4761; asn_org=INDOSAT Internet Network Provider",
      "id": "indicator--374e45b0-11b0-4e40-8691-80a67a7be5f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.5.104.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:05:02.000Z",
      "valid_until": "2026-04-20T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T05:47:16.715Z",
      "x_nadsec_last_seen": "2026-03-19T05:47:21.360Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4761"
      ],
      "x_nadsec_orgs": [
        "INDOSAT Internet Network Provider"
      ]
    },
    {
      "created": "2026-03-19T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6959e400-0705-444d-ad11-ec3a3c6d00ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.191.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:05:02.000Z",
      "valid_until": "2026-04-20T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T05:15:26.120Z",
      "x_nadsec_last_seen": "2026-03-19T05:15:26.120Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-19T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--590b73b4-dd15-4a87-9406-641706d3f8c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.65.223.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:05:02.000Z",
      "valid_until": "2026-04-20T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T05:35:26.361Z",
      "x_nadsec_last_seen": "2026-03-19T09:25:21.684Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-19T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=NG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--12bd98b8-cd71-4816-958d-cd3269eac782",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.11.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:05:02.000Z",
      "valid_until": "2026-04-20T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T05:05:10.771Z",
      "x_nadsec_last_seen": "2026-03-19T05:05:41.108Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-19T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--00e0796b-2a6c-4225-9c31-efc3d90634cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:05:02.000Z",
      "valid_until": "2026-04-20T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T05:37:08.820Z",
      "x_nadsec_last_seen": "2026-03-19T05:37:10.095Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-19T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3fb40a97-9a2c-447f-953a-5d1ac7f1c146",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.174.225.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:05:02.000Z",
      "valid_until": "2026-04-20T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T05:25:34.933Z",
      "x_nadsec_last_seen": "2026-03-19T05:25:45.130Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-19T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--11f9966d-0067-4c9a-98a0-9043e024b578",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '174.138.33.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:05:02.000Z",
      "valid_until": "2026-04-20T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T05:35:24.255Z",
      "x_nadsec_last_seen": "2026-03-19T05:35:24.255Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-19T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC; user(top)=**",
      "id": "indicator--a60879b8-e50c-415e-a618-7293a59e5851",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.32.58.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:05:02.000Z",
      "valid_until": "2026-04-20T06:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-19T05:11:48.924Z",
      "x_nadsec_last_seen": "2026-03-29T06:44:37.871Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-19T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--16094e33-2657-4334-9039-03ee4f15fabf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.14.23.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:05:02.000Z",
      "valid_until": "2026-04-20T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T05:12:17.648Z",
      "x_nadsec_last_seen": "2026-03-31T09:11:30.115Z",
      "x_nadsec_ports": [
        "21",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-19T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e9c4e704-f86e-4305-aaff-aa6d9d1f022e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.238.81.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:05:02.000Z",
      "valid_until": "2026-04-20T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T05:18:40.478Z",
      "x_nadsec_last_seen": "2026-03-19T05:20:45.236Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-19T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MA; asn=36903; asn_org=MT-MPLS; user(top)=**",
      "id": "indicator--61c93b75-50e2-4fdf-9a93-f10b6adee763",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.251.91.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:05:02.000Z",
      "valid_until": "2026-04-20T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T05:48:33.154Z",
      "x_nadsec_last_seen": "2026-03-19T05:48:33.154Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--4fdfae32-d0d0-44d6-89f5-2d84da730ff3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.163.126.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:05:02.000Z",
      "valid_until": "2026-04-20T07:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-19T06:28:15.324Z",
      "x_nadsec_last_seen": "2026-03-19T06:47:30.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=135967; asn_org=Bach Kim Network solutions Join stock company; user(top)=**",
      "id": "indicator--56634424-cd22-4931-821e-da0de5f0db65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.121.90.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:05:02.000Z",
      "valid_until": "2026-04-20T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T06:08:03.842Z",
      "x_nadsec_last_seen": "2026-03-19T06:08:03.842Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135967"
      ],
      "x_nadsec_orgs": [
        "Bach Kim Network solutions Join stock company"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45557; asn_org=Vietnam Technology and Telecommunication JSC",
      "id": "indicator--cc6491d8-0559-4dff-a957-e3c4bb669919",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.17.88.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:05:02.000Z",
      "valid_until": "2026-04-20T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T06:39:21.800Z",
      "x_nadsec_last_seen": "2026-03-19T06:45:48.240Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45557"
      ],
      "x_nadsec_orgs": [
        "Vietnam Technology and Telecommunication JSC"
      ]
    },
    {
      "created": "2026-03-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--f068493d-a98d-4322-9b87-191fbf433eb6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.212.15.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:05:02.000Z",
      "valid_until": "2026-04-20T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T06:30:38.291Z",
      "x_nadsec_last_seen": "2026-03-19T06:32:43.285Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--5e57d16e-4452-4173-82fc-7c9ae870f37b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.251.11.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:05:02.000Z",
      "valid_until": "2026-04-20T07:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-19T06:42:08.367Z",
      "x_nadsec_last_seen": "2026-03-19T08:35:11.731Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MY; asn=9534; asn_org=Binariang Berhad",
      "id": "indicator--eb22821b-3c61-4380-ac88-60144b32fed6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.121.61.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:05:02.000Z",
      "valid_until": "2026-04-20T07:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-19T06:47:32.066Z",
      "x_nadsec_last_seen": "2026-03-25T01:18:25.143Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9534"
      ],
      "x_nadsec_orgs": [
        "Binariang Berhad"
      ]
    },
    {
      "created": "2026-03-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--b4557a04-1d90-4372-aca2-f1a7c56de17c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.27.13.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:05:02.000Z",
      "valid_until": "2026-04-20T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T06:28:14.462Z",
      "x_nadsec_last_seen": "2026-03-19T06:30:19.169Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--22ad65b4-2c52-43c5-8ba5-ddd798d7b34f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.242.246.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:05:02.000Z",
      "valid_until": "2026-04-20T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T06:30:55.350Z",
      "x_nadsec_last_seen": "2026-03-19T06:33:01.594Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=327934; asn_org=Tunisie-Telecom",
      "id": "indicator--5f5dbcf9-8b0b-4e5e-9c5d-0d9337a4091a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.187.133.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:05:02.000Z",
      "valid_until": "2026-04-20T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T06:21:15.505Z",
      "x_nadsec_last_seen": "2026-03-19T06:23:22.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "327934"
      ],
      "x_nadsec_orgs": [
        "Tunisie-Telecom"
      ]
    },
    {
      "created": "2026-03-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--b20958e2-4027-4d27-8fb0-82c6b564c2c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.7.168.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:05:02.000Z",
      "valid_until": "2026-04-20T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T06:27:18.960Z",
      "x_nadsec_last_seen": "2026-03-19T06:29:24.020Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--a8c9321f-7eac-4fb8-9f97-fe3d52d04f6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:05:02.000Z",
      "valid_until": "2026-04-20T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T06:59:59.377Z",
      "x_nadsec_last_seen": "2026-03-25T04:34:06.367Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-19T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--16abc16c-f0b5-4704-920a-9a2c134f6f9f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.93.58.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:05:02.000Z",
      "valid_until": "2026-04-20T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T06:39:16.571Z",
      "x_nadsec_last_seen": "2026-03-19T06:41:23.651Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-19T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--23ab66a7-03c0-4814-96b3-bf950f70441b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.171.181.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T08:05:04.000Z",
      "valid_until": "2026-04-20T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T07:30:55.966Z",
      "x_nadsec_last_seen": "2026-03-19T07:37:22.648Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-19T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=38625; asn_org=CJONLINE ISP India",
      "id": "indicator--a20382b2-3f70-4073-9735-a6e3e1690f3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.55.243.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T08:05:04.000Z",
      "valid_until": "2026-04-20T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T07:30:05.081Z",
      "x_nadsec_last_seen": "2026-03-19T07:36:36.795Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "38625"
      ],
      "x_nadsec_orgs": [
        "CJONLINE ISP India"
      ]
    },
    {
      "created": "2026-03-19T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--27d141f5-f73e-4495-b48a-dc7874ef529d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.121.184.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T08:05:04.000Z",
      "valid_until": "2026-04-20T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T07:47:52.709Z",
      "x_nadsec_last_seen": "2026-03-19T07:54:29.317Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-19T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--30495c3a-2adb-4faf-9a6e-9bc24570cb7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.22.179.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T08:05:04.000Z",
      "valid_until": "2026-04-20T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T07:57:01.034Z",
      "x_nadsec_last_seen": "2026-03-19T07:57:01.034Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-19T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=LK; asn=18001; asn_org=Dialog Axiata PLC.",
      "id": "indicator--ea02492e-c870-47e4-8e89-17c350503060",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '175.157.41.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T08:05:04.000Z",
      "valid_until": "2026-04-20T08:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T07:27:47.501Z",
      "x_nadsec_last_seen": "2026-03-19T07:34:36.040Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "18001"
      ],
      "x_nadsec_orgs": [
        "Dialog Axiata PLC."
      ]
    },
    {
      "created": "2026-03-19T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--36e19497-dce2-44be-b352-95a1a977d843",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.76.124.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T08:05:04.000Z",
      "valid_until": "2026-04-20T08:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-19T07:39:11.048Z",
      "x_nadsec_last_seen": "2026-03-19T07:39:11.840Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-19T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45916; asn_org=Gujarat Telelink Pvt Ltd",
      "id": "indicator--0b9771f5-71e5-4bee-96b5-8351bca4d662",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.241.192.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T08:05:04.000Z",
      "valid_until": "2026-04-20T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T07:58:40.216Z",
      "x_nadsec_last_seen": "2026-03-19T08:00:45.169Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45916"
      ],
      "x_nadsec_orgs": [
        "Gujarat Telelink Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-19T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--f2737a3f-0b49-4028-b557-b1aae9d5519d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T08:05:04.000Z",
      "valid_until": "2026-04-20T08:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-19T08:03:24.313Z",
      "x_nadsec_last_seen": "2026-03-19T08:03:46.142Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-19T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--3b00b6e2-0e43-4150-b667-0d4a2ddf8da8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.169.221.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:05:03.000Z",
      "valid_until": "2026-04-20T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T08:50:27.176Z",
      "x_nadsec_last_seen": "2026-03-19T08:57:31.320Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-19T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=135173; asn_org=INDIA METEOROLOGICAL DEPARTMENT",
      "id": "indicator--f601b9b4-54a4-4c7b-aaae-567ff011efd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.215.208.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:05:03.000Z",
      "valid_until": "2026-04-20T09:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-19T08:07:15.742Z",
      "x_nadsec_last_seen": "2026-03-19T08:09:19.813Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135173"
      ],
      "x_nadsec_orgs": [
        "INDIA METEOROLOGICAL DEPARTMENT"
      ]
    },
    {
      "created": "2026-03-19T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--037a4e7d-a916-42b0-9612-c9afa6b990a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.4.130.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:05:03.000Z",
      "valid_until": "2026-04-20T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T08:44:06.714Z",
      "x_nadsec_last_seen": "2026-03-19T08:50:22.085Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-19T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ba1b5491-87c4-4750-bac4-c7e775e3dd0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:05:03.000Z",
      "valid_until": "2026-04-20T09:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-12T18:17:59.479Z",
      "x_nadsec_last_seen": "2026-03-19T08:51:11.763Z",
      "x_nadsec_ports": [
        "27017",
        "1723"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-19T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--e7242b5a-f37e-4bb4-984c-8136717cfffc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.79.216.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:05:03.000Z",
      "valid_until": "2026-04-20T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T08:27:41.317Z",
      "x_nadsec_last_seen": "2026-03-19T08:34:15.692Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-19T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--02f6bcbf-349f-4417-9f44-555fc7ed6bbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:05:03.000Z",
      "valid_until": "2026-04-20T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T08:43:14.261Z",
      "x_nadsec_last_seen": "2026-03-19T08:43:14.261Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-19T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=GB; asn=396982; asn_org=Google LLC",
      "id": "indicator--b7a0ee0d-85f4-492f-87b9-2922dcf053b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.203.211.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:05:03.000Z",
      "valid_until": "2026-04-20T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T08:53:44.379Z",
      "x_nadsec_last_seen": "2026-03-19T08:53:44.379Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-19T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--3406db07-3d24-4ad5-9b8a-04e6fc81769f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.48.216.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:05:03.000Z",
      "valid_until": "2026-04-20T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T08:50:25.854Z",
      "x_nadsec_last_seen": "2026-03-19T08:52:31.741Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-19T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--5e984d25-6348-4910-808a-cca6609e518b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.68.145.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:05:03.000Z",
      "valid_until": "2026-04-20T09:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-19T08:34:54.319Z",
      "x_nadsec_last_seen": "2026-03-28T20:52:42.052Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-03-19T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=31200; asn_org=Novotelecom Ltd",
      "id": "indicator--379ec286-cdd8-4064-9779-e6b64e30a848",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.128.121.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:05:03.000Z",
      "valid_until": "2026-04-20T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T08:42:53.740Z",
      "x_nadsec_last_seen": "2026-03-19T08:42:53.900Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31200"
      ],
      "x_nadsec_orgs": [
        "Novotelecom Ltd"
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mongod; ports=27017; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--b41e2446-83bf-444a-98b2-ae52fd64bdca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.36.97.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T09:46:16.885Z",
      "x_nadsec_last_seen": "2026-03-19T09:46:35.657Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--1951893d-25d6-4ebb-89af-637c4781093d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.203.243.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T09:35:16.278Z",
      "x_nadsec_last_seen": "2026-03-19T09:35:16.462Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--6ed26003-7b29-45b0-bd11-9c3ae28cc49a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.96.159.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T09:37:20.453Z",
      "x_nadsec_last_seen": "2026-03-19T09:37:20.453Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=264442; asn_org=Tamar Comercio e Equipamentos para Informatica Ltd",
      "id": "indicator--f2d6a06f-9bc4-4bbd-b06a-83e6e42a4c7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '131.221.192.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T09:23:45.171Z",
      "x_nadsec_last_seen": "2026-03-19T09:30:50.269Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "264442"
      ],
      "x_nadsec_orgs": [
        "Tamar Comercio e Equipamentos para Informatica Ltd"
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2285828e-4193-4039-878e-7d699650fc3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.224.114.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T09:10:58.858Z",
      "x_nadsec_last_seen": "2026-03-19T09:13:03.809Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--080f21df-63b4-4882-aa0e-ceea87060111",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.182.222.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T09:25:14.352Z",
      "x_nadsec_last_seen": "2026-03-19T09:25:14.352Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--9e1fef11-dd1f-41d1-8c11-eae1813c555d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T09:44:14.075Z",
      "x_nadsec_last_seen": "2026-03-19T09:46:21.505Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--362d3eab-27f8-4e56-9e90-58a91da54f08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.6.90.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T09:33:37.512Z",
      "x_nadsec_last_seen": "2026-03-19T09:35:41.949Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--dadcb280-1753-4a2f-8851-d9a69be9214e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.144.168.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T09:54:18.584Z",
      "x_nadsec_last_seen": "2026-03-19T09:56:24.321Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b0634c89-15fc-4acd-9063-c6e957c589aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.34.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T09:30:11.364Z",
      "x_nadsec_last_seen": "2026-03-19T09:30:11.364Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CL; asn=27651; asn_org=ENTEL CHILE S.A.",
      "id": "indicator--88e35513-2d9c-442c-93a1-46388196abc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.111.147.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T09:36:56.163Z",
      "x_nadsec_last_seen": "2026-03-19T09:43:56.796Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "27651"
      ],
      "x_nadsec_orgs": [
        "ENTEL CHILE S.A."
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--992badb4-63b6-4474-a7ee-fac95ca5f33d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T09:06:18.400Z",
      "x_nadsec_last_seen": "2026-03-19T09:06:18.400Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GA; asn=16058; asn_org=Gabon-Telecom",
      "id": "indicator--6acc7cb9-1fad-42c3-b853-a95e591e4e55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.158.189.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T09:25:39.121Z",
      "x_nadsec_last_seen": "2026-03-19T09:27:46.032Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GA"
      ],
      "x_nadsec_asns": [
        "16058"
      ],
      "x_nadsec_orgs": [
        "Gabon-Telecom"
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--79d7ef26-7e9e-4895-8f8e-3ee35cd32adb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.186.91.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T09:08:30.792Z",
      "x_nadsec_last_seen": "2026-03-19T09:10:36.928Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--421347ab-464a-4066-af9a-9175c58032ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '86.96.101.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T09:57:00.626Z",
      "x_nadsec_last_seen": "2026-03-21T12:34:30.796Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-03-19T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--7841b8ed-f6cd-49bb-919a-360c2d2d2182",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.147.173.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:05:03.000Z",
      "valid_until": "2026-04-20T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T09:25:42.302Z",
      "x_nadsec_last_seen": "2026-03-19T09:33:32.915Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=smbd; ports=445; cc=MU; asn=23889; asn_org=MauritiusTelecom",
      "id": "indicator--6b1ae9cd-a71a-42d8-8320-7d130e0ad585",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.117.229.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:05:02.000Z",
      "valid_until": "2026-04-20T12:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-19T11:14:11.830Z",
      "x_nadsec_last_seen": "2026-03-19T11:44:50.401Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MU"
      ],
      "x_nadsec_asns": [
        "23889"
      ],
      "x_nadsec_orgs": [
        "MauritiusTelecom"
      ]
    },
    {
      "created": "2026-03-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--e3eac159-e134-4d73-87ac-5de1cd1421e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.93.10.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:05:02.000Z",
      "valid_until": "2026-04-20T12:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-19T11:22:14.596Z",
      "x_nadsec_last_seen": "2026-03-19T11:24:20.115Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MN; asn=151355; asn_org=Software operation, Foreign trade",
      "id": "indicator--c3f121be-a9de-4b53-a70b-146cba2e270b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.209.212.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:05:02.000Z",
      "valid_until": "2026-04-20T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T11:47:13.393Z",
      "x_nadsec_last_seen": "2026-03-19T11:54:58.897Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "151355"
      ],
      "x_nadsec_orgs": [
        "Software operation, Foreign trade"
      ]
    },
    {
      "created": "2026-03-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--34364df4-4f7f-4cdf-9dc3-71931343f705",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.233.37.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:05:02.000Z",
      "valid_until": "2026-04-20T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T12:02:32.148Z",
      "x_nadsec_last_seen": "2026-03-19T12:10:12.073Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--38aa17bd-8421-4852-9ff1-d9deb69f27d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.42.222.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:05:02.000Z",
      "valid_until": "2026-04-20T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T11:32:33.692Z",
      "x_nadsec_last_seen": "2026-03-19T11:32:33.692Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--a1da0dfc-40bf-45af-b6e5-4972a0cd1d2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.199.154.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:05:02.000Z",
      "valid_until": "2026-04-20T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T11:29:03.927Z",
      "x_nadsec_last_seen": "2026-03-19T11:31:10.628Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-03-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=196705; asn_org=Ardinvest LTD",
      "id": "indicator--4ef03f7f-702e-4e96-83b4-f56ecd153b8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.187.148.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:05:02.000Z",
      "valid_until": "2026-04-20T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T11:47:53.821Z",
      "x_nadsec_last_seen": "2026-03-19T11:50:00.951Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "196705"
      ],
      "x_nadsec_orgs": [
        "Ardinvest LTD"
      ]
    },
    {
      "created": "2026-03-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--c1692b65-bf34-44d4-93b5-430fc9d1ac3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.63.138.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:05:02.000Z",
      "valid_until": "2026-04-20T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T11:32:33.183Z",
      "x_nadsec_last_seen": "2026-03-19T11:32:33.557Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--20febe91-7a46-452c-b4a2-06275097b146",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.40.210.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:05:02.000Z",
      "valid_until": "2026-04-20T12:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T11:05:59.564Z",
      "x_nadsec_last_seen": "2026-03-19T11:06:09.736Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--a7ac40bc-3bee-44e2-a006-e68884418e21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.55.92.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:05:02.000Z",
      "valid_until": "2026-04-20T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T11:56:02.096Z",
      "x_nadsec_last_seen": "2026-03-19T11:58:09.655Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--608aa186-fa1c-4238-a7dd-48f5742f5268",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.228.6.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:05:02.000Z",
      "valid_until": "2026-04-20T12:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-19T11:29:55.106Z",
      "x_nadsec_last_seen": "2026-03-19T12:25:00.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-19T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--cd7d4bcb-b7c7-450d-ba2f-a362f233186e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.181.73.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:05:02.000Z",
      "valid_until": "2026-04-20T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T12:01:37.454Z",
      "x_nadsec_last_seen": "2026-03-19T12:01:41.920Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-03-19T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--eb2a90a2-7117-4543-985b-5d8c6fcd0a32",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.61.60.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T13:05:02.000Z",
      "valid_until": "2026-04-20T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T12:27:48.268Z",
      "x_nadsec_last_seen": "2026-03-19T12:27:48.268Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-03-19T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--8129fd44-1a43-4cb6-97c7-ea070cb10d98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.169.151.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T13:05:02.000Z",
      "valid_until": "2026-04-20T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T12:35:11.415Z",
      "x_nadsec_last_seen": "2026-03-19T12:37:16.184Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-19T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=35805; asn_org=JSC Silknet",
      "id": "indicator--7fba62ec-2391-4521-a935-2e38c2c9e87d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.255.252.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T13:05:02.000Z",
      "valid_until": "2026-04-20T13:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-16T18:36:38.822Z",
      "x_nadsec_last_seen": "2026-03-19T13:02:39.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "35805"
      ],
      "x_nadsec_orgs": [
        "JSC Silknet"
      ]
    },
    {
      "created": "2026-03-19T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--f45fb02a-913e-4578-9591-e9c819228dde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.233.37.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T13:05:02.000Z",
      "valid_until": "2026-04-20T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T12:50:40.438Z",
      "x_nadsec_last_seen": "2026-03-19T12:50:40.438Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-19T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=37340; asn_org=Spectranet",
      "id": "indicator--ceb654d2-c613-4bde-9889-32b51993d9e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.118.15.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T13:05:02.000Z",
      "valid_until": "2026-04-20T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T12:28:19.651Z",
      "x_nadsec_last_seen": "2026-03-19T12:30:28.862Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37340"
      ],
      "x_nadsec_orgs": [
        "Spectranet"
      ]
    },
    {
      "created": "2026-03-19T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--24040bc9-bef3-433f-ae10-664dc14bf7dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.242.57.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T13:05:02.000Z",
      "valid_until": "2026-04-20T13:05:01.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-03-19T12:25:57.894Z",
      "x_nadsec_last_seen": "2026-03-19T12:28:27.017Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-19T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--a4e9b574-4116-4f92-8132-42dfabbbcc03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.145.84.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T13:05:02.000Z",
      "valid_until": "2026-04-20T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T12:45:01.839Z",
      "x_nadsec_last_seen": "2026-03-19T12:47:09.005Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-19T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--52853ab5-d030-45f0-90c6-d421e8d15812",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.210.52.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T13:05:02.000Z",
      "valid_until": "2026-04-20T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T12:22:13.624Z",
      "x_nadsec_last_seen": "2026-03-19T12:22:14.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-19T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0a246e32-97f1-44d4-91ed-6782e97e8e57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T13:05:02.000Z",
      "valid_until": "2026-04-20T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T12:50:26.224Z",
      "x_nadsec_last_seen": "2026-03-19T12:50:26.224Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-19T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d361d59f-97c3-43fc-af84-ac116505bebf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:05:03.000Z",
      "valid_until": "2026-04-20T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T13:36:16.932Z",
      "x_nadsec_last_seen": "2026-03-19T13:36:16.932Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-19T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--61c2212f-108f-4a6e-b8ba-9092470f5423",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.225.216.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:05:03.000Z",
      "valid_until": "2026-04-20T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T13:06:26.867Z",
      "x_nadsec_last_seen": "2026-03-19T13:08:31.286Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-19T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--81bdba31-0b41-4a5b-9c0b-02c150d2ad36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.13.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:05:03.000Z",
      "valid_until": "2026-04-20T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T13:48:43.124Z",
      "x_nadsec_last_seen": "2026-03-19T13:50:51.176Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-19T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=43812; asn_org=Elfimov Sergey Ivanovich PE",
      "id": "indicator--dd1ce91b-6ac5-4ecb-80b2-35dcf87857f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.20.179.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:05:03.000Z",
      "valid_until": "2026-04-20T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T13:30:17.164Z",
      "x_nadsec_last_seen": "2026-03-19T13:37:47.136Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "43812"
      ],
      "x_nadsec_orgs": [
        "Elfimov Sergey Ivanovich PE"
      ]
    },
    {
      "created": "2026-03-19T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--73729bec-1df6-46c5-aa3a-5f2e526b1da9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.38.14.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:05:03.000Z",
      "valid_until": "2026-04-20T14:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-19T13:24:47.708Z",
      "x_nadsec_last_seen": "2026-03-28T06:12:14.865Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-19T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--f8e50c96-2a9d-480e-aed0-99cbc70a11a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:05:03.000Z",
      "valid_until": "2026-04-20T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T13:48:16.599Z",
      "x_nadsec_last_seen": "2026-03-19T13:49:06.197Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-19T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--59d0c0e8-beeb-4a1c-97c3-0825593b66fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:05:03.000Z",
      "valid_until": "2026-04-20T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T13:48:48.473Z",
      "x_nadsec_last_seen": "2026-03-19T13:50:03.498Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-19T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--27eeb943-8c95-497e-9235-50a3bd3c042d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:05:03.000Z",
      "valid_until": "2026-04-20T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T13:49:37.191Z",
      "x_nadsec_last_seen": "2026-03-19T13:49:49.184Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-19T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--8fd21909-c647-42a0-a462-90492e5b6720",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:05:03.000Z",
      "valid_until": "2026-04-20T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T13:47:35.351Z",
      "x_nadsec_last_seen": "2026-03-19T13:49:49.759Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-19T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AU; asn=7545; asn_org=TPG Telecom Limited",
      "id": "indicator--38794f59-cb2d-4ce9-9754-b99f9afbba78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.240.78.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:05:03.000Z",
      "valid_until": "2026-04-20T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T13:58:54.671Z",
      "x_nadsec_last_seen": "2026-03-19T14:00:57.914Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "7545"
      ],
      "x_nadsec_orgs": [
        "TPG Telecom Limited"
      ]
    },
    {
      "created": "2026-03-19T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a8167127-6968-4b59-ad74-08cbc1b95f8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.208.70.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:05:03.000Z",
      "valid_until": "2026-04-20T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T13:47:48.939Z",
      "x_nadsec_last_seen": "2026-03-19T13:49:55.798Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-19T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--56c03186-8669-4d4f-9209-1998613e2a30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.202.104.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:05:02.000Z",
      "valid_until": "2026-04-20T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T14:07:08.548Z",
      "x_nadsec_last_seen": "2026-03-19T14:07:08.901Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-19T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--63cd76c3-211f-4eae-ac7b-9f5dd025105f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:05:02.000Z",
      "valid_until": "2026-04-20T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T14:05:33.810Z",
      "x_nadsec_last_seen": "2026-03-19T14:05:33.810Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-19T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--881c6b24-0b62-4c5c-98e7-15e340db8b4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.115.171.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:05:02.000Z",
      "valid_until": "2026-04-20T15:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-19T14:29:24.713Z",
      "x_nadsec_last_seen": "2026-03-30T08:26:37.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-19T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=271855; asn_org=MANGO NETWORK, C. A. MANGONET, C. A",
      "id": "indicator--c76d1003-a410-4cdf-986e-a1047f8adf2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.191.225.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:05:02.000Z",
      "valid_until": "2026-04-20T15:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T14:54:20.914Z",
      "x_nadsec_last_seen": "2026-03-19T14:59:35.104Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "271855"
      ],
      "x_nadsec_orgs": [
        "MANGO NETWORK, C. A. MANGONET, C. A"
      ]
    },
    {
      "created": "2026-03-19T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=7738; asn_org=V tal",
      "id": "indicator--d0ea144a-e6b1-40b4-a591-1aca6384e1b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.0.123.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:05:02.000Z",
      "valid_until": "2026-04-20T15:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-19T14:51:12.064Z",
      "x_nadsec_last_seen": "2026-03-28T13:12:56.627Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "7738"
      ],
      "x_nadsec_orgs": [
        "V tal"
      ]
    },
    {
      "created": "2026-03-19T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c891b496-4be8-4fed-9752-f1126aa40966",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.29.49.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:05:02.000Z",
      "valid_until": "2026-04-20T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T14:19:33.654Z",
      "x_nadsec_last_seen": "2026-03-19T14:19:33.654Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-19T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f264d500-ebb1-4d9b-a4f4-4d2c7862c86a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:05:02.000Z",
      "valid_until": "2026-04-20T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T14:32:15.720Z",
      "x_nadsec_last_seen": "2026-03-19T14:32:15.720Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-19T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=GB; asn=396982; asn_org=Google LLC",
      "id": "indicator--ee777362-bd00-43e3-ac34-a16c28b079c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.203.211.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:05:02.000Z",
      "valid_until": "2026-04-20T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T14:18:32.867Z",
      "x_nadsec_last_seen": "2026-03-19T14:18:42.868Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-19T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KW; asn=42961; asn_org=Mobile Telecommunications Company K.S.C.P.",
      "id": "indicator--8d7f7203-ab2e-4612-9154-650365a5cb74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.34.180.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:05:02.000Z",
      "valid_until": "2026-04-20T15:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-13T06:18:31.788Z",
      "x_nadsec_last_seen": "2026-03-20T01:36:45.515Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KW"
      ],
      "x_nadsec_asns": [
        "42961"
      ],
      "x_nadsec_orgs": [
        "Mobile Telecommunications Company K.S.C.P."
      ]
    },
    {
      "created": "2026-03-19T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KE; asn=15808; asn_org=ACCESSKENYA-KE ACCESSKENYA GROUP LTD is an ISP serving",
      "id": "indicator--3f140f19-559a-4c05-83f3-c3da953835f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.215.18.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:05:02.000Z",
      "valid_until": "2026-04-20T15:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-19T14:43:58.999Z",
      "x_nadsec_last_seen": "2026-03-19T14:44:04.717Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "15808"
      ],
      "x_nadsec_orgs": [
        "ACCESSKENYA-KE ACCESSKENYA GROUP LTD is an ISP serving"
      ]
    },
    {
      "created": "2026-03-19T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--77d4c99b-71cf-41e8-b80e-d044be8632bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '84.36.95.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:05:02.000Z",
      "valid_until": "2026-04-20T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T14:36:02.955Z",
      "x_nadsec_last_seen": "2026-03-19T14:36:09.508Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-03-19T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--a08a34de-f116-47e9-9d9f-1e20ef5e8661",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.98.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T16:05:02.000Z",
      "valid_until": "2026-04-20T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T15:46:11.099Z",
      "x_nadsec_last_seen": "2026-03-19T15:54:04.176Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-19T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--2e64d3f9-52d9-43f9-817b-76f6e783b9e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.26.140.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T16:05:02.000Z",
      "valid_until": "2026-04-20T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T15:38:55.160Z",
      "x_nadsec_last_seen": "2026-03-19T15:38:55.307Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-19T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--28ab6522-cdcc-42f8-b75a-c7d3109c444a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T16:05:02.000Z",
      "valid_until": "2026-04-20T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T15:35:25.613Z",
      "x_nadsec_last_seen": "2026-03-19T15:35:25.613Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-19T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.; user(top)=w******a; pass(top)=a***n",
      "id": "indicator--ddd7899a-9225-421a-a69c-1b53bcd96955",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.84.132.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T16:05:02.000Z",
      "valid_until": "2026-04-20T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T15:32:21.480Z",
      "x_nadsec_last_seen": "2026-03-19T15:32:21.480Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9269"
      ],
      "x_nadsec_orgs": [
        "Hong Kong Broadband Network Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "w******a"
      ],
      "x_nadsec_passwords_attempted": [
        "a***n"
      ]
    },
    {
      "created": "2026-03-19T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=26609; asn_org=Universal Telecom S.A.",
      "id": "indicator--6f5cb645-96c8-41a3-86b9-6da24a526628",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.8.22.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T16:05:02.000Z",
      "valid_until": "2026-04-20T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T15:23:47.889Z",
      "x_nadsec_last_seen": "2026-03-19T15:25:54.652Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26609"
      ],
      "x_nadsec_orgs": [
        "Universal Telecom S.A."
      ]
    },
    {
      "created": "2026-03-19T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EC; asn=28006; asn_org=CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP",
      "id": "indicator--cc3f1449-6f86-4262-89f9-ab018fc35b0a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.11.22.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T16:05:02.000Z",
      "valid_until": "2026-04-20T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T15:18:29.087Z",
      "x_nadsec_last_seen": "2026-03-19T15:25:35.709Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "28006"
      ],
      "x_nadsec_orgs": [
        "CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP"
      ]
    },
    {
      "created": "2026-03-19T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--386cf182-2efb-42c2-8ce7-6ba1d4666901",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.117.224.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T16:05:02.000Z",
      "valid_until": "2026-04-20T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T15:57:00.672Z",
      "x_nadsec_last_seen": "2026-03-19T15:59:07.454Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4538"
      ],
      "x_nadsec_orgs": [
        "China Education and Research Network Center"
      ]
    },
    {
      "created": "2026-03-19T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=TW; asn=208137; asn_org=Feo Prest SRL",
      "id": "indicator--84673100-fe63-4f33-90f5-d8fc49e6e87c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T16:05:02.000Z",
      "valid_until": "2026-04-20T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T15:26:32.754Z",
      "x_nadsec_last_seen": "2026-03-19T15:26:43.405Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "208137"
      ],
      "x_nadsec_orgs": [
        "Feo Prest SRL"
      ]
    },
    {
      "created": "2026-03-19T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=TW; asn=208137; asn_org=Feo Prest SRL",
      "id": "indicator--3c21a198-3c92-4bb8-98c8-c947fbffd2ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T16:05:02.000Z",
      "valid_until": "2026-04-20T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T15:26:33.364Z",
      "x_nadsec_last_seen": "2026-03-20T19:23:47.010Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "208137"
      ],
      "x_nadsec_orgs": [
        "Feo Prest SRL"
      ]
    },
    {
      "created": "2026-03-19T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=TW; asn=208137; asn_org=Feo Prest SRL",
      "id": "indicator--ede496af-59dd-4f20-9331-55355ff36af5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T16:05:02.000Z",
      "valid_until": "2026-04-20T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T15:26:32.105Z",
      "x_nadsec_last_seen": "2026-03-20T19:23:37.894Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "208137"
      ],
      "x_nadsec_orgs": [
        "Feo Prest SRL"
      ]
    },
    {
      "created": "2026-03-19T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--eef77270-587f-479f-9491-eeecd5173dbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.236.33.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T16:05:02.000Z",
      "valid_until": "2026-04-20T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T15:18:17.931Z",
      "x_nadsec_last_seen": "2026-03-19T15:25:17.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-03-19T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--15082ad7-7bf4-4fcd-b9c8-4cfe0c06ea4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.188.123.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T17:05:03.000Z",
      "valid_until": "2026-04-20T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T16:15:07.567Z",
      "x_nadsec_last_seen": "2026-03-19T16:17:14.570Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-19T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--2ad58026-4ca2-4923-8036-693595f138a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.246.238.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T17:05:03.000Z",
      "valid_until": "2026-04-20T17:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T16:44:11.938Z",
      "x_nadsec_last_seen": "2026-03-19T16:50:38.291Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-19T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=56082; asn_org=INTERNET-SOLUTION; user(top)=**",
      "id": "indicator--58493d6e-2892-4915-adc5-4fc05f1590ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.14.154.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T17:05:03.000Z",
      "valid_until": "2026-04-20T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T16:31:54.133Z",
      "x_nadsec_last_seen": "2026-03-19T16:31:54.133Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56082"
      ],
      "x_nadsec_orgs": [
        "INTERNET-SOLUTION"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-19T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--935c3150-38c5-4aca-a775-e1934018100a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.22.5.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T17:05:03.000Z",
      "valid_until": "2026-04-20T17:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-19T16:07:27.945Z",
      "x_nadsec_last_seen": "2026-03-19T18:37:16.074Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-19T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--92278272-050f-4d41-865f-8fdedf17024e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.232.208.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T17:05:03.000Z",
      "valid_until": "2026-04-20T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T16:33:14.467Z",
      "x_nadsec_last_seen": "2026-03-19T16:35:19.149Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-19T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--d577b099-401b-440f-bbc8-cdc3ce426d2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.202.7.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T17:05:03.000Z",
      "valid_until": "2026-04-20T17:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T16:17:45.667Z",
      "x_nadsec_last_seen": "2026-03-19T16:24:37.541Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-03-19T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--73ea3dfa-d6b0-492a-bc15-b6d17975f1b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T17:05:03.000Z",
      "valid_until": "2026-04-20T17:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T16:27:23.660Z",
      "x_nadsec_last_seen": "2026-03-19T16:27:33.822Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-19T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8a6f50e3-6997-44f3-aca3-b462d09823df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.83.170.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T17:05:03.000Z",
      "valid_until": "2026-04-20T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T16:40:48.517Z",
      "x_nadsec_last_seen": "2026-03-19T16:40:48.517Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-19T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--a7d6f833-8280-4315-bde4-4b2d42a047c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T17:05:03.000Z",
      "valid_until": "2026-04-20T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T16:05:15.339Z",
      "x_nadsec_last_seen": "2026-03-19T16:05:15.339Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TN; asn=37705; asn_org=TOPNET",
      "id": "indicator--5c77bcf6-73b0-4c14-aeb7-5aa9e816486d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.3.10.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T18:05:10.000Z",
      "valid_until": "2026-04-20T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T17:56:37.723Z",
      "x_nadsec_last_seen": "2026-03-19T17:58:44.778Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37705"
      ],
      "x_nadsec_orgs": [
        "TOPNET"
      ]
    },
    {
      "created": "2026-03-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c8c53bcd-e40e-4272-ba00-35f53e3956f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T18:05:10.000Z",
      "valid_until": "2026-04-20T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T17:05:22.020Z",
      "x_nadsec_last_seen": "2026-03-19T17:05:22.020Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--f3708dc9-2302-4578-a293-17022aac772f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.34.132.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T18:05:10.000Z",
      "valid_until": "2026-04-20T18:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T17:56:35.189Z",
      "x_nadsec_last_seen": "2026-03-21T12:56:06.417Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s",
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        "",
        "a********@"
      ]
    },
    {
      "created": "2026-03-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=267214; asn_org=CLICKPLAY PROVEDOR DE ACESSO LTDA - ME",
      "id": "indicator--b6a1419b-2902-4dc2-88c2-53dac36502e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.230.163.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T18:05:10.000Z",
      "valid_until": "2026-04-20T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T17:42:19.203Z",
      "x_nadsec_last_seen": "2026-03-19T17:48:03.610Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "267214"
      ],
      "x_nadsec_orgs": [
        "CLICKPLAY PROVEDOR DE ACESSO LTDA - ME"
      ]
    },
    {
      "created": "2026-03-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6f3c4981-ae5b-40bc-8492-747f7176c3ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.165.80.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T18:05:10.000Z",
      "valid_until": "2026-04-20T18:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T17:16:19.525Z",
      "x_nadsec_last_seen": "2026-03-19T17:16:19.876Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--d353fe94-a4bc-46e9-8384-30ca34c9685c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.208.111.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T18:05:10.000Z",
      "valid_until": "2026-04-20T18:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T17:25:50.753Z",
      "x_nadsec_last_seen": "2026-03-19T17:33:30.017Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--fd64300d-8c7f-4014-b084-27140dec0255",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T18:05:10.000Z",
      "valid_until": "2026-04-20T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T17:52:44.138Z",
      "x_nadsec_last_seen": "2026-03-19T17:52:44.138Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--12002d78-5c2b-4757-9277-cef4b16fdcc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T18:05:10.000Z",
      "valid_until": "2026-04-20T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T17:52:33.821Z",
      "x_nadsec_last_seen": "2026-03-19T17:52:33.821Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-19T18:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IT; asn=47217; asn_org=Planetel SPA",
      "id": "indicator--60f18ea4-21bc-48f2-97d3-0fbf52eae044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T18:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.185.79.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T18:05:10.000Z",
      "valid_until": "2026-04-20T18:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T17:53:19.546Z",
      "x_nadsec_last_seen": "2026-03-19T17:53:19.546Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "47217"
      ],
      "x_nadsec_orgs": [
        "Planetel SPA"
      ]
    },
    {
      "created": "2026-03-19T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--2dec6829-c6c3-4147-8ed6-d99d28dea3d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.101.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:05:02.000Z",
      "valid_until": "2026-04-20T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T19:34:20.079Z",
      "x_nadsec_last_seen": "2026-03-19T19:34:20.547Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-19T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=52838; asn_org=WN TELECOM LTDA - ME",
      "id": "indicator--6f429b06-49d6-428b-b954-9998e48b9068",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.202.93.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:05:02.000Z",
      "valid_until": "2026-04-20T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T20:01:49.244Z",
      "x_nadsec_last_seen": "2026-03-19T20:03:55.826Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52838"
      ],
      "x_nadsec_orgs": [
        "WN TELECOM LTDA - ME"
      ]
    },
    {
      "created": "2026-03-19T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--cccbcd53-3e90-41c5-9523-0225d6dfbc3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:05:02.000Z",
      "valid_until": "2026-04-20T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T19:34:12.053Z",
      "x_nadsec_last_seen": "2026-03-28T17:00:55.499Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-19T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--472d226d-6fe3-4b32-ab45-09a57940b599",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.156.161.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:05:02.000Z",
      "valid_until": "2026-04-20T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T19:32:43.166Z",
      "x_nadsec_last_seen": "2026-03-19T19:32:43.496Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-19T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--3c6050f1-6d32-42cf-b4d8-6c5db49f8583",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.240.219.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:05:02.000Z",
      "valid_until": "2026-04-20T20:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-19T19:31:20.043Z",
      "x_nadsec_last_seen": "2026-03-19T19:31:59.914Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-19T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--38d0c43a-c431-4722-a354-a0602351dbee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.188.115.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:05:02.000Z",
      "valid_until": "2026-04-20T20:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-19T19:18:42.728Z",
      "x_nadsec_last_seen": "2026-03-19T19:55:10.276Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-19T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--93335f29-35c5-47d4-a5bd-26457c2dfea8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:05:02.000Z",
      "valid_until": "2026-04-20T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T19:09:21.087Z",
      "x_nadsec_last_seen": "2026-03-19T19:09:21.087Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-19T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--2897a318-904e-47e0-a984-402f673db94f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.10.64.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:05:02.000Z",
      "valid_until": "2026-04-20T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T19:39:35.687Z",
      "x_nadsec_last_seen": "2026-03-19T19:41:42.199Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-19T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--4fef8ad8-7a42-427d-8229-29ea8a44d45b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.2.254.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:05:02.000Z",
      "valid_until": "2026-04-20T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T19:35:26.592Z",
      "x_nadsec_last_seen": "2026-03-19T19:37:32.860Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-03-19T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=34137; asn_org=Rostelecom",
      "id": "indicator--859fd1ce-487a-4c5d-9329-b22cd0f47e43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.109.175.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T20:05:02.000Z",
      "valid_until": "2026-04-20T20:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-19T19:52:05.578Z",
      "x_nadsec_last_seen": "2026-03-26T07:44:03.817Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "34137"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-19T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=55839; asn_org=Microsense Private Limited",
      "id": "indicator--cf760727-b4ce-4b3b-8386-19fcc468ad8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.234.157.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T21:05:03.000Z",
      "valid_until": "2026-04-20T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T21:02:02.564Z",
      "x_nadsec_last_seen": "2026-03-19T21:04:08.283Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55839"
      ],
      "x_nadsec_orgs": [
        "Microsense Private Limited"
      ]
    },
    {
      "created": "2026-03-19T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--ede10cf7-1a72-4f5e-bf63-fefd21c9c21d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.83.225.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T21:05:03.000Z",
      "valid_until": "2026-04-20T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T20:20:25.118Z",
      "x_nadsec_last_seen": "2026-03-19T20:22:30.558Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-19T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--4b470ff6-5a84-40cb-927e-77b150bd1b70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T21:05:03.000Z",
      "valid_until": "2026-04-20T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T20:50:35.842Z",
      "x_nadsec_last_seen": "2026-03-19T20:50:35.842Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-19T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--952cf9c5-b789-4379-953a-5811333ad34b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T21:05:03.000Z",
      "valid_until": "2026-04-20T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T20:50:35.205Z",
      "x_nadsec_last_seen": "2026-03-19T20:50:35.205Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-19T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--5cc1278c-7066-4df3-80c6-74244f649152",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.44.143.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T21:05:03.000Z",
      "valid_until": "2026-04-20T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T20:56:37.645Z",
      "x_nadsec_last_seen": "2026-03-19T20:56:37.721Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-19T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.",
      "id": "indicator--8af1def3-9811-4242-8a9f-9112c7e43593",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.188.3.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T21:05:03.000Z",
      "valid_until": "2026-04-20T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T20:37:34.040Z",
      "x_nadsec_last_seen": "2026-03-19T20:39:39.663Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11172"
      ],
      "x_nadsec_orgs": [
        "Alestra, S. de R.L. de C.V."
      ]
    },
    {
      "created": "2026-03-19T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--b94fa017-1310-4bfd-af46-b118a85163f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.65.203.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T21:05:03.000Z",
      "valid_until": "2026-04-20T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T20:34:24.228Z",
      "x_nadsec_last_seen": "2026-03-19T20:34:29.151Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-19T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--3d7a849e-033e-43e9-a34b-49dcd26c69ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.110.147.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T21:05:03.000Z",
      "valid_until": "2026-04-20T21:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-19T20:41:13.865Z",
      "x_nadsec_last_seen": "2026-03-19T22:26:08.358Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-19T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--cc2e04e8-5c89-4a15-b3aa-1b94ad7fc52d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.79.181.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T21:05:03.000Z",
      "valid_until": "2026-04-20T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T20:21:17.294Z",
      "x_nadsec_last_seen": "2026-03-19T20:21:47.295Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-19T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CO; asn=27831; asn_org=Colombia Movil",
      "id": "indicator--af7e1982-56cf-4a72-9976-0244bc0f0ef6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.253.71.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T22:05:05.000Z",
      "valid_until": "2026-04-20T22:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-19T21:25:25.022Z",
      "x_nadsec_last_seen": "2026-03-19T21:26:14.381Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "27831"
      ],
      "x_nadsec_orgs": [
        "Colombia Movil"
      ]
    },
    {
      "created": "2026-03-19T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--26fc687d-6a09-4e01-a57f-ac147059322c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.38.141.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T22:05:05.000Z",
      "valid_until": "2026-04-20T22:05:03.000Z",
      "x_nadsec_event_count": 3150,
      "x_nadsec_first_seen": "2026-03-19T21:55:03.401Z",
      "x_nadsec_last_seen": "2026-03-19T23:46:08.669Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-19T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--c1bfa54a-d1e4-4195-881a-3c025ad29b30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.34.237.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T22:05:05.000Z",
      "valid_until": "2026-04-20T22:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T21:26:36.058Z",
      "x_nadsec_last_seen": "2026-03-19T21:36:42.533Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-19T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--52c6f886-76ad-4163-b08e-0af4cf6ad2ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.228.36.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T22:05:05.000Z",
      "valid_until": "2026-04-20T22:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T21:23:32.660Z",
      "x_nadsec_last_seen": "2026-03-19T21:23:32.660Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-19T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4811; asn_org=China Telecom Group; user(top)=**",
      "id": "indicator--dd2e9b5f-d944-422e-bb79-6b94ce459a64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.80.34.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T23:05:02.000Z",
      "valid_until": "2026-04-20T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T22:24:34.660Z",
      "x_nadsec_last_seen": "2026-03-19T22:24:34.660Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4811"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-19T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=55836; asn_org=Reliance Jio Infocomm Limited; user(top)=**",
      "id": "indicator--521a3dfc-5644-4e4e-93af-6ff0bbe5d1fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.240.147.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T23:05:02.000Z",
      "valid_until": "2026-04-20T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-19T22:41:07.524Z",
      "x_nadsec_last_seen": "2026-03-19T22:41:07.524Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55836"
      ],
      "x_nadsec_orgs": [
        "Reliance Jio Infocomm Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-19T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ab0a2458-7b56-476e-8a7b-9b0d9bc41d82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T23:05:02.000Z",
      "valid_until": "2026-04-20T23:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T22:43:02.782Z",
      "x_nadsec_last_seen": "2026-03-28T20:49:01.501Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-19T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--c3a88bcc-6e74-4da2-9d0e-cdd6e15367fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.63.152.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T23:05:02.000Z",
      "valid_until": "2026-04-20T23:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-19T22:33:14.232Z",
      "x_nadsec_last_seen": "2026-03-19T23:21:30.440Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-19T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=14; services=httpd; ports=81; cc=US; asn=215925; asn_org=Vpsvault.host Ltd",
      "id": "indicator--b0525028-ca2c-42bc-bfda-ed5d554d9ec9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T23:05:02.000Z",
      "valid_until": "2026-04-20T23:05:01.000Z",
      "x_nadsec_event_count": 56,
      "x_nadsec_first_seen": "2026-03-19T22:05:22.140Z",
      "x_nadsec_last_seen": "2026-03-28T05:27:20.361Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "215925"
      ],
      "x_nadsec_orgs": [
        "Vpsvault.host Ltd"
      ]
    },
    {
      "created": "2026-03-19T23:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=FR; asn=16276; asn_org=OVH SAS",
      "id": "indicator--39278a53-a6c6-4eaa-8ab1-8016e4513bad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-19T23:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.39.12.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T23:05:02.000Z",
      "valid_until": "2026-04-20T23:05:01.000Z",
      "x_nadsec_event_count": 310,
      "x_nadsec_first_seen": "2026-03-19T18:45:13.418Z",
      "x_nadsec_last_seen": "2026-03-24T16:37:42.947Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-03-20T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--e1311563-edb9-4519-bd36-16daa4824cab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.38.107.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:05:04.000Z",
      "valid_until": "2026-04-21T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-19T23:37:02.037Z",
      "x_nadsec_last_seen": "2026-03-19T23:43:32.924Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-20T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--8751e5b4-0265-41ee-bd2a-5a0500235ce2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.141.0.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:05:04.000Z",
      "valid_until": "2026-04-21T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T23:46:29.318Z",
      "x_nadsec_last_seen": "2026-03-19T23:46:29.324Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-20T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bfd5923b-deca-4065-ad3e-5ef510c5b16f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.22.104.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:05:04.000Z",
      "valid_until": "2026-04-21T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T23:30:51.000Z",
      "x_nadsec_last_seen": "2026-03-23T03:13:13.569Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-20T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=23106; asn_org=AMERICAN TOWER DO BRASIL-COMUNICACAO MULTIMIDIA LT",
      "id": "indicator--01963713-dcdc-44e6-b3ce-18722a038cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.248.233.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:05:04.000Z",
      "valid_until": "2026-04-21T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T23:14:55.222Z",
      "x_nadsec_last_seen": "2026-03-19T23:17:02.421Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "23106"
      ],
      "x_nadsec_orgs": [
        "AMERICAN TOWER DO BRASIL-COMUNICACAO MULTIMIDIA LT"
      ]
    },
    {
      "created": "2026-03-20T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--69a73c4b-4549-497e-9d9a-8ddebcb237b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:05:04.000Z",
      "valid_until": "2026-04-21T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-19T23:51:59.263Z",
      "x_nadsec_last_seen": "2026-03-25T22:07:04.007Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-20T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--ebc52efb-6d38-42c9-93d9-5149bc10c37b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.26.233.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:05:04.000Z",
      "valid_until": "2026-04-21T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T23:24:27.451Z",
      "x_nadsec_last_seen": "2026-03-19T23:26:35.388Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-20T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GB; asn=13285; asn_org=TalkTalk",
      "id": "indicator--6ba70776-03b0-42f0-b5c6-ceb76a96d698",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.27.136.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:05:04.000Z",
      "valid_until": "2026-04-21T00:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-11T15:48:25.716Z",
      "x_nadsec_last_seen": "2026-03-19T23:51:39.441Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "13285"
      ],
      "x_nadsec_orgs": [
        "TalkTalk"
      ]
    },
    {
      "created": "2026-03-20T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--dc76aed1-03ee-4785-9924-94bf0efd003f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.47.131.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:05:04.000Z",
      "valid_until": "2026-04-21T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-19T23:13:33.324Z",
      "x_nadsec_last_seen": "2026-03-19T23:15:39.690Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-20T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--645c4c73-b529-428b-8cc6-f85ae705b280",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.236.47.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:05:03.000Z",
      "valid_until": "2026-04-21T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T00:13:15.959Z",
      "x_nadsec_last_seen": "2026-03-20T00:17:33.719Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-20T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--1aa1874f-7bb8-4af5-a4aa-9c9b70964bd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:05:03.000Z",
      "valid_until": "2026-04-21T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T00:17:30.164Z",
      "x_nadsec_last_seen": "2026-03-20T00:18:00.166Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-20T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262907; asn_org=BRASIL TECPAR | AMIGO | AVATO",
      "id": "indicator--315833d5-a406-42af-8658-37a838c393b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.36.35.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:05:03.000Z",
      "valid_until": "2026-04-21T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T00:26:32.731Z",
      "x_nadsec_last_seen": "2026-03-20T00:28:39.334Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262907"
      ],
      "x_nadsec_orgs": [
        "BRASIL TECPAR | AMIGO | AVATO"
      ]
    },
    {
      "created": "2026-03-20T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--c567e8f9-4c05-40d2-a42b-b0128cc5be5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.253.67.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:05:03.000Z",
      "valid_until": "2026-04-21T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T01:00:06.378Z",
      "x_nadsec_last_seen": "2026-03-20T01:02:13.564Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-03-20T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--c5b15c82-1448-4c1a-a74c-483e45a50bdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.37.140.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:05:03.000Z",
      "valid_until": "2026-04-21T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T00:29:52.290Z",
      "x_nadsec_last_seen": "2026-03-20T00:31:58.988Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-20T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--3a40e319-d787-4696-920b-101e41ed2cb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.196.224.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:05:03.000Z",
      "valid_until": "2026-04-21T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T00:22:55.559Z",
      "x_nadsec_last_seen": "2026-03-20T00:25:00.707Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-03-20T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PS; asn=211057; asn_org=Astra for Telecommunication and IT Services; user(top)=**",
      "id": "indicator--041d756c-b7d4-4998-abe4-7a475699ee3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.21.120.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:05:03.000Z",
      "valid_until": "2026-04-21T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T00:29:47.183Z",
      "x_nadsec_last_seen": "2026-03-21T06:59:34.382Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "211057"
      ],
      "x_nadsec_orgs": [
        "Astra for Telecommunication and IT Services"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-20T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--4519b041-a404-4c40-8adc-5fcbc3173540",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.191.59.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:05:03.000Z",
      "valid_until": "2026-04-21T01:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-20T00:14:19.733Z",
      "x_nadsec_last_seen": "2026-03-28T12:10:58.808Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-20T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45903; asn_org=CMC Telecom Infrastructure Company",
      "id": "indicator--7a74cc2b-4584-45a2-8f05-6f422a90525b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.205.52.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:05:03.000Z",
      "valid_until": "2026-04-21T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T00:17:33.566Z",
      "x_nadsec_last_seen": "2026-03-20T00:17:33.566Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45903"
      ],
      "x_nadsec_orgs": [
        "CMC Telecom Infrastructure Company"
      ]
    },
    {
      "created": "2026-03-20T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=24088; asn_org=Hanoi Telecom Joint Stock Company - HCMC Branch",
      "id": "indicator--ed6b80c8-3d13-48ef-a445-b93137e7094f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.209.181.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:05:03.000Z",
      "valid_until": "2026-04-21T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T00:19:37.482Z",
      "x_nadsec_last_seen": "2026-03-20T00:19:38.216Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24088"
      ],
      "x_nadsec_orgs": [
        "Hanoi Telecom Joint Stock Company - HCMC Branch"
      ]
    },
    {
      "created": "2026-03-20T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--55247113-2db0-4fbe-a0ce-fe12fca9ac6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:05:03.000Z",
      "valid_until": "2026-04-21T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T00:15:30.280Z",
      "x_nadsec_last_seen": "2026-03-20T00:15:30.280Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-20T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--d1e11f36-aee6-4792-be3a-3a6565e40801",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '218.23.19.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:05:03.000Z",
      "valid_until": "2026-04-21T01:05:01.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-03-20T00:33:24.567Z",
      "x_nadsec_last_seen": "2026-03-20T00:35:59.501Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-20T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=SG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--278d8cca-c6c4-4771-ac8e-ee050e618953",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.255.223.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:05:03.000Z",
      "valid_until": "2026-04-21T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T00:57:07.311Z",
      "x_nadsec_last_seen": "2026-03-20T23:42:48.468Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-20T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--1de6f33f-12fd-4fab-aef0-027ce7b4560d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.202.70.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:05:03.000Z",
      "valid_until": "2026-04-21T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T00:58:57.929Z",
      "x_nadsec_last_seen": "2026-03-20T00:58:57.929Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-20T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--560c5f8a-49b7-43c0-b405-ac06ab4ddb41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.44.119.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:05:03.000Z",
      "valid_until": "2026-04-21T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T00:17:42.279Z",
      "x_nadsec_last_seen": "2026-03-20T00:17:42.315Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-20T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--19205eb5-efb0-4c3c-a2fc-e2deb6d171ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.4.196.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T02:05:02.000Z",
      "valid_until": "2026-04-21T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T01:49:18.555Z",
      "x_nadsec_last_seen": "2026-03-20T01:49:23.290Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-20T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--be03f6d9-2b6b-4ccf-a170-c64ae267536f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.219.91.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T02:05:02.000Z",
      "valid_until": "2026-04-21T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T01:52:12.261Z",
      "x_nadsec_last_seen": "2026-03-20T01:54:16.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-20T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--d71609d7-f3eb-4667-9d54-4aa5787ae17b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.136.60.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T02:05:02.000Z",
      "valid_until": "2026-04-21T02:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T01:11:28.150Z",
      "x_nadsec_last_seen": "2026-03-20T01:16:22.608Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-20T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--c79c2f54-bd7a-4554-93e2-376f800ac00d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.52.27.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T02:05:02.000Z",
      "valid_until": "2026-04-21T02:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T01:49:49.152Z",
      "x_nadsec_last_seen": "2026-03-20T01:54:08.454Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-20T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--65b3e847-71c6-434b-b34f-5868bba83447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T02:05:02.000Z",
      "valid_until": "2026-04-21T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T01:09:15.568Z",
      "x_nadsec_last_seen": "2026-03-20T01:09:15.568Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-20T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e754f851-6e1e-4c5c-b4bf-ec3e5071baa0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T02:05:02.000Z",
      "valid_until": "2026-04-21T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T01:58:41.522Z",
      "x_nadsec_last_seen": "2026-03-20T01:59:14.194Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-20T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--cbb446fc-1cec-4804-a33f-c433459f8369",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T02:05:02.000Z",
      "valid_until": "2026-04-21T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T01:31:03.229Z",
      "x_nadsec_last_seen": "2026-03-20T01:31:03.229Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-20T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--c365669b-847e-4443-a5f5-7bdf84348084",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.224.6.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T02:05:02.000Z",
      "valid_until": "2026-04-21T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T01:52:23.533Z",
      "x_nadsec_last_seen": "2026-03-20T01:52:29.748Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-20T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--3e449657-f615-4042-b4a2-ce840092a748",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.165.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T02:05:02.000Z",
      "valid_until": "2026-04-21T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T01:07:43.868Z",
      "x_nadsec_last_seen": "2026-03-20T01:07:43.868Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-20T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--fd72bdaa-f2f0-4f78-8981-62762a7eda76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.95.183.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T02:05:02.000Z",
      "valid_until": "2026-04-21T02:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T01:17:05.122Z",
      "x_nadsec_last_seen": "2026-03-20T01:18:25.532Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-20T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--bb6ab765-c241-43da-a27d-c26a40958c64",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.11.193.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:05:02.000Z",
      "valid_until": "2026-04-21T03:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T02:39:53.428Z",
      "x_nadsec_last_seen": "2026-03-20T02:42:01.098Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-03-20T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--a3f6cd8d-1163-4b8e-8c88-1130252612f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.199.4.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:05:02.000Z",
      "valid_until": "2026-04-21T03:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T03:03:08.052Z",
      "x_nadsec_last_seen": "2026-03-29T15:44:10.678Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-20T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--0a1e389a-28b1-462e-8e6e-1e11d692b361",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.50.66.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:05:02.000Z",
      "valid_until": "2026-04-21T03:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T02:24:08.273Z",
      "x_nadsec_last_seen": "2026-03-20T02:26:23.337Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-20T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--56932fab-13e2-4b6f-ae9e-35dbff8542a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.50.66.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:05:02.000Z",
      "valid_until": "2026-04-21T03:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T02:26:16.507Z",
      "x_nadsec_last_seen": "2026-03-20T02:26:21.545Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-20T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--6c25824e-3516-4248-838e-d3274433dac2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.75.4.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:05:02.000Z",
      "valid_until": "2026-04-21T03:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T02:08:17.423Z",
      "x_nadsec_last_seen": "2026-03-20T02:10:21.960Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-20T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--c6107b64-91c9-4830-a0f4-40a07202f2ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.98.247.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:05:02.000Z",
      "valid_until": "2026-04-21T03:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T02:57:08.939Z",
      "x_nadsec_last_seen": "2026-03-20T02:59:14.711Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-20T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17762; asn_org=Tata Teleservices Maharashtra Ltd",
      "id": "indicator--eac84cb7-3712-4468-9d75-fa152d7069c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.252.174.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:05:02.000Z",
      "valid_until": "2026-04-21T03:05:00.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-20T02:42:07.803Z",
      "x_nadsec_last_seen": "2026-03-20T10:17:45.334Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17762"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices Maharashtra Ltd"
      ]
    },
    {
      "created": "2026-03-20T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0e40264e-a4e2-4e74-8781-902a2ee8f52e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:05:02.000Z",
      "valid_until": "2026-04-21T03:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T02:22:21.024Z",
      "x_nadsec_last_seen": "2026-03-20T02:22:21.840Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-20T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--51a3a0ee-3538-47e8-a9a7-4ea747a781e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.253.38.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:05:02.000Z",
      "valid_until": "2026-04-21T03:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T03:01:14.301Z",
      "x_nadsec_last_seen": "2026-03-20T03:07:44.512Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-03-20T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28233; asn_org=I-CONECTA REDES DE TELECOMUNICACAO EIRELI EPP",
      "id": "indicator--7a990a90-5c65-4a83-97be-8f59206478c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.127.60.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:05:02.000Z",
      "valid_until": "2026-04-21T03:05:00.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-16T18:59:09.900Z",
      "x_nadsec_last_seen": "2026-03-30T17:29:14.867Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28233"
      ],
      "x_nadsec_orgs": [
        "I-CONECTA REDES DE TELECOMUNICACAO EIRELI EPP"
      ]
    },
    {
      "created": "2026-03-20T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=130; services=smbd; ports=445; cc=ES; asn=41608; asn_org=NextGenWebs, S.L.",
      "id": "indicator--79c43c0e-9ddc-46de-b39d-947fa573451e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.170.172.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:05:02.000Z",
      "valid_until": "2026-04-21T03:05:00.000Z",
      "x_nadsec_event_count": 264,
      "x_nadsec_first_seen": "2026-03-20T02:25:19.093Z",
      "x_nadsec_last_seen": "2026-03-22T05:58:51.021Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "41608"
      ],
      "x_nadsec_orgs": [
        "NextGenWebs, S.L."
      ]
    },
    {
      "created": "2026-03-20T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--8dabf845-53f3-46d5-919f-ede9202c8113",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.31.20.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:05:08.000Z",
      "valid_until": "2026-04-21T04:05:04.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-20T03:31:57.315Z",
      "x_nadsec_last_seen": "2026-03-20T03:32:10.928Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-20T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3f18d720-6cd9-4fa2-971a-c63a31c797f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:05:08.000Z",
      "valid_until": "2026-04-21T04:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T03:55:00.466Z",
      "x_nadsec_last_seen": "2026-03-20T03:55:00.466Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-20T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--9b22ac02-f537-47f9-9010-b359e367a50e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:05:08.000Z",
      "valid_until": "2026-04-21T04:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T03:20:50.751Z",
      "x_nadsec_last_seen": "2026-03-20T03:20:50.751Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-20T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=27717; asn_org=Corporacion Digitel C.A.",
      "id": "indicator--d9e29ad3-f735-42a3-8e80-cd8b23d35a9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.167.32.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:05:08.000Z",
      "valid_until": "2026-04-21T04:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T03:37:04.981Z",
      "x_nadsec_last_seen": "2026-03-20T03:39:10.842Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "27717"
      ],
      "x_nadsec_orgs": [
        "Corporacion Digitel C.A."
      ]
    },
    {
      "created": "2026-03-20T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--baf4989b-1487-4b02-94ae-82be01128105",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.252.4.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:05:08.000Z",
      "valid_until": "2026-04-21T04:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T03:27:50.778Z",
      "x_nadsec_last_seen": "2026-03-20T03:29:56.735Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-20T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=268437; asn_org=BRAXTEL TELECOM E TI",
      "id": "indicator--dcfe6656-768d-4c56-9e12-d96eea2148d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.160.21.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:05:08.000Z",
      "valid_until": "2026-04-21T04:05:04.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-20T04:01:55.646Z",
      "x_nadsec_last_seen": "2026-03-28T22:58:19.952Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "268437"
      ],
      "x_nadsec_orgs": [
        "BRAXTEL TELECOM E TI"
      ]
    },
    {
      "created": "2026-03-20T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3520; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--8b91aaa6-35ff-4658-ac01-61cd23d6bd5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.20.44.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:05:08.000Z",
      "valid_until": "2026-04-21T04:05:04.000Z",
      "x_nadsec_event_count": 3520,
      "x_nadsec_first_seen": "2026-03-20T03:47:43.687Z",
      "x_nadsec_last_seen": "2026-03-20T03:51:13.200Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-20T04:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--59686c98-85fc-443e-90b0-170afb311323",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T04:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.10.0.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:05:08.000Z",
      "valid_until": "2026-04-21T04:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T04:04:08.476Z",
      "x_nadsec_last_seen": "2026-03-20T04:06:15.108Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-20T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--35fec062-9956-4b7e-956b-dc267f94c481",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '100.1.33.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:05:03.000Z",
      "valid_until": "2026-04-21T05:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-20T04:20:58.444Z",
      "x_nadsec_last_seen": "2026-03-24T01:26:06.439Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-03-20T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--c86ee2f4-5b3d-49a5-b4eb-8c848f25425b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.75.40.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:05:03.000Z",
      "valid_until": "2026-04-21T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T04:31:07.913Z",
      "x_nadsec_last_seen": "2026-03-20T04:33:14.507Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-03-20T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c2742e6d-90cc-4f12-a356-6d84e13a97fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.190.229.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:05:03.000Z",
      "valid_until": "2026-04-21T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T04:07:52.560Z",
      "x_nadsec_last_seen": "2026-03-20T04:09:58.908Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-20T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet; user(top)=**",
      "id": "indicator--e31c1121-1cc6-4ed1-9054-f162c1e29cd6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.217.51.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:05:03.000Z",
      "valid_until": "2026-04-21T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T04:30:59.407Z",
      "x_nadsec_last_seen": "2026-03-20T04:30:59.407Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-20T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--450703d3-974a-4790-bdd6-c455f68bc5c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.173.95.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:05:03.000Z",
      "valid_until": "2026-04-21T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T04:27:21.035Z",
      "x_nadsec_last_seen": "2026-03-20T04:29:25.925Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-20T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--a73a6e5a-fa71-4cbf-b9fb-f1f3655f85ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:05:03.000Z",
      "valid_until": "2026-04-21T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T04:23:06.024Z",
      "x_nadsec_last_seen": "2026-03-20T04:23:06.024Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-20T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--9b6a37c7-af7e-475f-9dca-9818144d6be5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.141.9.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:05:03.000Z",
      "valid_until": "2026-04-21T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T04:07:31.588Z",
      "x_nadsec_last_seen": "2026-03-20T04:07:31.588Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-20T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--8b26d3ab-bea6-4346-ba6c-887889b7ebd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.33.193.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:05:03.000Z",
      "valid_until": "2026-04-21T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T04:21:58.786Z",
      "x_nadsec_last_seen": "2026-03-20T04:24:05.081Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-20T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--8dad4109-4a58-4fd8-b61c-b863b34d0373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:05:03.000Z",
      "valid_until": "2026-04-21T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T04:53:37.913Z",
      "x_nadsec_last_seen": "2026-03-20T04:53:37.913Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-20T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--bfcab118-2576-4fa4-9b4a-650e84e9f910",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:05:03.000Z",
      "valid_until": "2026-04-21T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T04:57:48.201Z",
      "x_nadsec_last_seen": "2026-03-20T04:57:48.201Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-20T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f3937848-59e4-44a9-b026-05e0f3264bdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:05:03.000Z",
      "valid_until": "2026-04-21T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T04:57:48.539Z",
      "x_nadsec_last_seen": "2026-03-20T04:57:48.539Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=133278; asn_org=Dehradun Enet Solutions Private Ltd",
      "id": "indicator--7be4aff1-a313-4d25-8a1e-17864131e173",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.230.155.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:05:03.000Z",
      "valid_until": "2026-04-21T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T05:39:13.170Z",
      "x_nadsec_last_seen": "2026-03-20T05:46:54.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133278"
      ],
      "x_nadsec_orgs": [
        "Dehradun Enet Solutions Private Ltd"
      ]
    },
    {
      "created": "2026-03-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--0270d6f8-48ab-4309-bb4c-b61d4cff34f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.92.81.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:05:03.000Z",
      "valid_until": "2026-04-21T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T05:16:12.456Z",
      "x_nadsec_last_seen": "2026-03-20T05:16:12.625Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TH; asn=23969; asn_org=TOT Public Company Limited; user(top)=**",
      "id": "indicator--bf0c4cd7-af15-4b13-b3ca-58a9c2ca178a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.24.190.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:05:03.000Z",
      "valid_until": "2026-04-21T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T06:03:33.862Z",
      "x_nadsec_last_seen": "2026-03-20T06:03:33.862Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--af4f2696-1a16-4b6e-b6c1-c553a585e1af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.162.128.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:05:03.000Z",
      "valid_until": "2026-04-21T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T05:13:22.035Z",
      "x_nadsec_last_seen": "2026-03-20T05:15:28.002Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2e56e713-808e-4145-b06e-502c6bd8d5c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.186.143.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:05:03.000Z",
      "valid_until": "2026-04-21T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T05:33:19.935Z",
      "x_nadsec_last_seen": "2026-03-20T05:35:24.557Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--009b15a3-f8f8-44e0-903a-aae71f239220",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.82.98.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:05:03.000Z",
      "valid_until": "2026-04-21T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T05:56:25.815Z",
      "x_nadsec_last_seen": "2026-03-20T05:58:31.164Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8610047e-fb6d-4b81-9a69-c000ad285f1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:05:03.000Z",
      "valid_until": "2026-04-21T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T05:06:33.525Z",
      "x_nadsec_last_seen": "2026-03-20T05:06:33.525Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--23b46439-abae-4263-8949-0fa4e9c38b96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.53.11.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:05:03.000Z",
      "valid_until": "2026-04-21T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T05:52:00.724Z",
      "x_nadsec_last_seen": "2026-03-20T05:54:13.595Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--36ac13db-e398-4b8e-bacc-128de61d3aa9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '219.149.208.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:05:03.000Z",
      "valid_until": "2026-04-21T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T05:38:52.981Z",
      "x_nadsec_last_seen": "2026-03-20T05:41:01.859Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--a424d316-6a1e-4a19-a1c8-eaa200b08ab1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '219.149.208.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:05:03.000Z",
      "valid_until": "2026-04-21T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T05:40:58.226Z",
      "x_nadsec_last_seen": "2026-03-20T05:40:58.226Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--bf7f2092-b360-4dee-8567-a96c01fbcf1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '219.149.208.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:05:03.000Z",
      "valid_until": "2026-04-21T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T05:40:58.539Z",
      "x_nadsec_last_seen": "2026-03-20T05:40:58.539Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AL; asn=199276; asn_org=Tele.Co.Albania SHPK",
      "id": "indicator--229cdc07-2f5d-44c3-861f-53cb4c55caf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.247.92.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:05:03.000Z",
      "valid_until": "2026-04-21T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T05:08:29.516Z",
      "x_nadsec_last_seen": "2026-03-20T05:10:35.740Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AL"
      ],
      "x_nadsec_asns": [
        "199276"
      ],
      "x_nadsec_orgs": [
        "Tele.Co.Albania SHPK"
      ]
    },
    {
      "created": "2026-03-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--f282d46b-622e-4cef-a06e-799383c31e12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.35.216.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:05:03.000Z",
      "valid_until": "2026-04-21T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T05:07:02.861Z",
      "x_nadsec_last_seen": "2026-03-20T05:07:02.968Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-03-20T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--cea0b897-cf35-4972-9962-cb4d798b3a0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.218.205.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:05:03.000Z",
      "valid_until": "2026-04-21T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T05:27:20.282Z",
      "x_nadsec_last_seen": "2026-03-20T05:27:26.654Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-20T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45916; asn_org=Gujarat Telelink Pvt Ltd",
      "id": "indicator--f4e1e380-a605-4743-bf4b-4d833a460ea5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.250.147.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T07:05:03.000Z",
      "valid_until": "2026-04-21T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T06:27:20.613Z",
      "x_nadsec_last_seen": "2026-03-20T06:29:25.923Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45916"
      ],
      "x_nadsec_orgs": [
        "Gujarat Telelink Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-20T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--607ab60d-17e9-43f3-a319-386b18f60357",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.229.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T07:05:03.000Z",
      "valid_until": "2026-04-21T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T06:44:27.969Z",
      "x_nadsec_last_seen": "2026-03-20T06:44:28.212Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-20T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--fd6d040c-5687-4315-a660-4514deeca53e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.174.105.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T07:05:03.000Z",
      "valid_until": "2026-04-21T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T06:28:39.505Z",
      "x_nadsec_last_seen": "2026-03-20T06:30:44.455Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-20T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--d4b09e04-caf7-480e-a8f9-49abdb8a4691",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.234.129.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T07:05:03.000Z",
      "valid_until": "2026-04-21T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T06:46:32.312Z",
      "x_nadsec_last_seen": "2026-03-20T06:46:33.021Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-20T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--cc7d0f4b-8119-4cff-b155-e178271f306a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T07:05:03.000Z",
      "valid_until": "2026-04-21T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T06:11:43.261Z",
      "x_nadsec_last_seen": "2026-03-20T06:11:43.261Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-20T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--e6881181-1188-43b1-b558-5bb3a6023906",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '175.167.148.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T07:05:03.000Z",
      "valid_until": "2026-04-21T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T06:30:34.277Z",
      "x_nadsec_last_seen": "2026-03-20T06:32:41.496Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-20T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--52c37982-8a44-4444-80d7-cd6d737fd7c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.202.1.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T07:05:03.000Z",
      "valid_until": "2026-04-21T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T06:44:37.288Z",
      "x_nadsec_last_seen": "2026-03-20T06:46:43.898Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-20T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--bdf7395e-1f6e-4079-b840-018d9cd938c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.135.185.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T07:05:03.000Z",
      "valid_until": "2026-04-21T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T06:59:24.580Z",
      "x_nadsec_last_seen": "2026-03-20T07:05:50.970Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-20T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--8435a3ee-1f29-43fa-9c94-33373083a1dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.186.132.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T07:05:03.000Z",
      "valid_until": "2026-04-21T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T06:21:59.293Z",
      "x_nadsec_last_seen": "2026-03-20T06:24:04.593Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-20T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7697e62e-a969-4209-8c8b-330ece866aaf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T07:05:03.000Z",
      "valid_until": "2026-04-21T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T06:31:27.401Z",
      "x_nadsec_last_seen": "2026-03-28T03:31:18.139Z",
      "x_nadsec_ports": [
        "445",
        "1723"
      ],
      "x_nadsec_services": [
        "smbd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-20T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a065ef79-cee4-465c-a186-ea8e64e8178c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.171.96.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T07:05:03.000Z",
      "valid_until": "2026-04-21T07:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-20T06:18:05.885Z",
      "x_nadsec_last_seen": "2026-03-22T10:59:28.592Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-20T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--57b3ab54-d736-4011-92a4-472e61dd752e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.109.44.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T07:05:03.000Z",
      "valid_until": "2026-04-21T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T07:03:35.298Z",
      "x_nadsec_last_seen": "2026-03-20T07:11:39.449Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-20T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--d5e8562d-0380-4f21-afe0-9f8d56433f0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.41.236.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T07:05:03.000Z",
      "valid_until": "2026-04-21T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T06:44:40.741Z",
      "x_nadsec_last_seen": "2026-03-20T06:46:47.108Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-03-20T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NP; asn=17501; asn_org=WorldLink Communications Pvt Ltd",
      "id": "indicator--ca5edfc5-af82-4119-b433-55c45af1807a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.5.73.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T08:05:03.000Z",
      "valid_until": "2026-04-21T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T07:46:57.273Z",
      "x_nadsec_last_seen": "2026-03-20T07:46:57.273Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "17501"
      ],
      "x_nadsec_orgs": [
        "WorldLink Communications Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-20T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IT; asn=62044; asn_org=Zscaler Switzerland GmbH",
      "id": "indicator--270c40cc-f5ac-4750-9f66-820206e498f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.85.31.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T08:05:03.000Z",
      "valid_until": "2026-04-21T08:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T07:51:23.561Z",
      "x_nadsec_last_seen": "2026-03-20T07:56:00.837Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "62044"
      ],
      "x_nadsec_orgs": [
        "Zscaler Switzerland GmbH"
      ]
    },
    {
      "created": "2026-03-20T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=NP; asn=17501; asn_org=WorldLink Communications Pvt Ltd",
      "id": "indicator--d5c2182b-ac91-46bd-8590-6b06caa10bc9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.79.60.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T08:05:03.000Z",
      "valid_until": "2026-04-21T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T07:46:30.475Z",
      "x_nadsec_last_seen": "2026-03-20T07:46:30.637Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "17501"
      ],
      "x_nadsec_orgs": [
        "WorldLink Communications Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-20T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8e41d9b2-93d9-4577-8993-a51158e8a5a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.69.154.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T08:05:03.000Z",
      "valid_until": "2026-04-21T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T08:04:57.318Z",
      "x_nadsec_last_seen": "2026-03-20T08:07:02.238Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-20T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c9e0c578-d6fd-4320-ab9a-61e92227eabf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.76.140.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T08:05:03.000Z",
      "valid_until": "2026-04-21T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T07:17:53.043Z",
      "x_nadsec_last_seen": "2026-03-20T07:17:53.043Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-20T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--63ba1563-0192-4ad2-bf58-775e51faaed6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.200.148.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T08:05:03.000Z",
      "valid_until": "2026-04-21T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T07:43:48.590Z",
      "x_nadsec_last_seen": "2026-03-20T07:45:53.226Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-03-20T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=33934; asn_org=Rostelecom",
      "id": "indicator--dec30938-e6b8-4b91-9ca0-a4feb7194710",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.173.80.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T08:05:03.000Z",
      "valid_until": "2026-04-21T08:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T07:25:46.934Z",
      "x_nadsec_last_seen": "2026-03-20T07:27:07.400Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "33934"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-20T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--ae768871-1162-41cb-8b53-014c3caefe01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.34.189.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:05:04.000Z",
      "valid_until": "2026-04-21T09:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-13T03:13:23.612Z",
      "x_nadsec_last_seen": "2026-03-20T08:06:53.298Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-20T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--ed4f0900-0600-45dd-83ee-8853ddf7524c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.19.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:05:04.000Z",
      "valid_until": "2026-04-21T09:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T09:02:09.277Z",
      "x_nadsec_last_seen": "2026-03-20T09:10:26.690Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-20T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--02d9c94e-04db-4a7d-b287-8178791749dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.252.208.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:05:04.000Z",
      "valid_until": "2026-04-21T09:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T08:29:01.316Z",
      "x_nadsec_last_seen": "2026-03-20T08:35:27.504Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-20T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--e0d616bb-fd10-4a69-ad2a-0dbda0149f5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.73.222.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:05:04.000Z",
      "valid_until": "2026-04-21T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T08:37:26.320Z",
      "x_nadsec_last_seen": "2026-03-20T08:39:31.004Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-20T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--78ba5d81-a8fa-4dc0-ab2c-0f8309fe0029",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.160.122.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:05:04.000Z",
      "valid_until": "2026-04-21T09:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T08:46:38.451Z",
      "x_nadsec_last_seen": "2026-03-20T08:46:38.451Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-20T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EC; asn=269935; asn_org=TAPIA FLORES OSCAR ALDO FIBRANET ZAMORA",
      "id": "indicator--6678ee79-6a8c-4669-9096-83a1ab858198",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.83.15.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:05:04.000Z",
      "valid_until": "2026-04-21T09:05:00.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-20T08:39:10.505Z",
      "x_nadsec_last_seen": "2026-03-27T07:15:02.876Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "269935"
      ],
      "x_nadsec_orgs": [
        "TAPIA FLORES OSCAR ALDO FIBRANET ZAMORA"
      ]
    },
    {
      "created": "2026-03-20T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--1be61a35-b056-4a27-b355-fa7ab9db7b80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.69.31.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:05:04.000Z",
      "valid_until": "2026-04-21T09:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T08:56:02.656Z",
      "x_nadsec_last_seen": "2026-03-20T08:56:03.049Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-20T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--2beee95e-816c-4e65-b57e-70bf7bad908b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.237.220.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:05:04.000Z",
      "valid_until": "2026-04-21T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T08:37:56.912Z",
      "x_nadsec_last_seen": "2026-03-20T08:40:01.729Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-20T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--4b0f2092-8f41-4af5-8320-e8ff0cdfb99c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.35.219.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:05:04.000Z",
      "valid_until": "2026-04-21T09:05:00.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-20T08:20:28.534Z",
      "x_nadsec_last_seen": "2026-03-23T09:05:37.631Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-20T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--961607b1-4073-48e8-bf6a-c2092811b0a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.127.95.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:05:04.000Z",
      "valid_until": "2026-04-21T09:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T08:12:44.674Z",
      "x_nadsec_last_seen": "2026-03-20T08:19:11.205Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-20T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--21bb8cf8-d10a-4fac-82a1-0af617830393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.145.65.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:05:04.000Z",
      "valid_until": "2026-04-21T09:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T08:34:55.595Z",
      "x_nadsec_last_seen": "2026-03-20T08:35:20.850Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-20T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--4debd4c0-8377-44d7-8cae-979157a915a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.68.226.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:05:04.000Z",
      "valid_until": "2026-04-21T09:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T09:04:52.751Z",
      "x_nadsec_last_seen": "2026-03-20T09:12:37.849Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-20T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134932; asn_org=VORTEX INFOWAY PRIVATE LIMITED",
      "id": "indicator--46cabebc-91d0-4144-8f34-f429f119499b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.164.240.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T10:05:02.000Z",
      "valid_until": "2026-04-21T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T09:50:09.999Z",
      "x_nadsec_last_seen": "2026-03-20T09:52:15.259Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134932"
      ],
      "x_nadsec_orgs": [
        "VORTEX INFOWAY PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-20T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=17421; asn_org=Mobile Business Group",
      "id": "indicator--0f7ba2b2-e6e0-4985-b360-02a71d31b9f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.70.10.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T10:05:02.000Z",
      "valid_until": "2026-04-21T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T09:12:13.675Z",
      "x_nadsec_last_seen": "2026-03-20T09:14:18.657Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "17421"
      ],
      "x_nadsec_orgs": [
        "Mobile Business Group"
      ]
    },
    {
      "created": "2026-03-20T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=VN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c7b2ee07-cbfd-4831-9683-3fc72c2a874f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.160.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T10:05:02.000Z",
      "valid_until": "2026-04-21T10:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T09:23:18.344Z",
      "x_nadsec_last_seen": "2026-03-20T09:23:41.264Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-20T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--106bcdb7-5795-48a6-a7dd-57db3edc65be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.150.26.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T10:05:02.000Z",
      "valid_until": "2026-04-21T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T09:12:50.467Z",
      "x_nadsec_last_seen": "2026-03-20T09:12:50.588Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-20T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=16276; asn_org=OVH SAS; user(top)=**",
      "id": "indicator--2b0650eb-2606-4157-8118-5676e989b32f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '51.255.50.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T10:05:02.000Z",
      "valid_until": "2026-04-21T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T09:18:19.256Z",
      "x_nadsec_last_seen": "2026-03-20T09:18:19.256Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-20T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--77bfc5de-12b4-466b-a425-ab701a63b2e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.175.53.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T10:05:02.000Z",
      "valid_until": "2026-04-21T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T09:25:23.064Z",
      "x_nadsec_last_seen": "2026-03-20T09:27:29.723Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-20T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--3ac9a8bd-fa11-4425-ad5c-96fc6c31f986",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.164.167.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:05:03.000Z",
      "valid_until": "2026-04-21T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T10:16:41.795Z",
      "x_nadsec_last_seen": "2026-03-20T10:18:47.960Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-20T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--7e4ea8a0-f535-44cd-8ef3-f4e4e3126f25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.0.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:05:03.000Z",
      "valid_until": "2026-04-21T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T10:22:07.170Z",
      "x_nadsec_last_seen": "2026-03-20T10:24:14.524Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-20T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--2072499a-0f1b-4c9f-b702-1e5451be53dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.178.211.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:05:03.000Z",
      "valid_until": "2026-04-21T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T10:45:02.122Z",
      "x_nadsec_last_seen": "2026-03-20T10:53:44.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-20T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--5ab202cc-13cf-486f-afab-5b20c8390854",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:05:03.000Z",
      "valid_until": "2026-04-21T11:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T10:13:22.925Z",
      "x_nadsec_last_seen": "2026-03-22T22:10:24.506Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-20T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--ff037d07-844b-47be-b291-d7c7f1bddc3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.178.220.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:05:03.000Z",
      "valid_until": "2026-04-21T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T10:25:16.498Z",
      "x_nadsec_last_seen": "2026-03-20T10:27:21.495Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-20T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--a66e6794-e476-4334-beb6-e8dc11595635",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.25.96.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:05:03.000Z",
      "valid_until": "2026-04-21T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T10:09:57.483Z",
      "x_nadsec_last_seen": "2026-03-20T10:12:01.971Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-03-20T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=50187; asn_org=BaikalWestCom",
      "id": "indicator--6d9dd2f9-0e07-4e94-9d97-1ba9663792fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.44.247.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:05:03.000Z",
      "valid_until": "2026-04-21T11:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T10:29:22.845Z",
      "x_nadsec_last_seen": "2026-03-20T10:31:28.204Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50187"
      ],
      "x_nadsec_orgs": [
        "BaikalWestCom"
      ]
    },
    {
      "created": "2026-03-20T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--0987008c-b7e3-41f3-9a41-d696bb0915af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.139.147.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:05:03.000Z",
      "valid_until": "2026-04-21T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T10:17:40.910Z",
      "x_nadsec_last_seen": "2026-03-20T10:25:16.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-03-20T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KR; asn=17853; asn_org=LGTELECOM",
      "id": "indicator--6c9df060-0bf2-4be6-afc3-40fa8dbbf5a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.96.49.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T13:05:03.000Z",
      "valid_until": "2026-04-21T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T12:23:49.956Z",
      "x_nadsec_last_seen": "2026-03-20T12:25:54.923Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "17853"
      ],
      "x_nadsec_orgs": [
        "LGTELECOM"
      ]
    },
    {
      "created": "2026-03-20T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=BR; asn=270777; asn_org=RGSul Internet Eireli",
      "id": "indicator--661341d3-1d4d-4278-ae27-648f0213988e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '131.161.119.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T13:05:03.000Z",
      "valid_until": "2026-04-21T13:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-20T12:01:04.881Z",
      "x_nadsec_last_seen": "2026-03-20T12:28:43.474Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "270777"
      ],
      "x_nadsec_orgs": [
        "RGSul Internet Eireli"
      ]
    },
    {
      "created": "2026-03-20T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--bdc7e7db-62f4-4a8f-8b2e-ee7699da190a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.24.16.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:05:03.000Z",
      "valid_until": "2026-04-21T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T13:28:01.840Z",
      "x_nadsec_last_seen": "2026-03-20T13:28:01.840Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-20T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=7497; asn_org=Computer Network Information Center of Chinese Academy of Sciences CNIC-CAS",
      "id": "indicator--38cc0b6c-b763-4328-874d-3264851438a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.226.1.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:05:03.000Z",
      "valid_until": "2026-04-21T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T13:28:28.439Z",
      "x_nadsec_last_seen": "2026-03-20T13:28:28.439Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "7497"
      ],
      "x_nadsec_orgs": [
        "Computer Network Information Center of Chinese Academy of Sciences CNIC-CAS"
      ]
    },
    {
      "created": "2026-03-20T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MA; asn=36903; asn_org=MT-MPLS; user(top)=**",
      "id": "indicator--7f6297f8-46b8-47bc-8edf-dceab9aaaf92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.177.175.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:05:03.000Z",
      "valid_until": "2026-04-21T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T13:48:15.746Z",
      "x_nadsec_last_seen": "2026-03-20T13:48:15.746Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-20T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--b9fae1e7-6d8b-4dcb-abbe-4b80f7df0eba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.36.7.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:05:03.000Z",
      "valid_until": "2026-04-21T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T13:28:18.521Z",
      "x_nadsec_last_seen": "2026-03-20T13:28:18.521Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-20T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=17069; asn_org=Coop Telefonica Villa Gesell Ltda",
      "id": "indicator--08ed93e7-a460-453a-9cb4-ae6203341db5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.192.6.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:05:03.000Z",
      "valid_until": "2026-04-21T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T13:31:18.466Z",
      "x_nadsec_last_seen": "2026-03-20T13:33:26.000Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "17069"
      ],
      "x_nadsec_orgs": [
        "Coop Telefonica Villa Gesell Ltda"
      ]
    },
    {
      "created": "2026-03-20T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--5e38d25a-585e-4a9e-87c9-beaf27dd1761",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.21.164.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:05:03.000Z",
      "valid_until": "2026-04-21T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T14:04:44.203Z",
      "x_nadsec_last_seen": "2026-03-20T14:06:51.895Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-20T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--cae8fe7a-3b3e-4b2a-8df3-55230fdd7b2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.138.158.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:05:03.000Z",
      "valid_until": "2026-04-21T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T13:28:09.978Z",
      "x_nadsec_last_seen": "2026-03-20T13:28:09.978Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-20T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--85e28a75-dbb2-4252-a376-2dc7b3548338",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.155.46.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:05:03.000Z",
      "valid_until": "2026-04-21T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T13:44:28.783Z",
      "x_nadsec_last_seen": "2026-03-20T13:46:34.900Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-20T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IE; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--30e13408-4fe1-4e4c-bdda-57af9c02b497",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.82.167.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:05:03.000Z",
      "valid_until": "2026-04-21T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T13:24:58.794Z",
      "x_nadsec_last_seen": "2026-03-20T13:24:58.951Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IE"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-20T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=51167; asn_org=Contabo GmbH; user(top)=**",
      "id": "indicator--8cf3c6d6-8bb2-4041-9a36-97c3581a58df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.199.42.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:05:03.000Z",
      "valid_until": "2026-04-21T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T13:50:39.583Z",
      "x_nadsec_last_seen": "2026-03-20T13:50:39.583Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-20T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--e427e6ec-d148-4662-9265-8cc572bb218c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.205.238.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:05:03.000Z",
      "valid_until": "2026-04-21T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T13:07:28.826Z",
      "x_nadsec_last_seen": "2026-03-20T13:09:33.364Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-20T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--f4a6c531-6bda-4b41-820b-8c2282740d38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.140.13.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:05:03.000Z",
      "valid_until": "2026-04-21T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T14:02:13.969Z",
      "x_nadsec_last_seen": "2026-03-20T14:02:13.969Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-20T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=55577; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--ccc19c63-f46e-4212-86f6-c400def2d729",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.205.118.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:05:03.000Z",
      "valid_until": "2026-04-21T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T13:57:18.303Z",
      "x_nadsec_last_seen": "2026-03-20T13:59:24.057Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "55577"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-20T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--310be03e-b28e-4b90-9c09-1cc94858f60d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.12.244.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:05:03.000Z",
      "valid_until": "2026-04-21T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T13:28:11.241Z",
      "x_nadsec_last_seen": "2026-03-20T13:28:11.241Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-20T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CA; asn=54527; asn_org=Astute Internet",
      "id": "indicator--22b810bf-02ae-4eb8-8718-855f9b73752b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.38.41.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:05:03.000Z",
      "valid_until": "2026-04-21T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T13:51:16.704Z",
      "x_nadsec_last_seen": "2026-03-20T13:51:16.850Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "54527"
      ],
      "x_nadsec_orgs": [
        "Astute Internet"
      ]
    },
    {
      "created": "2026-03-20T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--51a11212-f8af-4d53-b169-000f985493e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.189.111.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T15:05:03.000Z",
      "valid_until": "2026-04-21T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T14:42:15.719Z",
      "x_nadsec_last_seen": "2026-03-20T14:44:20.520Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-20T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--5445ce49-e724-40a6-8fc5-ab5931e1ce60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.98.37.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T15:05:03.000Z",
      "valid_until": "2026-04-21T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T14:30:51.714Z",
      "x_nadsec_last_seen": "2026-03-20T14:32:57.169Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-03-20T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--f37988be-490d-4538-ae82-ce3d58737933",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.40.240.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T15:05:03.000Z",
      "valid_until": "2026-04-21T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T14:16:19.879Z",
      "x_nadsec_last_seen": "2026-03-20T14:18:26.468Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-20T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--ad04e58a-fa0a-48e8-abd6-8b2d05c1a291",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.87.27.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T15:05:03.000Z",
      "valid_until": "2026-04-21T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T14:17:52.885Z",
      "x_nadsec_last_seen": "2026-03-20T14:19:59.184Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-20T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--38079a31-1976-41da-8b19-0a85d823b168",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T15:05:03.000Z",
      "valid_until": "2026-04-21T15:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T15:00:08.961Z",
      "x_nadsec_last_seen": "2026-03-31T10:33:41.184Z",
      "x_nadsec_ports": [
        "81",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-20T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--a577d2a6-c223-4402-9b79-37e6f3554d05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.136.221.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T15:05:03.000Z",
      "valid_until": "2026-04-21T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T14:55:27.998Z",
      "x_nadsec_last_seen": "2026-03-20T14:57:32.397Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-03-20T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--b670054a-aa88-4967-a59a-4c398f668ef2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.235.217.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T15:05:03.000Z",
      "valid_until": "2026-04-21T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T14:22:49.447Z",
      "x_nadsec_last_seen": "2026-03-20T14:24:59.000Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--79fe4638-aea9-452f-9d3e-e73147e9b242",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.57.95.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:05:02.000Z",
      "valid_until": "2026-04-21T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T15:10:13.938Z",
      "x_nadsec_last_seen": "2026-03-20T15:12:21.616Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-03-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--09b3b58e-80c8-43e3-a9c6-5d0d36ff2237",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.115.186.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:05:02.000Z",
      "valid_until": "2026-04-21T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T15:50:02.975Z",
      "x_nadsec_last_seen": "2026-03-27T20:46:17.591Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=IR; asn=213790; asn_org=Limited Network LTD",
      "id": "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:05:02.000Z",
      "valid_until": "2026-04-21T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T15:16:59.533Z",
      "x_nadsec_last_seen": "2026-03-20T15:17:07.500Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "213790"
      ],
      "x_nadsec_orgs": [
        "Limited Network LTD"
      ]
    },
    {
      "created": "2026-03-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IR; asn=213790; asn_org=Limited Network LTD",
      "id": "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:05:02.000Z",
      "valid_until": "2026-04-21T16:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T15:16:58.948Z",
      "x_nadsec_last_seen": "2026-03-25T07:21:39.450Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "213790"
      ],
      "x_nadsec_orgs": [
        "Limited Network LTD"
      ]
    },
    {
      "created": "2026-03-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=IR; asn=213790; asn_org=Limited Network LTD",
      "id": "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:05:02.000Z",
      "valid_until": "2026-04-21T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T15:16:58.398Z",
      "x_nadsec_last_seen": "2026-03-20T15:16:58.398Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "IR"
      ],
      "x_nadsec_asns": [
        "213790"
      ],
      "x_nadsec_orgs": [
        "Limited Network LTD"
      ]
    },
    {
      "created": "2026-03-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--3379f0d3-1e36-4fcb-843e-12bedab70bbb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.141.121.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:05:02.000Z",
      "valid_until": "2026-04-21T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T16:00:57.319Z",
      "x_nadsec_last_seen": "2026-03-20T16:00:57.319Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--836055fb-a07f-4d63-83fa-3e8d255b3823",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:05:02.000Z",
      "valid_until": "2026-04-21T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T15:17:16.155Z",
      "x_nadsec_last_seen": "2026-03-26T21:32:21.938Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MO; asn=4609; asn_org=Companhia de Telecomunicacoes de Macau SARL",
      "id": "indicator--87efe5c6-4732-4c81-ac88-d175444e88b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.86.174.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:05:02.000Z",
      "valid_until": "2026-04-21T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T15:40:43.294Z",
      "x_nadsec_last_seen": "2026-03-20T15:40:43.377Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MO"
      ],
      "x_nadsec_asns": [
        "4609"
      ],
      "x_nadsec_orgs": [
        "Companhia de Telecomunicacoes de Macau SARL"
      ]
    },
    {
      "created": "2026-03-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5ba16619-00b5-4137-89fa-b06319339c20",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.120.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:05:02.000Z",
      "valid_until": "2026-04-21T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T15:08:16.865Z",
      "x_nadsec_last_seen": "2026-03-30T04:05:50.421Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-20T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6b207d61-854b-4e7e-807f-af435357af2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '9.234.10.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:05:02.000Z",
      "valid_until": "2026-04-21T16:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T15:57:50.181Z",
      "x_nadsec_last_seen": "2026-03-20T15:57:50.891Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-20T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=137365; asn_org=PT DUTA VISUAL NUSANTARA TIVI TUJUH",
      "id": "indicator--389be42f-4bc3-420a-90ef-09430921b11d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.116.200.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T17:05:02.000Z",
      "valid_until": "2026-04-21T17:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T16:44:07.482Z",
      "x_nadsec_last_seen": "2026-03-20T18:02:18.574Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "137365"
      ],
      "x_nadsec_orgs": [
        "PT DUTA VISUAL NUSANTARA TIVI TUJUH"
      ]
    },
    {
      "created": "2026-03-20T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--ee2c3a0e-c36d-416e-af85-dcc715a7fc29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.165.129.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T17:05:02.000Z",
      "valid_until": "2026-04-21T17:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T16:46:11.690Z",
      "x_nadsec_last_seen": "2026-03-20T18:02:19.565Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-03-20T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=271486; asn_org=AP SOLUCOES EM NETWORK E INFORMATICA EIRELI",
      "id": "indicator--58f24a98-902a-4329-a454-530e763d9056",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.224.22.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T17:05:02.000Z",
      "valid_until": "2026-04-21T17:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T16:42:48.856Z",
      "x_nadsec_last_seen": "2026-03-20T16:54:23.653Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "271486"
      ],
      "x_nadsec_orgs": [
        "AP SOLUCOES EM NETWORK E INFORMATICA EIRELI"
      ]
    },
    {
      "created": "2026-03-20T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=2715; asn_org=Fundacao Carlos Chagas Filho de Amparo a Pesquisa",
      "id": "indicator--6935c409-0b00-472b-83a5-5cb0755912a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.156.24.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T17:05:02.000Z",
      "valid_until": "2026-04-21T17:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T16:38:26.144Z",
      "x_nadsec_last_seen": "2026-03-20T16:39:46.622Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "2715"
      ],
      "x_nadsec_orgs": [
        "Fundacao Carlos Chagas Filho de Amparo a Pesquisa"
      ]
    },
    {
      "created": "2026-03-20T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--a4bd9572-0ceb-47cf-9aa5-495009525146",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.95.74.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T17:05:02.000Z",
      "valid_until": "2026-04-21T17:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T16:41:28.491Z",
      "x_nadsec_last_seen": "2026-03-20T16:43:33.292Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-20T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=SA; asn=35819; asn_org=Etihad Etisalat, a joint stock company",
      "id": "indicator--d34bd504-f6dc-432a-9f4e-851b440814f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.82.84.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T17:05:02.000Z",
      "valid_until": "2026-04-21T17:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T16:59:46.073Z",
      "x_nadsec_last_seen": "2026-03-20T17:07:43.500Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "35819"
      ],
      "x_nadsec_orgs": [
        "Etihad Etisalat, a joint stock company"
      ]
    },
    {
      "created": "2026-03-20T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--add26371-178d-4f79-9275-617082baaa37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T17:05:02.000Z",
      "valid_until": "2026-04-21T17:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T16:35:18.873Z",
      "x_nadsec_last_seen": "2026-03-22T02:30:46.415Z",
      "x_nadsec_ports": [
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-20T17:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--111fbc77-6388-4bec-bbf9-9f8f6e713f40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T17:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.79.7.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T17:05:02.000Z",
      "valid_until": "2026-04-21T17:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T16:21:58.491Z",
      "x_nadsec_last_seen": "2026-03-20T16:30:03.438Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-03-20T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--58187403-a370-4c16-924f-5088f8d7dfde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.141.137.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T18:05:05.000Z",
      "valid_until": "2026-04-21T18:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-20T17:36:34.661Z",
      "x_nadsec_last_seen": "2026-03-20T17:52:52.321Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-20T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a7578eff-b769-48a0-9480-e1f2f1a5e2ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T18:05:05.000Z",
      "valid_until": "2026-04-21T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T17:46:12.866Z",
      "x_nadsec_last_seen": "2026-03-20T17:46:12.866Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-20T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=15924; asn_org=Vodafone Net Iletisim Hizmetler AS",
      "id": "indicator--69023526-e231-4f9a-baac-63fad093b612",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.145.114.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T18:05:05.000Z",
      "valid_until": "2026-04-21T18:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T17:55:58.340Z",
      "x_nadsec_last_seen": "2026-03-20T18:03:14.458Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "15924"
      ],
      "x_nadsec_orgs": [
        "Vodafone Net Iletisim Hizmetler AS"
      ]
    },
    {
      "created": "2026-03-20T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a4f545ad-f1fc-41f4-8308-f9ab7277aa25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.163.196.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T18:05:05.000Z",
      "valid_until": "2026-04-21T18:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-20T17:29:06.220Z",
      "x_nadsec_last_seen": "2026-03-28T14:32:40.438Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-20T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--9e6dc2ad-21f2-4845-a148-d9c57ac4e871",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.207.7.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T18:05:05.000Z",
      "valid_until": "2026-04-21T18:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T17:16:23.585Z",
      "x_nadsec_last_seen": "2026-03-20T17:22:44.681Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-20T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=36992; asn_org=Etisalat Misr",
      "id": "indicator--ba290b14-f9ae-4fc8-a1c1-5f1667f8a495",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '84.36.84.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T18:05:05.000Z",
      "valid_until": "2026-04-21T18:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T17:49:47.253Z",
      "x_nadsec_last_seen": "2026-03-20T17:49:55.188Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ]
    },
    {
      "created": "2026-03-20T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=41465; asn_org=Limited Liability Company VolgoGazTelecom",
      "id": "indicator--d13c17cf-33d3-4434-86d3-276cac1c36d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.19.193.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T18:05:05.000Z",
      "valid_until": "2026-04-21T18:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T18:02:59.090Z",
      "x_nadsec_last_seen": "2026-03-20T18:04:17.381Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "41465"
      ],
      "x_nadsec_orgs": [
        "Limited Liability Company VolgoGazTelecom"
      ]
    },
    {
      "created": "2026-03-20T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--cb3e5c57-5376-47bc-95ae-8ec1b2e9360b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.79.7.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T18:05:05.000Z",
      "valid_until": "2026-04-21T18:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T17:52:09.935Z",
      "x_nadsec_last_seen": "2026-03-20T18:02:42.145Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-03-20T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--2eacbe48-7679-4004-8c07-9a9cc5cd3903",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.2.184.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:05:02.000Z",
      "valid_until": "2026-04-21T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T18:55:12.191Z",
      "x_nadsec_last_seen": "2026-03-20T18:57:17.716Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-20T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--5cd40293-4795-4828-84c0-08dc6ca01e78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.204.70.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:05:02.000Z",
      "valid_until": "2026-04-21T19:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T18:09:23.948Z",
      "x_nadsec_last_seen": "2026-03-20T18:19:28.849Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-20T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--6e163ad9-dfd2-489c-92fd-5a6ff0550a90",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.195.242.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:05:02.000Z",
      "valid_until": "2026-04-21T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T18:12:39.031Z",
      "x_nadsec_last_seen": "2026-03-20T18:14:47.227Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-20T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1f3d9f59-5bc5-40e8-8258-cacd3e89da5c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.106.56.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:05:02.000Z",
      "valid_until": "2026-04-21T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T18:06:22.032Z",
      "x_nadsec_last_seen": "2026-03-20T18:06:32.207Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-20T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7aa70d56-3546-420e-b2c6-fa89c2dfe127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.171.8.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:05:02.000Z",
      "valid_until": "2026-04-21T19:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T18:33:42.679Z",
      "x_nadsec_last_seen": "2026-03-21T09:19:12.787Z",
      "x_nadsec_ports": [
        "21",
        "81"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-20T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--53f1a4f6-5e54-43e7-8f28-fe0a9f4b8a48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.14.120.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:05:02.000Z",
      "valid_until": "2026-04-21T19:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T18:59:42.557Z",
      "x_nadsec_last_seen": "2026-03-20T19:06:21.500Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-03-20T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=32811; cc=GB; asn=396982; asn_org=Google LLC",
      "id": "indicator--07bdd816-23a6-4333-9dd0-3c0706108cda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.203.211.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:05:02.000Z",
      "valid_until": "2026-04-21T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T18:29:33.271Z",
      "x_nadsec_last_seen": "2026-03-20T18:29:33.275Z",
      "x_nadsec_ports": [
        "42",
        "32811"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-20T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=16637; asn_org=MTN Business Solutions",
      "id": "indicator--5eebbaf9-731d-4248-80e2-e7770cf27c2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.8.6.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:05:02.000Z",
      "valid_until": "2026-04-21T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T18:08:45.009Z",
      "x_nadsec_last_seen": "2026-03-20T18:11:01.145Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "16637"
      ],
      "x_nadsec_orgs": [
        "MTN Business Solutions"
      ]
    },
    {
      "created": "2026-03-20T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2f0c4569-32dd-4e90-b293-4c695f41c38b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:05:02.000Z",
      "valid_until": "2026-04-21T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T18:07:18.720Z",
      "x_nadsec_last_seen": "2026-03-20T18:07:18.720Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-20T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5ff5af9a-143c-45a0-81c9-858b85bd6fdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:05:02.000Z",
      "valid_until": "2026-04-21T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T18:07:19.262Z",
      "x_nadsec_last_seen": "2026-03-20T18:07:19.262Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-20T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e915d137-5f1d-4077-bc84-9a85e4a5d185",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.41.87.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:05:03.000Z",
      "valid_until": "2026-04-21T20:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T19:57:11.231Z",
      "x_nadsec_last_seen": "2026-03-20T20:03:18.691Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-20T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--791e714e-eb8a-4df4-9267-890922c11ad1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.104.51.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:05:03.000Z",
      "valid_until": "2026-04-21T20:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T19:06:28.640Z",
      "x_nadsec_last_seen": "2026-03-20T19:07:08.333Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-20T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4dd252d9-9881-4ec0-af5f-89051bf7a8ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.134.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:05:03.000Z",
      "valid_until": "2026-04-21T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T19:27:39.024Z",
      "x_nadsec_last_seen": "2026-03-20T19:27:39.024Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-20T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=265066; asn_org=Conect Provedor de Acesso a Internet Ltda Me",
      "id": "indicator--c41c80b8-3047-4f71-af7c-70aa12964791",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '168.121.201.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:05:03.000Z",
      "valid_until": "2026-04-21T20:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T19:18:35.288Z",
      "x_nadsec_last_seen": "2026-03-20T19:25:39.929Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "265066"
      ],
      "x_nadsec_orgs": [
        "Conect Provedor de Acesso a Internet Ltda Me"
      ]
    },
    {
      "created": "2026-03-20T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=265525; asn_org=TV CABLE DEL GUADIANA S.A DE C.V.",
      "id": "indicator--e6ac6255-c853-4fc2-ad91-9547101399ae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.80.241.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:05:03.000Z",
      "valid_until": "2026-04-21T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T19:35:00.474Z",
      "x_nadsec_last_seen": "2026-03-20T19:38:40.629Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "265525"
      ],
      "x_nadsec_orgs": [
        "TV CABLE DEL GUADIANA S.A DE C.V."
      ]
    },
    {
      "created": "2026-03-20T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--c2bc506d-5df2-45da-93fe-6f90149b380e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.47.236.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:05:03.000Z",
      "valid_until": "2026-04-21T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T19:08:41.393Z",
      "x_nadsec_last_seen": "2026-03-20T19:10:47.726Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-20T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7e097f91-2e79-45f4-a676-889a8d735450",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:05:03.000Z",
      "valid_until": "2026-04-21T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T19:15:59.053Z",
      "x_nadsec_last_seen": "2026-03-20T19:15:59.053Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-20T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--413d48df-bc90-4792-b49d-b5be73fcb447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:05:03.000Z",
      "valid_until": "2026-04-21T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T19:25:53.090Z",
      "x_nadsec_last_seen": "2026-03-20T19:25:53.090Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-20T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AZ; asn=8814; asn_org=Aztelekom LLC",
      "id": "indicator--d3f5a9e8-16e3-403e-b603-bfe707f67634",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.69.55.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T20:05:03.000Z",
      "valid_until": "2026-04-21T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T19:40:17.607Z",
      "x_nadsec_last_seen": "2026-03-20T19:40:17.733Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "8814"
      ],
      "x_nadsec_orgs": [
        "Aztelekom LLC"
      ]
    },
    {
      "created": "2026-03-20T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=63737; asn_org=VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED; user(top)=**",
      "id": "indicator--18b20513-66bf-4f88-84f0-782cc9fc1a6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.10.48.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:05:03.000Z",
      "valid_until": "2026-04-21T21:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T20:59:22.957Z",
      "x_nadsec_last_seen": "2026-03-21T20:17:08.033Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "63737"
      ],
      "x_nadsec_orgs": [
        "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-20T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2281; services=smbd; ports=445; cc=BR; asn=52698; asn_org=OPENTEL Comercio e Servicos Ltda",
      "id": "indicator--8bc087fc-c72b-4bc0-8d62-252decc42bdf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.73.68.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:05:03.000Z",
      "valid_until": "2026-04-21T21:05:00.000Z",
      "x_nadsec_event_count": 2282,
      "x_nadsec_first_seen": "2026-03-20T20:19:20.341Z",
      "x_nadsec_last_seen": "2026-03-20T21:04:17.442Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "52698"
      ],
      "x_nadsec_orgs": [
        "OPENTEL Comercio e Servicos Ltda"
      ]
    },
    {
      "created": "2026-03-20T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--145b541b-4da9-47a9-ad78-bc0e3d43480e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.202.8.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:05:03.000Z",
      "valid_until": "2026-04-21T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T20:48:38.386Z",
      "x_nadsec_last_seen": "2026-03-20T20:50:45.022Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-20T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--0851f372-8846-460a-9057-68f6eb28e6ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.203.180.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:05:03.000Z",
      "valid_until": "2026-04-21T21:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T20:12:46.909Z",
      "x_nadsec_last_seen": "2026-03-20T20:12:46.909Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-03-20T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CR; asn=52263; asn_org=Telecable Economico S.A.",
      "id": "indicator--8a05e51e-6d61-4322-b1d2-2b41392cd96a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.229.8.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:05:03.000Z",
      "valid_until": "2026-04-21T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T20:41:55.585Z",
      "x_nadsec_last_seen": "2026-03-22T17:18:15.912Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CR"
      ],
      "x_nadsec_asns": [
        "52263"
      ],
      "x_nadsec_orgs": [
        "Telecable Economico S.A."
      ]
    },
    {
      "created": "2026-03-20T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=14178; asn_org=Megacable Comunicaciones de Mexico, S.A. de C.V.",
      "id": "indicator--cbd5f3dc-6cea-42b5-8162-b8278ed70850",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.149.31.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:05:03.000Z",
      "valid_until": "2026-04-21T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T20:50:39.324Z",
      "x_nadsec_last_seen": "2026-03-20T20:52:50.320Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "14178"
      ],
      "x_nadsec_orgs": [
        "Megacable Comunicaciones de Mexico, S.A. de C.V."
      ]
    },
    {
      "created": "2026-03-20T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--0658d5ce-eae6-4c43-b482-50e966f571ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.237.117.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:05:03.000Z",
      "valid_until": "2026-04-21T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T20:46:25.656Z",
      "x_nadsec_last_seen": "2026-03-20T20:48:32.593Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-20T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GR; asn=6799; asn_org=OTEnet S.A.",
      "id": "indicator--24a6390c-5162-477a-9f91-e66182b2d6a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.106.194.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:05:03.000Z",
      "valid_until": "2026-04-21T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T20:09:20.628Z",
      "x_nadsec_last_seen": "2026-03-20T20:11:27.285Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GR"
      ],
      "x_nadsec_asns": [
        "6799"
      ],
      "x_nadsec_orgs": [
        "OTEnet S.A."
      ]
    },
    {
      "created": "2026-03-20T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--c1e3a8f7-5f48-4f68-9fcb-3b139e65e5bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:05:03.000Z",
      "valid_until": "2026-04-21T21:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T20:44:41.990Z",
      "x_nadsec_last_seen": "2026-03-21T00:04:12.338Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-20T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--a7bd9725-e481-43b1-ab3d-db6e21486ac1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:05:03.000Z",
      "valid_until": "2026-04-21T21:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T20:44:41.311Z",
      "x_nadsec_last_seen": "2026-03-20T20:44:41.311Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-20T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b116bedb-421e-4358-a00f-6ec37f44844a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.248.232.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:05:05.000Z",
      "valid_until": "2026-04-21T22:05:03.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-03-20T21:43:59.961Z",
      "x_nadsec_last_seen": "2026-03-20T21:46:48.766Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-20T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CR; asn=28317; asn_org=NAVEGALO S.A.",
      "id": "indicator--d5171751-2d2f-49dc-8586-673f7597c0f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.121.141.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:05:05.000Z",
      "valid_until": "2026-04-21T22:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T21:45:19.777Z",
      "x_nadsec_last_seen": "2026-03-20T21:47:25.373Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CR"
      ],
      "x_nadsec_asns": [
        "28317"
      ],
      "x_nadsec_orgs": [
        "NAVEGALO S.A."
      ]
    },
    {
      "created": "2026-03-20T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5e7589bb-d1ec-4e7b-bc42-ab34bc3fa405",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.245.184.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:05:05.000Z",
      "valid_until": "2026-04-21T22:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T21:47:03.486Z",
      "x_nadsec_last_seen": "2026-03-20T21:49:08.179Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-20T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bf9bb0f3-8531-4c23-9627-9f4b0edc829c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.224.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:05:05.000Z",
      "valid_until": "2026-04-21T22:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T21:46:51.976Z",
      "x_nadsec_last_seen": "2026-03-21T05:32:05.861Z",
      "x_nadsec_ports": [
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-20T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=HK; asn=138195; asn_org=MOACK.Co.LTD",
      "id": "indicator--cb05e5fa-16b2-42c9-956f-e1b9b87e2ee4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.53.137.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:05:05.000Z",
      "valid_until": "2026-04-21T22:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T21:59:55.451Z",
      "x_nadsec_last_seen": "2026-03-20T22:02:00.392Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "138195"
      ],
      "x_nadsec_orgs": [
        "MOACK.Co.LTD"
      ]
    },
    {
      "created": "2026-03-20T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KR; asn=3786; asn_org=LG DACOM Corporation",
      "id": "indicator--f283819b-4218-43ea-b25a-ee3cf21ea3a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.120.62.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:05:05.000Z",
      "valid_until": "2026-04-21T22:05:03.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T21:58:34.307Z",
      "x_nadsec_last_seen": "2026-03-20T22:02:39.951Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "3786"
      ],
      "x_nadsec_orgs": [
        "LG DACOM Corporation"
      ]
    },
    {
      "created": "2026-03-20T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--57af062d-57ae-4612-a9af-588bd4f25dcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.235.122.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:05:05.000Z",
      "valid_until": "2026-04-21T22:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T21:42:38.017Z",
      "x_nadsec_last_seen": "2026-03-20T21:42:38.017Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-20T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8402; asn_org=PVimpelCom",
      "id": "indicator--d6f86214-7923-4642-8e2c-a560f4e90cb9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.24.74.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:05:05.000Z",
      "valid_until": "2026-04-21T22:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T21:18:41.162Z",
      "x_nadsec_last_seen": "2026-03-20T21:20:48.734Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8402"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-03-20T22:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--b6208cc0-e3e2-4cf8-8408-be9fe67170fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T22:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.9.45.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:05:05.000Z",
      "valid_until": "2026-04-21T22:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T21:24:05.401Z",
      "x_nadsec_last_seen": "2026-03-20T21:26:12.112Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-20T23:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--c84aee27-4b2f-4850-9e8e-acbea4f54f43",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T23:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.0.3.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T23:05:06.000Z",
      "valid_until": "2026-04-21T23:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T22:34:23.844Z",
      "x_nadsec_last_seen": "2026-03-20T22:36:37.634Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-20T23:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--42f96bcc-7e87-422c-9c7c-06bb10d3b3a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T23:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.203.204.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T23:05:06.000Z",
      "valid_until": "2026-04-21T23:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T22:54:04.643Z",
      "x_nadsec_last_seen": "2026-03-20T22:54:04.988Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-20T23:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=VN; asn=45899; asn_org=VNPT Corp; user(top)=**",
      "id": "indicator--f57d1641-f1aa-47e6-98d8-166b2a1ec6f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T23:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.84.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T23:05:06.000Z",
      "valid_until": "2026-04-21T23:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T23:03:14.897Z",
      "x_nadsec_last_seen": "2026-03-20T23:03:14.897Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-20T23:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=134365; asn_org=Ansheng Network Technology Co., Limited",
      "id": "indicator--0022e6ee-e565-4a79-add6-23e76f6e42c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T23:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.194.251.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T23:05:06.000Z",
      "valid_until": "2026-04-21T23:05:00.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-20T22:29:06.090Z",
      "x_nadsec_last_seen": "2026-03-29T01:03:14.003Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "134365"
      ],
      "x_nadsec_orgs": [
        "Ansheng Network Technology Co., Limited"
      ]
    },
    {
      "created": "2026-03-20T23:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--20878be8-78e9-4a2a-b258-45d3319d36bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T23:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.202.117.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T23:05:06.000Z",
      "valid_until": "2026-04-21T23:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T22:43:12.477Z",
      "x_nadsec_last_seen": "2026-03-20T22:43:12.477Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-20T23:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262729; asn_org=Telemidia Sistema de Telecomunicacao Ltda",
      "id": "indicator--187e6dc2-fa3c-4957-b37a-70888ed774c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T23:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.193.157.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T23:05:06.000Z",
      "valid_until": "2026-04-21T23:05:00.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-20T22:24:32.636Z",
      "x_nadsec_last_seen": "2026-03-27T19:15:21.979Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262729"
      ],
      "x_nadsec_orgs": [
        "Telemidia Sistema de Telecomunicacao Ltda"
      ]
    },
    {
      "created": "2026-03-20T23:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--828737c0-83f3-4b3c-add4-027169ef55f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T23:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.156.66.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T23:05:06.000Z",
      "valid_until": "2026-04-21T23:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T22:11:39.980Z",
      "x_nadsec_last_seen": "2026-03-20T22:13:46.765Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-20T23:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ed4be67b-5aa4-4190-a299-347b419740a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T23:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T23:05:06.000Z",
      "valid_until": "2026-04-21T23:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T22:23:10.328Z",
      "x_nadsec_last_seen": "2026-03-20T22:23:10.328Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-20T23:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--94a17d3a-e1f1-48ae-9b9b-ccd3a781a501",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T23:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T23:05:06.000Z",
      "valid_until": "2026-04-21T23:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T22:40:46.178Z",
      "x_nadsec_last_seen": "2026-03-21T15:25:40.666Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-20T23:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=21299; asn_org=Kar-Tel LLC",
      "id": "indicator--cccaaa2b-77d4-4b42-a62d-08d2925e601a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-20T23:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '67.209.139.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T23:05:06.000Z",
      "valid_until": "2026-04-21T23:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T22:09:01.506Z",
      "x_nadsec_last_seen": "2026-03-20T22:11:08.688Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "21299"
      ],
      "x_nadsec_orgs": [
        "Kar-Tel LLC"
      ]
    },
    {
      "created": "2026-03-21T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=20057; asn_org=AT&T Enterprises, LLC",
      "id": "indicator--d3ef6778-5674-4368-9965-3f9d32149a81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '107.84.233.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:05:03.000Z",
      "valid_until": "2026-04-22T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T00:02:42.365Z",
      "x_nadsec_last_seen": "2026-03-21T00:10:05.747Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "20057"
      ],
      "x_nadsec_orgs": [
        "AT&T Enterprises, LLC"
      ]
    },
    {
      "created": "2026-03-21T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--58190f8f-1f6c-428a-aacd-9c32a24ef51b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.160.198.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:05:03.000Z",
      "valid_until": "2026-04-22T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T23:11:26.481Z",
      "x_nadsec_last_seen": "2026-03-20T23:13:31.240Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-21T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--e00c70a8-ebc1-40c3-b1e4-e98ffee72f22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.243.59.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:05:03.000Z",
      "valid_until": "2026-04-22T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-20T23:19:36.648Z",
      "x_nadsec_last_seen": "2026-03-20T23:26:04.343Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-21T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=MA; asn=36903; asn_org=MT-MPLS; user(top)=**",
      "id": "indicator--5aff98ff-04f8-4107-913d-1b6384a1330c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.74.107.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:05:03.000Z",
      "valid_until": "2026-04-22T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T23:34:51.528Z",
      "x_nadsec_last_seen": "2026-03-20T23:34:52.773Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-21T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--56c9e47b-4704-4c5f-aae8-f2f441bcf74a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:05:03.000Z",
      "valid_until": "2026-04-22T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T23:54:52.796Z",
      "x_nadsec_last_seen": "2026-03-20T23:54:52.796Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-21T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=202254; asn_org=Lifecell Digital Ltd; user(top)=**",
      "id": "indicator--0fe19022-8a21-4162-b980-9ded0d33b49d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.108.130.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:05:03.000Z",
      "valid_until": "2026-04-22T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-20T23:36:32.222Z",
      "x_nadsec_last_seen": "2026-03-28T18:16:20.580Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "202254"
      ],
      "x_nadsec_orgs": [
        "Lifecell Digital Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-21T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--43a23d69-8701-47d4-8d86-8afaea18b436",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:05:03.000Z",
      "valid_until": "2026-04-22T00:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-20T23:52:44.964Z",
      "x_nadsec_last_seen": "2026-03-25T22:29:08.584Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-21T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IL; asn=12400; asn_org=Partner Communications Ltd.",
      "id": "indicator--c2631f01-843c-401a-a981-18dea6d07732",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.179.153.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:05:03.000Z",
      "valid_until": "2026-04-22T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-20T23:31:13.208Z",
      "x_nadsec_last_seen": "2026-03-20T23:33:20.694Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "12400"
      ],
      "x_nadsec_orgs": [
        "Partner Communications Ltd."
      ]
    },
    {
      "created": "2026-03-21T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--35954e15-acd4-47c0-a8fd-2ec86b1193e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:05:03.000Z",
      "valid_until": "2026-04-22T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T00:04:36.635Z",
      "x_nadsec_last_seen": "2026-03-21T00:04:36.635Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-21T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b2c288a5-3948-489c-a234-1a86eeb17e48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:05:03.000Z",
      "valid_until": "2026-04-22T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T00:04:46.973Z",
      "x_nadsec_last_seen": "2026-03-21T00:04:46.973Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-21T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--ce6d399a-1cbb-4ad6-bc7e-cee7b5ced971",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:05:03.000Z",
      "valid_until": "2026-04-22T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T23:46:19.865Z",
      "x_nadsec_last_seen": "2026-03-20T23:46:19.865Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-21T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--1b096290-cd30-4bf5-982b-5f61b05af088",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:05:03.000Z",
      "valid_until": "2026-04-22T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-20T23:46:20.205Z",
      "x_nadsec_last_seen": "2026-03-20T23:46:20.205Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=135848; asn_org=Digitax India Communications Pvt Ltd.",
      "id": "indicator--9c860a57-7fe0-4f1c-9ce5-b71bcec4f913",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.54.100.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:05:03.000Z",
      "valid_until": "2026-04-22T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T00:07:55.985Z",
      "x_nadsec_last_seen": "2026-03-21T00:07:56.411Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135848"
      ],
      "x_nadsec_orgs": [
        "Digitax India Communications Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--3ec9416d-ab49-4fda-9a9c-799a3dd3a940",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.25.52.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:05:03.000Z",
      "valid_until": "2026-04-22T01:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T00:19:48.787Z",
      "x_nadsec_last_seen": "2026-03-21T00:26:21.421Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--9017e891-e291-4a9a-80c9-6c0622c9d899",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:05:03.000Z",
      "valid_until": "2026-04-22T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T00:11:06.115Z",
      "x_nadsec_last_seen": "2026-03-21T00:11:36.116Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=30; services=mongod; ports=27017; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--d961ad73-3e44-430c-9477-97f83ee8a4f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:05:03.000Z",
      "valid_until": "2026-04-22T01:05:01.000Z",
      "x_nadsec_event_count": 71,
      "x_nadsec_first_seen": "2026-03-21T01:00:28.546Z",
      "x_nadsec_last_seen": "2026-03-21T18:17:00.872Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5af52d50-f091-4491-aa16-f1c2598114c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.118.216.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:05:03.000Z",
      "valid_until": "2026-04-22T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T00:21:24.354Z",
      "x_nadsec_last_seen": "2026-03-21T00:21:34.531Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23974; asn_org=Ministry of education",
      "id": "indicator--0fc7ce3e-53c3-410d-bfd3-26e524ad9978",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.172.218.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:05:03.000Z",
      "valid_until": "2026-04-22T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T00:47:49.166Z",
      "x_nadsec_last_seen": "2026-03-21T00:49:53.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23974"
      ],
      "x_nadsec_orgs": [
        "Ministry of education"
      ]
    },
    {
      "created": "2026-03-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--36d64754-476b-4f6e-b2fc-8f792dadc109",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.23.231.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:05:03.000Z",
      "valid_until": "2026-04-22T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T00:51:39.764Z",
      "x_nadsec_last_seen": "2026-03-21T00:51:39.764Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--374fef9c-9004-4a6c-ba14-649b1a9a98a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.248.219.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:05:03.000Z",
      "valid_until": "2026-04-22T01:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-21T01:00:53.208Z",
      "x_nadsec_last_seen": "2026-03-23T18:29:50.453Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--fa3f2e63-6c7d-45a9-986a-985940e1eb2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.223.66.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:05:03.000Z",
      "valid_until": "2026-04-22T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T00:53:25.576Z",
      "x_nadsec_last_seen": "2026-03-21T00:55:30.287Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-21T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--b26dfec4-95d7-4455-a68a-126196e0a000",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.126.74.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:05:03.000Z",
      "valid_until": "2026-04-22T01:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T01:04:52.537Z",
      "x_nadsec_last_seen": "2026-03-21T01:13:43.773Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-21T02:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--fd5d9742-6cdc-44b8-8bec-27a53a9828fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.123.250.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:05:04.000Z",
      "valid_until": "2026-04-22T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T01:53:23.024Z",
      "x_nadsec_last_seen": "2026-03-29T02:02:25.287Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-03-21T02:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--c00cacde-7369-4eb8-80c4-1aca3ffd16c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.187.50.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:05:04.000Z",
      "valid_until": "2026-04-22T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T01:13:57.839Z",
      "x_nadsec_last_seen": "2026-03-21T01:16:02.866Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-21T02:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--b7a8ffde-aea3-44aa-8d21-2de8a9b2c887",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.196.84.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:05:04.000Z",
      "valid_until": "2026-04-22T02:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-21T01:48:02.136Z",
      "x_nadsec_last_seen": "2026-03-26T01:48:58.670Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-03-21T02:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=14868; asn_org=Ligga Telecomunicacoes S.A.",
      "id": "indicator--76fb6e5d-6db7-49fc-a0a0-142a012452f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.150.78.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:05:04.000Z",
      "valid_until": "2026-04-22T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T01:57:16.880Z",
      "x_nadsec_last_seen": "2026-03-21T01:59:23.416Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "14868"
      ],
      "x_nadsec_orgs": [
        "Ligga Telecomunicacoes S.A."
      ]
    },
    {
      "created": "2026-03-21T02:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--a2537d33-5997-4c97-a37c-6d3591dd0630",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:05:04.000Z",
      "valid_until": "2026-04-22T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T01:27:01.799Z",
      "x_nadsec_last_seen": "2026-03-21T01:27:01.799Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-21T02:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3ed08db9-7404-4d0e-a375-e119159182b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:05:04.000Z",
      "valid_until": "2026-04-22T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T01:44:13.805Z",
      "x_nadsec_last_seen": "2026-03-21T01:44:13.805Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-21T02:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6efdcd75-78ac-46dd-af89-c2b7b9c905a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T02:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:05:04.000Z",
      "valid_until": "2026-04-22T02:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T01:30:43.927Z",
      "x_nadsec_last_seen": "2026-03-27T07:36:52.022Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--675cdc61-ed5c-48ca-b2c1-54870eeb9dd9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.10.216.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:05:03.000Z",
      "valid_until": "2026-04-22T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T02:11:42.399Z",
      "x_nadsec_last_seen": "2026-03-21T02:13:47.230Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=151734; asn_org=WEBYNE DATA CENTRE PRIVATE LIMITED; user(top)=**",
      "id": "indicator--81e6c608-c640-4889-9b5b-971c1f84efee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.99.36.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:05:03.000Z",
      "valid_until": "2026-04-22T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T02:26:53.218Z",
      "x_nadsec_last_seen": "2026-03-21T02:26:53.218Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "151734"
      ],
      "x_nadsec_orgs": [
        "WEBYNE DATA CENTRE PRIVATE LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PK; asn=38264; asn_org=National WiMAXIMS environment",
      "id": "indicator--069d55f9-6e06-4cbf-9a79-4fbc3e506f00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.39.146.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:05:03.000Z",
      "valid_until": "2026-04-22T03:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-21T02:58:24.911Z",
      "x_nadsec_last_seen": "2026-03-21T03:02:52.724Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "38264"
      ],
      "x_nadsec_orgs": [
        "National WiMAXIMS environment"
      ]
    },
    {
      "created": "2026-03-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--b691384d-d5f0-4a12-bc9f-c2ecd320f104",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.25.52.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:05:03.000Z",
      "valid_until": "2026-04-22T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T02:33:07.049Z",
      "x_nadsec_last_seen": "2026-03-21T02:39:39.628Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=15895; asn_org=Kyivstar PJSC",
      "id": "indicator--d8745463-e457-4163-ba71-32a59c41181a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.163.177.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:05:03.000Z",
      "valid_until": "2026-04-22T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T02:17:30.603Z",
      "x_nadsec_last_seen": "2026-03-21T02:19:37.233Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "15895"
      ],
      "x_nadsec_orgs": [
        "Kyivstar PJSC"
      ]
    },
    {
      "created": "2026-03-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--372863f6-8781-45c1-9163-64032e9c06d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.105.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:05:03.000Z",
      "valid_until": "2026-04-22T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T02:12:45.913Z",
      "x_nadsec_last_seen": "2026-03-21T02:12:46.203Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fc9aaf2e-3a49-4e39-a37c-2015917f6627",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:05:03.000Z",
      "valid_until": "2026-04-22T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T02:55:17.060Z",
      "x_nadsec_last_seen": "2026-03-21T02:55:17.060Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-21T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bcc091c3-abea-425f-99b7-ed9dda4e8a81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:05:03.000Z",
      "valid_until": "2026-04-22T03:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-21T02:30:52.499Z",
      "x_nadsec_last_seen": "2026-03-29T23:35:05.430Z",
      "x_nadsec_ports": [
        "81",
        "135"
      ],
      "x_nadsec_services": [
        "httpd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-21T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--513f9437-af24-44a7-a944-a41905ef9bff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.162.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:05:03.000Z",
      "valid_until": "2026-04-22T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T03:41:07.027Z",
      "x_nadsec_last_seen": "2026-03-21T03:43:11.752Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-21T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NP; asn=24550; asn_org=Websurfer Nepal Internet Service Provider",
      "id": "indicator--dda73ac3-543f-468f-976e-26b36ad5ac2f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.90.230.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:05:03.000Z",
      "valid_until": "2026-04-22T04:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-13T01:17:04.924Z",
      "x_nadsec_last_seen": "2026-03-21T04:03:19.640Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "24550"
      ],
      "x_nadsec_orgs": [
        "Websurfer Nepal Internet Service Provider"
      ]
    },
    {
      "created": "2026-03-21T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mqttd; ports=1883; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4c6cdbc8-a164-4dcf-a731-377acf8050e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.206.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:05:03.000Z",
      "valid_until": "2026-04-22T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T03:19:57.094Z",
      "x_nadsec_last_seen": "2026-03-21T03:20:26.455Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-21T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--49fc3109-0d70-4008-a8cc-9fdb57d86cba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.17.49.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:05:03.000Z",
      "valid_until": "2026-04-22T04:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-21T03:17:31.437Z",
      "x_nadsec_last_seen": "2026-03-30T22:25:24.950Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-03-21T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--5721b29f-ef1a-42cb-9193-7c1ac0bd23bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.32.207.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:05:03.000Z",
      "valid_until": "2026-04-22T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T03:23:30.861Z",
      "x_nadsec_last_seen": "2026-03-21T03:25:37.630Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-21T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--b893af61-73ff-4657-b74d-c8205a2d167e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.241.166.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:05:03.000Z",
      "valid_until": "2026-04-22T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T03:43:35.907Z",
      "x_nadsec_last_seen": "2026-03-22T11:05:23.198Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-21T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1de4305a-38f4-48a4-af7e-7b41dd16ffe4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:05:03.000Z",
      "valid_until": "2026-04-22T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T03:18:19.268Z",
      "x_nadsec_last_seen": "2026-03-21T03:18:19.268Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-21T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--c3d8d1ce-a0c0-460f-a17d-9cfc952f0517",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.64.188.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T04:05:03.000Z",
      "valid_until": "2026-04-22T04:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-21T03:37:20.123Z",
      "x_nadsec_last_seen": "2026-03-22T02:52:36.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-03-21T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ca47286d-ff4e-40d3-a7b3-65c8197d9e99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.191.78.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T05:05:03.000Z",
      "valid_until": "2026-04-22T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T04:50:49.146Z",
      "x_nadsec_last_seen": "2026-03-21T04:57:14.011Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-21T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--75705452-f167-4299-980e-f7907bf85953",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.223.188.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T05:05:03.000Z",
      "valid_until": "2026-04-22T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T05:04:31.887Z",
      "x_nadsec_last_seen": "2026-03-21T05:04:31.887Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-21T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c6ff102c-8a2a-4cfc-85c2-0aaaef68cd30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T05:05:03.000Z",
      "valid_until": "2026-04-22T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T04:32:33.036Z",
      "x_nadsec_last_seen": "2026-03-21T04:32:33.036Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-21T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1b9e17a3-df54-4a27-8745-731349645ad9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.81.13.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T05:05:03.000Z",
      "valid_until": "2026-04-22T05:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-21T05:04:38.762Z",
      "x_nadsec_last_seen": "2026-03-21T07:47:22.740Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-21T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--de1d2942-72ed-47d7-981c-6aab37a13614",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.252.194.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T05:05:03.000Z",
      "valid_until": "2026-04-22T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T04:45:53.371Z",
      "x_nadsec_last_seen": "2026-03-21T04:47:58.227Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-21T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ab8eb317-13f7-481a-8e8e-6e8cb98811ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T05:05:03.000Z",
      "valid_until": "2026-04-22T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T04:34:01.516Z",
      "x_nadsec_last_seen": "2026-03-24T23:28:28.516Z",
      "x_nadsec_ports": [
        "1723",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-21T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8492; asn_org=OBIT Ltd.",
      "id": "indicator--37a9df55-5e14-4c16-8a6e-f538dd931289",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.134.194.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T05:05:03.000Z",
      "valid_until": "2026-04-22T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T04:43:15.111Z",
      "x_nadsec_last_seen": "2026-03-21T04:45:21.760Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8492"
      ],
      "x_nadsec_orgs": [
        "OBIT Ltd."
      ]
    },
    {
      "created": "2026-03-21T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=25490; asn_org=Rostelecom",
      "id": "indicator--0c8314f3-3fac-4bfb-aa36-3ef5431cc985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.239.29.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T05:05:03.000Z",
      "valid_until": "2026-04-22T05:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-21T04:41:21.631Z",
      "x_nadsec_last_seen": "2026-03-21T04:42:46.364Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25490"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-21T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--b49755f3-a6dd-44b7-bb20-fb4d3b2940d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.80.4.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T05:05:03.000Z",
      "valid_until": "2026-04-22T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T04:24:17.316Z",
      "x_nadsec_last_seen": "2026-03-21T04:24:17.316Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-21T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--ebfa5bd8-c82a-47b8-a69f-4e637e296b33",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.211.32.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T06:05:03.000Z",
      "valid_until": "2026-04-22T06:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T05:14:21.139Z",
      "x_nadsec_last_seen": "2026-03-21T05:14:21.139Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-03-21T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--12c20578-a011-4206-8ecb-e6e3c84f597a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.218.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T06:05:03.000Z",
      "valid_until": "2026-04-22T06:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T05:31:53.722Z",
      "x_nadsec_last_seen": "2026-03-21T05:32:04.969Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-21T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8359; asn_org=MTS PJSC",
      "id": "indicator--621d12ce-2b89-44db-a011-b35305010428",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.248.72.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T06:05:03.000Z",
      "valid_until": "2026-04-22T06:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T05:08:11.254Z",
      "x_nadsec_last_seen": "2026-03-21T05:10:18.115Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8359"
      ],
      "x_nadsec_orgs": [
        "MTS PJSC"
      ]
    },
    {
      "created": "2026-03-21T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KG; asn=12997; asn_org=OJSC Kyrgyztelecom",
      "id": "indicator--fa958367-38ac-4285-846a-a5ae69f82d49",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.145.132.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T06:05:03.000Z",
      "valid_until": "2026-04-22T06:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T05:29:38.654Z",
      "x_nadsec_last_seen": "2026-03-21T05:36:54.885Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "12997"
      ],
      "x_nadsec_orgs": [
        "OJSC Kyrgyztelecom"
      ]
    },
    {
      "created": "2026-03-21T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=34533; asn_org=JSC ER-Telecom Holding; user(top)=**",
      "id": "indicator--7691e129-a0b0-4068-a18f-1e1c56c3fd5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.113.44.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T06:05:03.000Z",
      "valid_until": "2026-04-22T06:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T05:59:37.375Z",
      "x_nadsec_last_seen": "2026-03-21T05:59:37.375Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "34533"
      ],
      "x_nadsec_orgs": [
        "JSC ER-Telecom Holding"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-21T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--38557c5c-d103-4a02-8a82-ef90e2e480a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.183.246.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:05:02.000Z",
      "valid_until": "2026-04-22T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T07:00:35.429Z",
      "x_nadsec_last_seen": "2026-03-21T07:03:50.379Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-21T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--67d763e3-9f27-45a7-bce4-01960a4324cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:05:02.000Z",
      "valid_until": "2026-04-22T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T06:54:57.058Z",
      "x_nadsec_last_seen": "2026-03-21T06:54:57.058Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-21T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--c639fdab-c6f2-4625-8b1c-bf61cd17fc2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.131.48.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:05:02.000Z",
      "valid_until": "2026-04-22T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T06:48:49.079Z",
      "x_nadsec_last_seen": "2026-03-21T06:48:49.230Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-21T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=8053; asn_org=IFX Networks Venezuela C.A.",
      "id": "indicator--890051f4-374f-4c56-bc2b-14b4fcd29caf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.94.249.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:05:02.000Z",
      "valid_until": "2026-04-22T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T06:42:10.089Z",
      "x_nadsec_last_seen": "2026-03-21T06:49:07.829Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8053"
      ],
      "x_nadsec_orgs": [
        "IFX Networks Venezuela C.A."
      ]
    },
    {
      "created": "2026-03-21T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ee64faba-7c43-4a34-966d-9344f890084f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.136.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:05:02.000Z",
      "valid_until": "2026-04-22T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T06:26:53.134Z",
      "x_nadsec_last_seen": "2026-03-21T06:27:03.453Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-21T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25591; asn_org=BCLan LLC",
      "id": "indicator--b3472130-03ed-4fc3-b561-3032a5744011",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.188.146.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:05:02.000Z",
      "valid_until": "2026-04-22T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T06:20:02.816Z",
      "x_nadsec_last_seen": "2026-03-21T06:22:09.601Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25591"
      ],
      "x_nadsec_orgs": [
        "BCLan LLC"
      ]
    },
    {
      "created": "2026-03-21T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BY; asn=6697; asn_org=Republican Unitary Telecommunication Enterprise Beltelecom",
      "id": "indicator--04356b0d-5e50-457f-887e-2b2c069a2534",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.84.79.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:05:02.000Z",
      "valid_until": "2026-04-22T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T06:29:11.536Z",
      "x_nadsec_last_seen": "2026-03-21T06:36:11.903Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BY"
      ],
      "x_nadsec_asns": [
        "6697"
      ],
      "x_nadsec_orgs": [
        "Republican Unitary Telecommunication Enterprise Beltelecom"
      ]
    },
    {
      "created": "2026-03-21T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--da28c18d-7945-4740-afab-59a731599a9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.166.105.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:05:06.000Z",
      "valid_until": "2026-04-22T08:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-16T22:07:50.201Z",
      "x_nadsec_last_seen": "2026-03-21T07:36:58.446Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-03-21T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fdb08c00-79af-4bfb-bc54-c71b7998353a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.248.225.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:05:06.000Z",
      "valid_until": "2026-04-22T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T07:47:21.897Z",
      "x_nadsec_last_seen": "2026-03-21T07:47:21.897Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-21T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6bcee5a6-4285-47cb-a806-f40faf5c24bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.174.246.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:05:06.000Z",
      "valid_until": "2026-04-22T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T07:37:44.748Z",
      "x_nadsec_last_seen": "2026-03-21T07:39:49.429Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-21T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--82054ee2-1ce8-447a-97b7-cbb63cb441cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.229.104.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:05:06.000Z",
      "valid_until": "2026-04-22T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T07:16:54.784Z",
      "x_nadsec_last_seen": "2026-03-21T07:19:02.181Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-21T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--32564c07-3418-4663-a9c5-ccb99a1f7500",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.176.99.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:05:06.000Z",
      "valid_until": "2026-04-22T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T07:16:12.830Z",
      "x_nadsec_last_seen": "2026-03-21T07:18:21.691Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-21T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ff6e4df6-08d3-48f3-9854-edb941afd985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.12.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:05:06.000Z",
      "valid_until": "2026-04-22T08:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-21T07:16:32.697Z",
      "x_nadsec_last_seen": "2026-03-21T07:19:02.335Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017",
        "34505"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-21T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--23a478de-4e02-4b1f-b562-94621c2574ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.236.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:05:06.000Z",
      "valid_until": "2026-04-22T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T07:47:22.773Z",
      "x_nadsec_last_seen": "2026-03-21T07:47:22.773Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-21T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--fc7cbb89-38a4-409b-9a9f-57e8c06659cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.251.242.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:05:06.000Z",
      "valid_until": "2026-04-22T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T07:14:43.951Z",
      "x_nadsec_last_seen": "2026-03-21T07:14:46.622Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-21T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=51570; asn_org=JSC ER-Telecom Holding",
      "id": "indicator--a7f56ae3-12e9-4a6f-a517-7942ad1c9feb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.187.54.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:05:06.000Z",
      "valid_until": "2026-04-22T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T07:43:43.695Z",
      "x_nadsec_last_seen": "2026-03-21T07:45:51.005Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "51570"
      ],
      "x_nadsec_orgs": [
        "JSC ER-Telecom Holding"
      ]
    },
    {
      "created": "2026-03-21T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MO; asn=4609; asn_org=Companhia de Telecomunicacoes de Macau SARL",
      "id": "indicator--41e011d0-e77a-4fbe-b4f2-750239068a23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.86.172.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:05:06.000Z",
      "valid_until": "2026-04-22T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T07:10:36.594Z",
      "x_nadsec_last_seen": "2026-03-21T07:12:41.090Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MO"
      ],
      "x_nadsec_asns": [
        "4609"
      ],
      "x_nadsec_orgs": [
        "Companhia de Telecomunicacoes de Macau SARL"
      ]
    },
    {
      "created": "2026-03-21T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bdcb32ab-e241-489a-839a-1a867de2f0b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:05:06.000Z",
      "valid_until": "2026-04-22T08:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-21T07:31:38.874Z",
      "x_nadsec_last_seen": "2026-03-30T12:49:19.003Z",
      "x_nadsec_ports": [
        "81",
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-21T08:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--8f2fd020-43b9-4482-a72a-2ac184317c9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T08:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.10.108.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:05:06.000Z",
      "valid_until": "2026-04-22T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T07:52:41.729Z",
      "x_nadsec_last_seen": "2026-03-21T07:54:48.829Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-21T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--bd39d215-3961-41bf-8a41-9365f7f22bac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.249.38.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T09:05:02.000Z",
      "valid_until": "2026-04-22T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T08:41:40.813Z",
      "x_nadsec_last_seen": "2026-03-24T08:06:47.064Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-03-21T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=24739; asn_org=JSC Severen-Telecom",
      "id": "indicator--f4d87608-362e-41bb-b36f-f198f6ae45f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.32.177.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T09:05:02.000Z",
      "valid_until": "2026-04-22T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T08:55:41.818Z",
      "x_nadsec_last_seen": "2026-03-21T09:01:07.528Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24739"
      ],
      "x_nadsec_orgs": [
        "JSC Severen-Telecom"
      ]
    },
    {
      "created": "2026-03-21T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--4ee15f1a-4b6a-414e-8728-6fee95844db0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.154.74.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T09:05:02.000Z",
      "valid_until": "2026-04-22T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T08:33:25.980Z",
      "x_nadsec_last_seen": "2026-03-21T08:35:31.089Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-21T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--85d1793a-8ccf-48c5-8fd6-ec87668cb5c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.220.55.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T09:05:02.000Z",
      "valid_until": "2026-04-22T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T08:58:52.139Z",
      "x_nadsec_last_seen": "2026-03-21T09:00:58.271Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-21T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MK; asn=6821; asn_org=Makedonski Telekom AD-Skopje",
      "id": "indicator--aeaf2718-9e7a-42cc-a66e-86433e03e9a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.162.141.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T09:05:02.000Z",
      "valid_until": "2026-04-22T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T08:06:27.439Z",
      "x_nadsec_last_seen": "2026-03-21T08:08:33.834Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MK"
      ],
      "x_nadsec_asns": [
        "6821"
      ],
      "x_nadsec_orgs": [
        "Makedonski Telekom AD-Skopje"
      ]
    },
    {
      "created": "2026-03-21T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--363e2e2f-29d1-4d6b-a815-5ea746c4d656",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.208.127.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T09:05:02.000Z",
      "valid_until": "2026-04-22T09:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T08:27:46.645Z",
      "x_nadsec_last_seen": "2026-03-21T08:35:28.160Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-21T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PL; asn=56449; asn_org=INTERA SP.zoo",
      "id": "indicator--18b6c72d-64e1-4a0c-a34c-2e30622f6eea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.225.156.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T09:05:02.000Z",
      "valid_until": "2026-04-22T09:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-21T08:36:21.951Z",
      "x_nadsec_last_seen": "2026-03-29T20:02:14.772Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "56449"
      ],
      "x_nadsec_orgs": [
        "INTERA SP.zoo"
      ]
    },
    {
      "created": "2026-03-21T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--be77fbdc-6f06-475d-8b8e-7332bb926f8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.150.114.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T10:05:02.000Z",
      "valid_until": "2026-04-22T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T09:59:57.912Z",
      "x_nadsec_last_seen": "2026-03-21T10:06:23.117Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-03-21T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--9317c893-9a9d-4618-a6d5-77c8f7272ba9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.23.64.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T10:05:02.000Z",
      "valid_until": "2026-04-22T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T09:38:11.527Z",
      "x_nadsec_last_seen": "2026-03-21T09:40:17.342Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-21T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--ccb36dea-ed2f-45d1-b145-95237c1e76f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.32.162.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T10:05:02.000Z",
      "valid_until": "2026-04-22T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T10:00:56.131Z",
      "x_nadsec_last_seen": "2026-03-21T10:03:00.765Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-21T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--f35e8439-88fa-4461-891c-15c6eb5f8608",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.157.109.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T10:05:02.000Z",
      "valid_until": "2026-04-22T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T10:04:06.306Z",
      "x_nadsec_last_seen": "2026-03-21T10:04:11.487Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-21T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--98337031-14c1-4462-b635-f1bfd65869ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T10:05:02.000Z",
      "valid_until": "2026-04-22T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T09:12:03.143Z",
      "x_nadsec_last_seen": "2026-03-22T05:20:23.539Z",
      "x_nadsec_ports": [
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-21T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--4cfa3a91-ad2e-4bcc-8187-d006728b1a86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.178.239.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T10:05:02.000Z",
      "valid_until": "2026-04-22T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T09:17:57.302Z",
      "x_nadsec_last_seen": "2026-03-21T09:20:03.633Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-21T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--773fd411-7959-4871-8664-09670643de89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '174.140.13.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T10:05:02.000Z",
      "valid_until": "2026-04-22T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T10:03:14.509Z",
      "x_nadsec_last_seen": "2026-03-21T10:05:20.920Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-21T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--77f29de8-e787-495e-a61c-7ce452a57e3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T10:05:02.000Z",
      "valid_until": "2026-04-22T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T09:54:30.912Z",
      "x_nadsec_last_seen": "2026-03-21T09:54:30.912Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-21T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3b10489e-34bb-48bb-877a-2c43a97c3e6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T10:05:02.000Z",
      "valid_until": "2026-04-22T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T09:51:12.997Z",
      "x_nadsec_last_seen": "2026-03-21T09:51:12.997Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-21T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--72429d1c-a622-4185-bea7-93474cc6ca84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.227.245.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T10:05:02.000Z",
      "valid_until": "2026-04-22T10:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-21T09:14:51.409Z",
      "x_nadsec_last_seen": "2026-03-24T10:58:16.044Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-21T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=FR; asn=16347; asn_org=ADISTA SAS",
      "id": "indicator--58049f56-30c8-4afa-ab5c-128f67584392",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.98.102.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T10:05:02.000Z",
      "valid_until": "2026-04-22T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T09:56:57.718Z",
      "x_nadsec_last_seen": "2026-03-22T18:06:07.301Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "16347"
      ],
      "x_nadsec_orgs": [
        "ADISTA SAS"
      ]
    },
    {
      "created": "2026-03-21T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MA; asn=36903; asn_org=MT-MPLS; user(top)=**",
      "id": "indicator--d4cac16c-b003-483d-852e-ce93090386fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.157.162.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:05:02.000Z",
      "valid_until": "2026-04-22T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T10:42:02.249Z",
      "x_nadsec_last_seen": "2026-03-21T10:42:02.249Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MA"
      ],
      "x_nadsec_asns": [
        "36903"
      ],
      "x_nadsec_orgs": [
        "MT-MPLS"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-21T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--4c4721e2-33c9-42f7-a573-47989e468cfb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.176.104.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:05:02.000Z",
      "valid_until": "2026-04-22T11:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-21T10:09:34.262Z",
      "x_nadsec_last_seen": "2026-03-22T15:17:51.989Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-21T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e1737cbd-37f3-42f0-ad29-c1c2ce70e0d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.227.88.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:05:02.000Z",
      "valid_until": "2026-04-22T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T10:42:24.945Z",
      "x_nadsec_last_seen": "2026-03-21T10:44:31.140Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-21T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--6e7804c3-7e7e-4456-ad21-997186243d76",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:05:02.000Z",
      "valid_until": "2026-04-22T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T10:26:29.135Z",
      "x_nadsec_last_seen": "2026-03-21T10:26:29.135Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-21T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--6ad90062-bb88-4500-b96f-49049bff1c81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.150.169.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:05:02.000Z",
      "valid_until": "2026-04-22T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T10:32:37.113Z",
      "x_nadsec_last_seen": "2026-03-21T10:34:43.502Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-03-21T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3145; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--45b78157-e265-4d33-ac8d-f5145da29266",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.233.80.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:05:02.000Z",
      "valid_until": "2026-04-22T11:05:01.000Z",
      "x_nadsec_event_count": 3145,
      "x_nadsec_first_seen": "2026-03-21T10:27:52.134Z",
      "x_nadsec_last_seen": "2026-03-21T10:57:07.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-21T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--06cb38b8-dd93-45a8-9334-cbda7322de02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.38.252.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:05:02.000Z",
      "valid_until": "2026-04-22T11:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T10:44:21.430Z",
      "x_nadsec_last_seen": "2026-03-21T11:31:50.200Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-21T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--be4f1d22-4742-4b33-a1b1-be71cac258e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.52.173.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:05:02.000Z",
      "valid_until": "2026-04-22T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T10:49:03.274Z",
      "x_nadsec_last_seen": "2026-03-24T21:02:45.477Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-21T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--8d853cce-6dd5-4bc1-a87e-1cddc03a3eac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.83.235.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:05:02.000Z",
      "valid_until": "2026-04-22T11:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T10:38:44.314Z",
      "x_nadsec_last_seen": "2026-03-21T10:38:44.537Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-21T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fcea88ab-2f7d-49a6-b299-668ecb11eace",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.184.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T11:05:02.000Z",
      "valid_until": "2026-04-22T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-16T22:15:05.562Z",
      "x_nadsec_last_seen": "2026-03-21T10:17:19.557Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-21T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--138281f1-d114-436a-b568-de8c046a4ad3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T12:05:04.000Z",
      "valid_until": "2026-04-22T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T11:39:08.181Z",
      "x_nadsec_last_seen": "2026-03-21T11:39:08.181Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-21T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--16d9a54b-80a7-48f4-b8f4-096bfefd4123",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T12:05:04.000Z",
      "valid_until": "2026-04-22T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T11:31:44.400Z",
      "x_nadsec_last_seen": "2026-03-21T11:31:44.400Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-21T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=35598; asn_org=Inetcom Carrier LLC",
      "id": "indicator--76f47aca-f8d2-4dbb-9d43-af2b9e54dd1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.99.138.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T12:05:04.000Z",
      "valid_until": "2026-04-22T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T11:53:55.330Z",
      "x_nadsec_last_seen": "2026-03-21T12:00:51.215Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "35598"
      ],
      "x_nadsec_orgs": [
        "Inetcom Carrier LLC"
      ]
    },
    {
      "created": "2026-03-21T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--e42d9735-7b25-4c78-9565-e8daa1bd46fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.4.118.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T12:05:04.000Z",
      "valid_until": "2026-04-22T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T12:04:12.476Z",
      "x_nadsec_last_seen": "2026-03-21T12:06:23.535Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-03-21T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--6ef7d5a0-6ecb-4ae3-855d-099a92d6da1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.234.76.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T12:05:04.000Z",
      "valid_until": "2026-04-22T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T11:37:45.937Z",
      "x_nadsec_last_seen": "2026-03-21T11:39:50.689Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-21T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=19689; asn_org=Nuvisions",
      "id": "indicator--5e43bf18-83d5-48aa-b3d5-a283eef48005",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.119.81.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T12:05:04.000Z",
      "valid_until": "2026-04-22T12:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-13T11:24:03.611Z",
      "x_nadsec_last_seen": "2026-03-21T12:01:16.415Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "19689"
      ],
      "x_nadsec_orgs": [
        "Nuvisions"
      ]
    },
    {
      "created": "2026-03-21T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KW; asn=21050; asn_org=Fast Communication Company Ltd",
      "id": "indicator--baccd5e0-89ed-41f4-976b-c7ac71e0d4f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.96.72.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T12:05:04.000Z",
      "valid_until": "2026-04-22T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T11:22:59.423Z",
      "x_nadsec_last_seen": "2026-03-21T11:25:06.664Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KW"
      ],
      "x_nadsec_asns": [
        "21050"
      ],
      "x_nadsec_orgs": [
        "Fast Communication Company Ltd"
      ]
    },
    {
      "created": "2026-03-21T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=9341; asn_org=PT INDONESIA COMNETS PLUS",
      "id": "indicator--0bbef10d-9c0a-4dbb-878b-54930a46a96a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.178.17.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T13:05:03.000Z",
      "valid_until": "2026-04-22T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T12:07:54.872Z",
      "x_nadsec_last_seen": "2026-03-21T12:09:59.505Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9341"
      ],
      "x_nadsec_orgs": [
        "PT INDONESIA COMNETS PLUS"
      ]
    },
    {
      "created": "2026-03-21T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31224; asn_org=PJSC MegaFon",
      "id": "indicator--15ee9d51-95d2-44dc-a9ee-94a5abba7226",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.178.93.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T13:05:03.000Z",
      "valid_until": "2026-04-22T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T12:17:36.780Z",
      "x_nadsec_last_seen": "2026-03-21T12:19:44.009Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31224"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-21T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BO; asn=6568; asn_org=EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA",
      "id": "indicator--d505132e-b053-45fd-be90-8d43b9105d0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.115.187.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T13:05:03.000Z",
      "valid_until": "2026-04-22T13:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-21T12:37:55.571Z",
      "x_nadsec_last_seen": "2026-03-21T12:38:39.148Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "6568"
      ],
      "x_nadsec_orgs": [
        "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA"
      ]
    },
    {
      "created": "2026-03-21T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "id": "indicator--cf829500-cbc2-4117-bacb-278f57e18f09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.117.206.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T13:05:03.000Z",
      "valid_until": "2026-04-22T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T12:12:06.491Z",
      "x_nadsec_last_seen": "2026-03-21T12:17:44.490Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ]
    },
    {
      "created": "2026-03-21T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MZ; asn=25139; asn_org=Comunicacoes Multimedia, Lda",
      "id": "indicator--629427b8-a26b-479f-9c1e-d246f39c4f95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.249.7.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T13:05:03.000Z",
      "valid_until": "2026-04-22T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T12:36:46.496Z",
      "x_nadsec_last_seen": "2026-03-21T12:38:53.885Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MZ"
      ],
      "x_nadsec_asns": [
        "25139"
      ],
      "x_nadsec_orgs": [
        "Comunicacoes Multimedia, Lda"
      ]
    },
    {
      "created": "2026-03-21T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LT; asn=8764; asn_org=Telia Lietuva, AB",
      "id": "indicator--088d17d1-aa19-4426-9c32-ec89ff04caee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.118.75.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T13:05:03.000Z",
      "valid_until": "2026-04-22T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T12:52:36.476Z",
      "x_nadsec_last_seen": "2026-03-21T12:54:43.940Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LT"
      ],
      "x_nadsec_asns": [
        "8764"
      ],
      "x_nadsec_orgs": [
        "Telia Lietuva, AB"
      ]
    },
    {
      "created": "2026-03-21T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b44753b8-5efa-4c27-8b4c-971fbd2004d7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.41.158.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:05:02.000Z",
      "valid_until": "2026-04-22T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T13:31:31.002Z",
      "x_nadsec_last_seen": "2026-03-21T13:33:35.673Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-21T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=17924; asn_org=SmarTone Mobile Communications Ltd",
      "id": "indicator--80b4fcd8-0078-4118-b101-5e48c27dd86b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.203.249.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:05:02.000Z",
      "valid_until": "2026-04-22T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T13:15:32.642Z",
      "x_nadsec_last_seen": "2026-03-21T13:17:38.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "17924"
      ],
      "x_nadsec_orgs": [
        "SmarTone Mobile Communications Ltd"
      ]
    },
    {
      "created": "2026-03-21T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f1b05f1e-87cb-4006-a843-0639f6f199ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.224.141.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:05:02.000Z",
      "valid_until": "2026-04-22T14:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-21T13:11:48.322Z",
      "x_nadsec_last_seen": "2026-03-29T09:30:27.620Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-21T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2aa5574a-99f8-4617-9811-096e71d37fab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.216.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:05:02.000Z",
      "valid_until": "2026-04-22T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T13:05:07.528Z",
      "x_nadsec_last_seen": "2026-03-21T13:05:07.528Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-21T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=FR; asn=51167; asn_org=Contabo GmbH; user(top)=**",
      "id": "indicator--b3702c86-60cd-4f7a-9a75-36a4549b61f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.97.115.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:05:02.000Z",
      "valid_until": "2026-04-22T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T13:33:56.723Z",
      "x_nadsec_last_seen": "2026-03-21T13:33:56.723Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-21T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--9bdb4de3-243b-47c3-b1f3-19e517eb795b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '168.121.221.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:05:02.000Z",
      "valid_until": "2026-04-22T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-21T13:22:48.608Z",
      "x_nadsec_last_seen": "2026-03-21T13:23:28.399Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ]
    },
    {
      "created": "2026-03-21T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=209759; asn_org=Moy Telecom LLC",
      "id": "indicator--1c5e352c-49d6-419f-96e0-2f3fc50255bb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.218.157.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:05:02.000Z",
      "valid_until": "2026-04-22T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T13:44:09.182Z",
      "x_nadsec_last_seen": "2026-03-21T13:51:40.176Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "209759"
      ],
      "x_nadsec_orgs": [
        "Moy Telecom LLC"
      ]
    },
    {
      "created": "2026-03-21T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AR; asn=11014; asn_org=CPS",
      "id": "indicator--72563dd9-6b26-4e65-b996-2fa13ddf39eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.104.195.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:05:02.000Z",
      "valid_until": "2026-04-22T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-21T13:50:27.470Z",
      "x_nadsec_last_seen": "2026-03-30T15:59:27.078Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "11014"
      ],
      "x_nadsec_orgs": [
        "CPS"
      ]
    },
    {
      "created": "2026-03-21T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PY; asn=28103; asn_org=TECNOLOGIA EN ELECTRONICA E INFORMATICA SOCIEDAD ANONIMA T.E.I.S.A",
      "id": "indicator--aaf1b8f0-a615-4167-9abf-beb63cb38938",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.110.231.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:05:02.000Z",
      "valid_until": "2026-04-22T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T13:10:01.788Z",
      "x_nadsec_last_seen": "2026-03-21T13:12:09.213Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PY"
      ],
      "x_nadsec_asns": [
        "28103"
      ],
      "x_nadsec_orgs": [
        "TECNOLOGIA EN ELECTRONICA E INFORMATICA SOCIEDAD ANONIMA T.E.I.S.A"
      ]
    },
    {
      "created": "2026-03-21T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--668fd350-714a-4324-84bc-92edfe0a52af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.210.70.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:05:02.000Z",
      "valid_until": "2026-04-22T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T14:03:33.708Z",
      "x_nadsec_last_seen": "2026-03-21T14:03:33.708Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-21T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4ad24fb0-c143-47d1-9106-25188217aae8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:05:02.000Z",
      "valid_until": "2026-04-22T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T13:50:31.039Z",
      "x_nadsec_last_seen": "2026-03-21T13:50:41.199Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-21T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=16814; asn_org=NSS S.A.",
      "id": "indicator--997f6d04-72bb-4341-811e-060898241047",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.61.183.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:05:02.000Z",
      "valid_until": "2026-04-22T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-21T13:48:20.590Z",
      "x_nadsec_last_seen": "2026-03-21T13:50:25.739Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "16814"
      ],
      "x_nadsec_orgs": [
        "NSS S.A."
      ]
    },
    {
      "created": "2026-03-21T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ES; asn=12430; asn_org=Vodafone Spain",
      "id": "indicator--5f77d29f-082c-4771-94c2-6393c9aff696",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.226.243.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:05:02.000Z",
      "valid_until": "2026-04-22T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-21T13:06:16.704Z",
      "x_nadsec_last_seen": "2026-03-21T14:08:18.472Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "12430"
      ],
      "x_nadsec_orgs": [
        "Vodafone Spain"
      ]
    },
    {
      "created": "2026-03-21T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--46c7b2cb-223d-4367-9283-dfb5bfc840f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.188.122.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:05:02.000Z",
      "valid_until": "2026-04-22T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T14:12:59.165Z",
      "x_nadsec_last_seen": "2026-03-21T14:15:06.098Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-21T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=mysqld; ports=3306; cc=US; asn=11427; asn_org=Charter Communications Inc",
      "id": "indicator--fde35f30-1f7e-4c1a-bb8f-9ae98fb599b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.197.14.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:05:02.000Z",
      "valid_until": "2026-04-22T15:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-21T14:47:51.267Z",
      "x_nadsec_last_seen": "2026-03-21T14:47:51.500Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11427"
      ],
      "x_nadsec_orgs": [
        "Charter Communications Inc"
      ]
    },
    {
      "created": "2026-03-21T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CA; asn=852; asn_org=TELUS Communications",
      "id": "indicator--bcbe362b-5be4-4c63-9083-722f2cbd9160",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '204.191.73.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:05:02.000Z",
      "valid_until": "2026-04-22T15:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T14:49:53.272Z",
      "x_nadsec_last_seen": "2026-03-21T14:56:44.263Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "852"
      ],
      "x_nadsec_orgs": [
        "TELUS Communications"
      ]
    },
    {
      "created": "2026-03-21T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; user(top)=a*******s; pass(top)=a*******s",
      "id": "indicator--4ced63d0-cb6a-497d-a149-b7ea10c7545e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '50.198.42.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:05:02.000Z",
      "valid_until": "2026-04-22T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T14:08:13.558Z",
      "x_nadsec_last_seen": "2026-03-21T14:08:13.558Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "7922"
      ],
      "x_nadsec_orgs": [
        "Comcast Cable Communications, LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s"
      ]
    },
    {
      "created": "2026-03-21T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--d0405b62-cd26-4aa4-836c-0e58d6675073",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.120.116.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:05:02.000Z",
      "valid_until": "2026-04-22T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T14:27:08.163Z",
      "x_nadsec_last_seen": "2026-03-21T14:29:12.859Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-21T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--02a2b7e3-9f6a-4916-a100-56936b4f7dc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.249.144.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:05:02.000Z",
      "valid_until": "2026-04-22T15:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-21T14:21:50.027Z",
      "x_nadsec_last_seen": "2026-03-21T14:29:14.289Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-21T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--4d2b306b-24f7-4d70-a730-13120db63d1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.105.136.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T15:05:02.000Z",
      "valid_until": "2026-04-22T15:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-21T14:47:28.848Z",
      "x_nadsec_last_seen": "2026-03-30T15:27:39.458Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-21T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=58765; asn_org=B TEL INTERNET PRIVATE LIMITED",
      "id": "indicator--33382c3d-b62d-4091-9f5c-72ba0eecbb8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.124.42.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T16:05:02.000Z",
      "valid_until": "2026-04-22T16:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T15:59:27.816Z",
      "x_nadsec_last_seen": "2026-03-21T16:01:32.778Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "58765"
      ],
      "x_nadsec_orgs": [
        "B TEL INTERNET PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-21T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c92212f1-7b7b-4699-a6a3-3168c91c599c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.89.124.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T16:05:02.000Z",
      "valid_until": "2026-04-22T16:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T15:27:28.403Z",
      "x_nadsec_last_seen": "2026-03-21T15:27:28.403Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-21T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--63460c25-d545-40a6-998d-8965ace79acc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.29.23.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T16:05:02.000Z",
      "valid_until": "2026-04-22T16:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T15:45:56.653Z",
      "x_nadsec_last_seen": "2026-03-21T15:45:56.653Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-21T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--54d7c922-5a31-4553-b45b-dedd022b2951",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.77.166.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T16:05:02.000Z",
      "valid_until": "2026-04-22T16:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T15:13:43.250Z",
      "x_nadsec_last_seen": "2026-03-21T15:13:43.250Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-21T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--dc01f7ac-fb03-4d1b-a8e2-27371d09004d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.233.21.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T16:05:02.000Z",
      "valid_until": "2026-04-22T16:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T15:13:42.598Z",
      "x_nadsec_last_seen": "2026-03-21T15:13:42.598Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-21T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=17638; asn_org=ASN for TIANJIN Provincial Net of CT",
      "id": "indicator--9883e2a6-7747-460d-92ef-c14a48ef434a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.106.166.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T16:05:02.000Z",
      "valid_until": "2026-04-22T16:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T15:06:52.287Z",
      "x_nadsec_last_seen": "2026-03-21T15:06:52.287Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "17638"
      ],
      "x_nadsec_orgs": [
        "ASN for TIANJIN Provincial Net of CT"
      ]
    },
    {
      "created": "2026-03-21T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--20cc4717-9812-4c72-9cdd-bdaa68747638",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.236.49.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T16:05:02.000Z",
      "valid_until": "2026-04-22T16:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T15:38:48.496Z",
      "x_nadsec_last_seen": "2026-03-21T15:40:53.114Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-21T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--baa5b08b-1efb-4e7c-bc79-09a1e074b675",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.161.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:05:03.000Z",
      "valid_until": "2026-04-22T17:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-21T16:17:47.231Z",
      "x_nadsec_last_seen": "2026-03-21T16:18:12.601Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-21T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=61662; asn_org=G2 XAXIM TELECOMUNICACOES LTDA",
      "id": "indicator--ca58355d-0aac-4627-a4c9-d870c4d8fdaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '131.100.212.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:05:03.000Z",
      "valid_until": "2026-04-22T17:05:02.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-21T16:41:26.277Z",
      "x_nadsec_last_seen": "2026-03-21T17:28:45.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "61662"
      ],
      "x_nadsec_orgs": [
        "G2 XAXIM TELECOMUNICACOES LTDA"
      ]
    },
    {
      "created": "2026-03-21T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--abbc4722-dd53-46d6-be46-4ba4042e3769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.161.253.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:05:03.000Z",
      "valid_until": "2026-04-22T17:05:02.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-21T16:05:39.357Z",
      "x_nadsec_last_seen": "2026-03-21T16:46:49.078Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-21T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6aff7db0-ada6-4b13-82c1-a4cbd087f13a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:05:03.000Z",
      "valid_until": "2026-04-22T17:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T16:46:37.218Z",
      "x_nadsec_last_seen": "2026-03-21T16:46:37.218Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-21T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=4230; asn_org=CLARO S.A.; user(top)=**",
      "id": "indicator--10bddabc-7e35-4385-969f-de3d98c64177",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.166.5.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:05:03.000Z",
      "valid_until": "2026-04-22T17:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T16:30:53.397Z",
      "x_nadsec_last_seen": "2026-03-21T16:30:53.397Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-21T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--23dc2c85-5c80-44eb-98c7-ebb171a119c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.161.105.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:05:03.000Z",
      "valid_until": "2026-04-22T17:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T16:17:21.100Z",
      "x_nadsec_last_seen": "2026-03-21T16:19:27.838Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-21T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a93ed2e2-466c-4fce-906d-05846901d2fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.147.174.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:05:03.000Z",
      "valid_until": "2026-04-22T17:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T16:19:13.559Z",
      "x_nadsec_last_seen": "2026-03-21T16:27:41.010Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-21T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=25513; asn_org=PJSC Moscow city telephone network",
      "id": "indicator--20248ff4-f894-4afd-bc72-dab1c68e61c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.29.126.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:05:03.000Z",
      "valid_until": "2026-04-22T17:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T16:28:32.583Z",
      "x_nadsec_last_seen": "2026-03-21T16:30:39.432Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25513"
      ],
      "x_nadsec_orgs": [
        "PJSC Moscow city telephone network"
      ]
    },
    {
      "created": "2026-03-21T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--817d15e6-f492-4089-aa82-851062c9e2a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.6.97.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T18:05:05.000Z",
      "valid_until": "2026-04-22T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T17:37:23.329Z",
      "x_nadsec_last_seen": "2026-03-21T17:39:27.959Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-21T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--077cb72f-5896-4c4f-a462-7af8034c8c5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T18:05:05.000Z",
      "valid_until": "2026-04-22T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T17:34:44.064Z",
      "x_nadsec_last_seen": "2026-03-21T17:34:44.064Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-21T18:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--cedeb147-d28f-45f6-beb3-c6652e0d7d74",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T18:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.117.109.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T18:05:05.000Z",
      "valid_until": "2026-04-22T18:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-21T17:10:51.543Z",
      "x_nadsec_last_seen": "2026-03-21T18:16:33.544Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-03-21T19:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=37148; asn_org=globacom-as",
      "id": "indicator--65bc2448-8189-4ef3-a3df-c75b49fc9848",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T19:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.211.52.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T19:05:54.000Z",
      "valid_until": "2026-04-22T19:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-21T18:05:43.896Z",
      "x_nadsec_last_seen": "2026-03-21T18:05:50.670Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37148"
      ],
      "x_nadsec_orgs": [
        "globacom-as"
      ]
    },
    {
      "created": "2026-03-21T19:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a5dd2709-52ee-4aa4-bc77-9e457dccb28e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T19:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T19:05:54.000Z",
      "valid_until": "2026-04-22T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T18:27:41.704Z",
      "x_nadsec_last_seen": "2026-03-21T18:27:41.704Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-21T19:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--bb735259-c370-4064-8160-d91a35b839ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T19:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T19:05:54.000Z",
      "valid_until": "2026-04-22T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T18:31:13.498Z",
      "x_nadsec_last_seen": "2026-03-21T18:31:13.498Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-21T19:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=34797; asn_org=System Net Ltd",
      "id": "indicator--4c7b6ad1-84f6-4628-9e9c-c5f414580201",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T19:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.212.62.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T19:05:54.000Z",
      "valid_until": "2026-04-22T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T18:34:04.111Z",
      "x_nadsec_last_seen": "2026-03-21T18:36:10.631Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "34797"
      ],
      "x_nadsec_orgs": [
        "System Net Ltd"
      ]
    },
    {
      "created": "2026-03-21T19:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--098a2614-5df7-4dcb-824b-332ed009893b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T19:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T19:05:54.000Z",
      "valid_until": "2026-04-22T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T18:18:57.364Z",
      "x_nadsec_last_seen": "2026-03-21T18:18:57.364Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-21T19:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--4d7cf024-3cdb-408e-9f97-bbe7f0aec93c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T19:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T19:05:54.000Z",
      "valid_until": "2026-04-22T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T18:18:36.132Z",
      "x_nadsec_last_seen": "2026-03-21T18:18:36.132Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-21T19:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--39ef9c9c-db64-4af1-beba-fa69caabdd47",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T19:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T19:05:54.000Z",
      "valid_until": "2026-04-22T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T18:18:58.036Z",
      "x_nadsec_last_seen": "2026-03-21T18:18:58.036Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-21T19:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9876322e-f4e3-4f50-94da-af6b2191a40f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T19:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T19:05:54.000Z",
      "valid_until": "2026-04-22T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T18:18:36.468Z",
      "x_nadsec_last_seen": "2026-03-21T18:18:36.468Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-21T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=36873; asn_org=Celtel Nigeria Limited t.a ZAIN",
      "id": "indicator--7df881db-6828-40ff-bfa6-f8dce3e1de9b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.118.1.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:05:03.000Z",
      "valid_until": "2026-04-22T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T19:16:41.635Z",
      "x_nadsec_last_seen": "2026-03-21T19:18:50.230Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "36873"
      ],
      "x_nadsec_orgs": [
        "Celtel Nigeria Limited t.a ZAIN"
      ]
    },
    {
      "created": "2026-03-21T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--03016241-daa8-448c-ac58-07377ac37816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.203.201.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:05:03.000Z",
      "valid_until": "2026-04-22T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T19:50:19.898Z",
      "x_nadsec_last_seen": "2026-03-21T19:50:30.069Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-21T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--013b2660-5841-4f1f-a2a7-3ff46aa1589d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.128.82.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:05:03.000Z",
      "valid_until": "2026-04-22T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T19:27:56.902Z",
      "x_nadsec_last_seen": "2026-03-22T12:29:31.237Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-21T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=28665; asn_org=Predlink Rede de Telecomuniccoes Ltda",
      "id": "indicator--9301812e-c7ba-4ce3-8ed1-6eb4f56382f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.1.139.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:05:03.000Z",
      "valid_until": "2026-04-22T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T19:58:47.900Z",
      "x_nadsec_last_seen": "2026-03-21T19:58:54.644Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28665"
      ],
      "x_nadsec_orgs": [
        "Predlink Rede de Telecomuniccoes Ltda"
      ]
    },
    {
      "created": "2026-03-21T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--56bf828e-348d-4b65-bc18-6e01f28501e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:05:03.000Z",
      "valid_until": "2026-04-22T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T19:25:45.210Z",
      "x_nadsec_last_seen": "2026-03-21T19:25:45.210Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-21T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--0cdb2f1b-6794-4f0d-b847-622bcb2b6ad4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.206.45.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:05:03.000Z",
      "valid_until": "2026-04-22T20:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T19:52:17.314Z",
      "x_nadsec_last_seen": "2026-03-21T19:58:33.237Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-21T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=CH; asn=15169; asn_org=Google LLC",
      "id": "indicator--2d4b8455-841f-40f0-bd04-28519034dab8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.216.172.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:05:03.000Z",
      "valid_until": "2026-04-22T20:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-21T19:22:49.318Z",
      "x_nadsec_last_seen": "2026-03-26T05:46:02.145Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "CH"
      ],
      "x_nadsec_asns": [
        "15169"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-21T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=9931; asn_org=National Telecom Public Company Limited",
      "id": "indicator--4f1f5a17-3e0a-4ac8-80e4-28b4dc3fe089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.155.80.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:05:03.000Z",
      "valid_until": "2026-04-22T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T20:32:11.412Z",
      "x_nadsec_last_seen": "2026-03-21T20:34:16.028Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "9931"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-21T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--a0697d65-baea-40d7-abd8-02c19ead10bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.245.84.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:05:03.000Z",
      "valid_until": "2026-04-22T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T20:17:57.093Z",
      "x_nadsec_last_seen": "2026-03-21T20:17:57.093Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-21T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--dfbf5a38-3589-4646-80aa-86ab04cb9a26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.227.31.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:05:03.000Z",
      "valid_until": "2026-04-22T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T20:17:58.285Z",
      "x_nadsec_last_seen": "2026-03-21T20:17:58.285Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-21T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--cfdf52b8-51aa-46ce-9225-b2f5e5b61693",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '144.123.77.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:05:03.000Z",
      "valid_until": "2026-04-22T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T20:17:55.391Z",
      "x_nadsec_last_seen": "2026-03-21T20:17:55.391Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-21T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--a7b0757d-da13-4dcf-873a-ffec97ecea1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.54.65.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:05:03.000Z",
      "valid_until": "2026-04-22T21:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-21T20:54:08.513Z",
      "x_nadsec_last_seen": "2026-03-29T17:15:27.500Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-03-21T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UA; asn=39056; asn_org=Fizichna Osoba-pidpriemec Anohin Igor Valentinovich",
      "id": "indicator--c36731c9-8695-4959-8982-d59148d5f41a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.162.116.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:05:03.000Z",
      "valid_until": "2026-04-22T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T20:59:15.758Z",
      "x_nadsec_last_seen": "2026-03-21T21:01:21.737Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "39056"
      ],
      "x_nadsec_orgs": [
        "Fizichna Osoba-pidpriemec Anohin Igor Valentinovich"
      ]
    },
    {
      "created": "2026-03-21T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--66b23e1d-6b6d-4919-b59f-9fe512dd7e03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:05:03.000Z",
      "valid_until": "2026-04-22T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T20:50:24.236Z",
      "x_nadsec_last_seen": "2026-03-21T20:50:24.562Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-21T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--4b16db4d-6848-4343-a4ac-c507370f1fe4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.176.200.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:05:03.000Z",
      "valid_until": "2026-04-22T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T20:17:48.167Z",
      "x_nadsec_last_seen": "2026-03-21T20:17:48.167Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-21T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=17638; asn_org=ASN for TIANJIN Provincial Net of CT",
      "id": "indicator--9333d311-e661-4c8c-82ef-ce5a9822ba88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.106.167.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T21:05:03.000Z",
      "valid_until": "2026-04-22T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T20:17:39.085Z",
      "x_nadsec_last_seen": "2026-03-21T20:17:39.085Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "17638"
      ],
      "x_nadsec_orgs": [
        "ASN for TIANJIN Provincial Net of CT"
      ]
    },
    {
      "created": "2026-03-21T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8c1d030d-1074-495d-a9ed-e57d52068278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T22:05:02.000Z",
      "valid_until": "2026-04-22T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T21:49:38.888Z",
      "x_nadsec_last_seen": "2026-03-21T21:49:38.888Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-21T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=36914; asn_org=Kenya Education Network",
      "id": "indicator--9c2e5d1f-3ee0-4eef-891b-58d1fc6b852e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.136.50.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T22:05:02.000Z",
      "valid_until": "2026-04-22T22:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T21:52:27.877Z",
      "x_nadsec_last_seen": "2026-03-21T22:00:14.831Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "36914"
      ],
      "x_nadsec_orgs": [
        "Kenya Education Network"
      ]
    },
    {
      "created": "2026-03-21T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--25151733-9d89-4349-a88e-7be542acf5c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.71.202.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T22:05:02.000Z",
      "valid_until": "2026-04-22T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T21:53:03.455Z",
      "x_nadsec_last_seen": "2026-03-21T21:53:09.698Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-21T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC; user(top)=**",
      "id": "indicator--240febd7-adf6-4ddf-bce0-357b5b1f8cc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.225.29.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T22:05:02.000Z",
      "valid_until": "2026-04-22T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T21:17:01.133Z",
      "x_nadsec_last_seen": "2026-03-21T21:17:01.133Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-21T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=16135; asn_org=Turkcell Iletisim Hizmetleri A.s.",
      "id": "indicator--ddbf3a12-5570-4fa5-a1e7-097dbe456546",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.25.148.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T22:05:02.000Z",
      "valid_until": "2026-04-22T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T21:46:28.865Z",
      "x_nadsec_last_seen": "2026-03-21T21:48:35.749Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "16135"
      ],
      "x_nadsec_orgs": [
        "Turkcell Iletisim Hizmetleri A.s."
      ]
    },
    {
      "created": "2026-03-21T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=21479; asn_org=Rostelecom",
      "id": "indicator--ed1796e8-29a0-401b-9a01-9f9d83f63502",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-21T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.68.4.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T22:05:02.000Z",
      "valid_until": "2026-04-22T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T21:51:21.794Z",
      "x_nadsec_last_seen": "2026-03-21T21:53:29.573Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "21479"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-22T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--54bb277f-35c8-4724-b5c2-9ec5571ea036",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.45.245.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:05:03.000Z",
      "valid_until": "2026-04-23T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T23:33:34.160Z",
      "x_nadsec_last_seen": "2026-03-21T23:35:41.046Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-22T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--393995cd-0951-4657-a8e4-f22cbbf7ae05",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.105.209.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:05:03.000Z",
      "valid_until": "2026-04-23T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T23:24:18.321Z",
      "x_nadsec_last_seen": "2026-03-21T23:24:18.321Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-22T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=17809; asn_org=VEE TIME CORP.",
      "id": "indicator--8f260af1-f0d9-4667-95c4-05c4cc4998d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.254.116.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:05:03.000Z",
      "valid_until": "2026-04-23T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T23:36:31.530Z",
      "x_nadsec_last_seen": "2026-03-21T23:38:36.905Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "17809"
      ],
      "x_nadsec_orgs": [
        "VEE TIME CORP."
      ]
    },
    {
      "created": "2026-03-22T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--fdbc00f7-7c1b-46ce-bdc0-fc0ec5fcc9ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:05:03.000Z",
      "valid_until": "2026-04-23T00:05:01.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-21T23:36:34.220Z",
      "x_nadsec_last_seen": "2026-03-23T08:08:19.931Z",
      "x_nadsec_ports": [
        "81",
        "445",
        "21",
        "1723",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "smbd",
        "ftpd",
        "mongod",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-03-22T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--eb2a9d43-30d8-4197-bd84-9fd7cac9f431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.175.24.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:05:03.000Z",
      "valid_until": "2026-04-23T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-21T23:09:24.989Z",
      "x_nadsec_last_seen": "2026-03-21T23:11:31.015Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-22T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=53081; asn_org=Netjacarei Telecon Ltda",
      "id": "indicator--fb47f37c-9cfc-4478-b278-41b09b70bb16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.95.20.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:05:03.000Z",
      "valid_until": "2026-04-23T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-21T23:40:42.832Z",
      "x_nadsec_last_seen": "2026-03-21T23:40:43.155Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53081"
      ],
      "x_nadsec_orgs": [
        "Netjacarei Telecon Ltda"
      ]
    },
    {
      "created": "2026-03-22T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--b3c83928-f38e-4dd4-a0b4-d93793c398e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:05:03.000Z",
      "valid_until": "2026-04-23T00:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-21T23:23:22.419Z",
      "x_nadsec_last_seen": "2026-03-27T07:18:12.133Z",
      "x_nadsec_ports": [
        "27017",
        "1723"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-22T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--5d3cc13a-5dcc-46d5-aead-f966ab01025b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.56.144.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:05:03.000Z",
      "valid_until": "2026-04-23T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-21T23:47:55.888Z",
      "x_nadsec_last_seen": "2026-03-21T23:54:24.404Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-22T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e91110c1-47b5-426b-ba82-731109a8dcff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:05:03.000Z",
      "valid_until": "2026-04-23T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T23:31:50.557Z",
      "x_nadsec_last_seen": "2026-03-21T23:31:50.557Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-22T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b57a84c7-b815-4c90-add5-d9bc20735584",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:05:03.000Z",
      "valid_until": "2026-04-23T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T23:31:10.335Z",
      "x_nadsec_last_seen": "2026-03-21T23:31:10.335Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-22T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7a0ca15a-909f-462f-a47f-6c03bc5aeb7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T00:05:03.000Z",
      "valid_until": "2026-04-23T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-21T23:31:10.508Z",
      "x_nadsec_last_seen": "2026-03-21T23:31:10.508Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-22T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--3f162a48-7156-48b1-a632-1bf368f9d06e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.174.148.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:05:04.000Z",
      "valid_until": "2026-04-23T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T00:21:14.650Z",
      "x_nadsec_last_seen": "2026-03-22T00:23:21.095Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-22T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--1b4c831a-e1ec-430f-9cea-3a807a65b540",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.27.150.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:05:04.000Z",
      "valid_until": "2026-04-23T01:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-22T00:31:52.107Z",
      "x_nadsec_last_seen": "2026-03-22T00:33:57.901Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-22T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=RU; asn=12389; asn_org=Rostelecom; user(top)=**",
      "id": "indicator--c9865826-b781-46b2-b5f1-327509fea110",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.65.245.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:05:04.000Z",
      "valid_until": "2026-04-23T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T00:12:15.804Z",
      "x_nadsec_last_seen": "2026-03-22T00:12:17.249Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-22T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--4108158e-9447-4204-82de-6d01a925d97f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.205.239.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:05:04.000Z",
      "valid_until": "2026-04-23T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T00:55:34.273Z",
      "x_nadsec_last_seen": "2026-03-22T00:55:34.273Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-22T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--889d01bc-c7a5-4179-be83-7022715816be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:05:04.000Z",
      "valid_until": "2026-04-23T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T00:28:24.408Z",
      "x_nadsec_last_seen": "2026-03-22T00:28:24.700Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-22T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--362f8de0-9a1b-4482-88e2-502291374c6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.149.99.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:05:04.000Z",
      "valid_until": "2026-04-23T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T00:11:09.305Z",
      "x_nadsec_last_seen": "2026-03-22T00:14:39.267Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-22T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KG; asn=29061; asn_org=Cjsc Saima Telecom",
      "id": "indicator--a2bdd847-2076-4735-8f62-a95777353d6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.29.26.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:05:04.000Z",
      "valid_until": "2026-04-23T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T00:16:12.240Z",
      "x_nadsec_last_seen": "2026-03-22T00:18:19.115Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "29061"
      ],
      "x_nadsec_orgs": [
        "Cjsc Saima Telecom"
      ]
    },
    {
      "created": "2026-03-22T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4809; asn_org=China Telecom Next Generation Carrier Network",
      "id": "indicator--3ff3b9df-2f08-433f-8902-ab07b25a3135",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.167.78.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:05:04.000Z",
      "valid_until": "2026-04-23T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T00:39:13.357Z",
      "x_nadsec_last_seen": "2026-03-22T00:39:13.357Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4809"
      ],
      "x_nadsec_orgs": [
        "China Telecom Next Generation Carrier Network"
      ]
    },
    {
      "created": "2026-03-22T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--cec97e65-8ece-4c2b-8fd3-1028851bb0e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:05:04.000Z",
      "valid_until": "2026-04-23T01:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-22T00:46:36.333Z",
      "x_nadsec_last_seen": "2026-03-25T02:38:58.247Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-22T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=SC; asn=42624; asn_org=Global-Data System IT Corporation",
      "id": "indicator--8a71205f-a273-4754-83f7-28ecb4f59991",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '69.5.189.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:05:04.000Z",
      "valid_until": "2026-04-23T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T00:52:14.093Z",
      "x_nadsec_last_seen": "2026-03-22T00:52:14.093Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "42624"
      ],
      "x_nadsec_orgs": [
        "Global-Data System IT Corporation"
      ]
    },
    {
      "created": "2026-03-22T01:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--2e20e28a-9c92-4758-a4e4-eac8d68595e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T01:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:05:04.000Z",
      "valid_until": "2026-04-23T01:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-22T00:16:45.164Z",
      "x_nadsec_last_seen": "2026-03-27T10:04:51.030Z",
      "x_nadsec_ports": [
        "21",
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-22T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=28573; asn_org=Claro NXT Telecomunicacoes Ltda",
      "id": "indicator--af4440d5-1f02-415c-ba5c-c44077728985",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.181.5.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T02:05:02.000Z",
      "valid_until": "2026-04-23T02:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-22T01:22:23.914Z",
      "x_nadsec_last_seen": "2026-03-22T01:29:39.351Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28573"
      ],
      "x_nadsec_orgs": [
        "Claro NXT Telecomunicacoes Ltda"
      ]
    },
    {
      "created": "2026-03-22T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2d2a464d-ab91-413f-b5e5-15dbc08a3314",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T02:05:02.000Z",
      "valid_until": "2026-04-23T02:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-22T01:31:35.251Z",
      "x_nadsec_last_seen": "2026-03-22T01:31:35.906Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-22T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=33934; asn_org=Rostelecom",
      "id": "indicator--89947802-d6b3-4a7d-8ab6-3510a848ac73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.233.25.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T02:05:02.000Z",
      "valid_until": "2026-04-23T02:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-22T01:09:34.077Z",
      "x_nadsec_last_seen": "2026-03-22T14:54:18.147Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "33934"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-22T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=38713; asn_org=Broadband ISP, FTTH and Cable Service Provider",
      "id": "indicator--053ddf32-2e9e-42e9-9dbb-cb59f0b720b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.205.178.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T03:05:03.000Z",
      "valid_until": "2026-04-23T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T02:09:19.008Z",
      "x_nadsec_last_seen": "2026-03-22T02:11:25.119Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "38713"
      ],
      "x_nadsec_orgs": [
        "Broadband ISP, FTTH and Cable Service Provider"
      ]
    },
    {
      "created": "2026-03-22T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=201624; asn_org=ARANEA LLC",
      "id": "indicator--c3d6bb35-ee22-4c55-bc2c-0fb668790fa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.118.199.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T03:05:03.000Z",
      "valid_until": "2026-04-23T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T02:33:33.080Z",
      "x_nadsec_last_seen": "2026-03-22T02:35:39.776Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "201624"
      ],
      "x_nadsec_orgs": [
        "ARANEA LLC"
      ]
    },
    {
      "created": "2026-03-22T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--70687746-088c-4769-a69b-5d70cb92226c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.137.109.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T03:05:03.000Z",
      "valid_until": "2026-04-23T03:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-22T02:43:03.786Z",
      "x_nadsec_last_seen": "2026-03-31T08:33:32.898Z",
      "x_nadsec_ports": [
        "135",
        "445"
      ],
      "x_nadsec_services": [
        "epmapper",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-22T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T03:05:03.000Z",
      "valid_until": "2026-04-23T03:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-22T02:41:48.791Z",
      "x_nadsec_last_seen": "2026-03-31T03:54:29.811Z",
      "x_nadsec_ports": [
        "21",
        "135"
      ],
      "x_nadsec_services": [
        "ftpd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-22T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d1de4275-fa25-4bff-a718-97502f11a16d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T03:05:03.000Z",
      "valid_until": "2026-04-23T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T02:30:40.557Z",
      "x_nadsec_last_seen": "2026-03-22T02:30:40.557Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-22T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--dc19e10d-6d32-47e1-b8f0-e3306ad1d0bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.127.91.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T03:05:03.000Z",
      "valid_until": "2026-04-23T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T02:17:58.176Z",
      "x_nadsec_last_seen": "2026-03-22T02:20:05.778Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-22T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--e424c86c-5411-43d6-acd9-e422cdc42b70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.211.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T04:05:03.000Z",
      "valid_until": "2026-04-23T04:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-22T03:47:14.126Z",
      "x_nadsec_last_seen": "2026-03-22T03:47:46.577Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-22T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9a1848e9-e412-4a58-8b52-62ec68c13075",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T04:05:03.000Z",
      "valid_until": "2026-04-23T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T03:30:49.066Z",
      "x_nadsec_last_seen": "2026-03-22T03:30:49.066Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-22T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CL; asn=14117; asn_org=Telefonica del Sur S.A.",
      "id": "indicator--16f3aaf9-d233-4398-a747-a30123dbf281",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.121.12.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T04:05:03.000Z",
      "valid_until": "2026-04-23T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T04:02:27.349Z",
      "x_nadsec_last_seen": "2026-03-22T04:04:34.152Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "14117"
      ],
      "x_nadsec_orgs": [
        "Telefonica del Sur S.A."
      ]
    },
    {
      "created": "2026-03-22T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8d48bd37-a962-41fd-89d7-5ce020fbb87b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.102.92.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T04:05:03.000Z",
      "valid_until": "2026-04-23T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T03:55:29.162Z",
      "x_nadsec_last_seen": "2026-03-22T03:55:29.162Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-22T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--7a3e261b-ec71-4751-b3e5-fcfc11a3b518",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T04:05:03.000Z",
      "valid_until": "2026-04-23T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T03:42:17.393Z",
      "x_nadsec_last_seen": "2026-03-25T01:40:01.039Z",
      "x_nadsec_ports": [
        "81",
        "1723"
      ],
      "x_nadsec_services": [
        "httpd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-22T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--f97165fa-d4a2-4965-9109-ae98f2001817",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T04:05:03.000Z",
      "valid_until": "2026-04-23T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T03:41:41.973Z",
      "x_nadsec_last_seen": "2026-03-22T03:42:03.710Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-22T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--d7920f85-8b2e-475a-96ca-7a8e9c0ad125",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T04:05:03.000Z",
      "valid_until": "2026-04-23T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T03:41:50.708Z",
      "x_nadsec_last_seen": "2026-03-22T03:42:32.690Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-22T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=httpd; ports=81; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--9e01c6a5-4f51-44f7-827a-8cb302680a81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T04:05:03.000Z",
      "valid_until": "2026-04-23T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T03:41:42.715Z",
      "x_nadsec_last_seen": "2026-03-22T03:42:27.681Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-22T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--ca07831a-ebff-4518-acfa-9954d1e10360",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T04:05:03.000Z",
      "valid_until": "2026-04-23T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T03:36:39.994Z",
      "x_nadsec_last_seen": "2026-03-22T03:36:39.994Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-22T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=FR; asn=210644; asn_org=Aeza Group LLC",
      "id": "indicator--b43b791e-2e32-4190-91d5-79255d346e00",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.208.113.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T04:05:03.000Z",
      "valid_until": "2026-04-23T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T03:10:46.884Z",
      "x_nadsec_last_seen": "2026-03-22T03:10:46.884Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "210644"
      ],
      "x_nadsec_orgs": [
        "Aeza Group LLC"
      ]
    },
    {
      "created": "2026-03-22T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--949054bf-4ff1-4cfa-922b-e20185ca6b57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.245.151.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T04:05:03.000Z",
      "valid_until": "2026-04-23T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T03:35:59.139Z",
      "x_nadsec_last_seen": "2026-03-22T03:38:07.198Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CO; asn=262191; asn_org=LIBERTY NETWORKS DE COLOMBIA S.A.S",
      "id": "indicator--5d9dff7c-8d36-4dd1-9dac-4433c7acb147",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.131.217.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T05:05:03.000Z",
      "valid_until": "2026-04-23T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T04:42:10.376Z",
      "x_nadsec_last_seen": "2026-03-22T04:42:10.431Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "262191"
      ],
      "x_nadsec_orgs": [
        "LIBERTY NETWORKS DE COLOMBIA S.A.S"
      ]
    },
    {
      "created": "2026-03-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b4e11170-7a01-4df6-bd3f-130ce09744b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.241.149.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T05:05:03.000Z",
      "valid_until": "2026-04-23T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T04:29:07.761Z",
      "x_nadsec_last_seen": "2026-03-22T04:29:07.761Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e44ba671-8e20-4856-983f-6fb416831236",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T05:05:03.000Z",
      "valid_until": "2026-04-23T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T04:11:22.482Z",
      "x_nadsec_last_seen": "2026-03-22T04:11:22.482Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--b20700c5-6615-47af-8918-2033e885f58e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.132.27.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T05:05:03.000Z",
      "valid_until": "2026-04-23T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T04:26:31.613Z",
      "x_nadsec_last_seen": "2026-03-22T04:28:45.555Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--bf4a1301-79a3-47e4-b2c7-1603c06e215e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.26.232.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T05:05:03.000Z",
      "valid_until": "2026-04-23T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T04:32:45.730Z",
      "x_nadsec_last_seen": "2026-03-22T04:34:52.701Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-22T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=209863; asn_org=PROLVL Ltd.",
      "id": "indicator--633ba613-4a8c-48c3-ad19-dfd1b4a61f91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.170.78.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T05:05:03.000Z",
      "valid_until": "2026-04-23T05:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-13T07:32:57.642Z",
      "x_nadsec_last_seen": "2026-03-22T04:51:46.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "209863"
      ],
      "x_nadsec_orgs": [
        "PROLVL Ltd."
      ]
    },
    {
      "created": "2026-03-22T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--5ef8438f-309d-4629-ad1f-f6cdb085c0d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.147.20.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T06:05:03.000Z",
      "valid_until": "2026-04-23T06:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T05:48:00.122Z",
      "x_nadsec_last_seen": "2026-03-22T05:50:05.412Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-22T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--0a0f090b-f676-4c7b-a214-0620e45c28dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.77.45.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T06:05:03.000Z",
      "valid_until": "2026-04-23T06:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T05:19:29.907Z",
      "x_nadsec_last_seen": "2026-03-22T05:19:29.907Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-22T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3ed94e72-0d58-47d8-ae39-1d24cf96fcc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.59.97.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T06:05:03.000Z",
      "valid_until": "2026-04-23T06:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T05:25:08.915Z",
      "x_nadsec_last_seen": "2026-03-22T05:25:08.915Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-22T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=mssqld; ports=1433; cc=KR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--11e3e12d-4dfa-4919-a7cb-64188b29b465",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.139.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T06:05:03.000Z",
      "valid_until": "2026-04-23T06:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-22T06:02:38.424Z",
      "x_nadsec_last_seen": "2026-03-22T06:03:35.953Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-22T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37693; asn_org=TUNISIANA",
      "id": "indicator--7099a337-5598-48fa-a5b7-c698e3a382fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.14.51.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T06:05:03.000Z",
      "valid_until": "2026-04-23T06:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T05:37:12.427Z",
      "x_nadsec_last_seen": "2026-03-22T05:39:18.737Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37693"
      ],
      "x_nadsec_orgs": [
        "TUNISIANA"
      ]
    },
    {
      "created": "2026-03-22T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--0049f615-f877-4afd-afaa-4d7522e162c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.79.136.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T06:05:03.000Z",
      "valid_until": "2026-04-23T06:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-22T05:42:11.630Z",
      "x_nadsec_last_seen": "2026-03-22T05:48:54.161Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-22T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5285c58d-b092-4d2b-869a-0bd1c7c1c6ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.81.9.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T06:05:03.000Z",
      "valid_until": "2026-04-23T06:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T05:19:31.457Z",
      "x_nadsec_last_seen": "2026-03-22T05:19:31.457Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-22T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=50187; asn_org=BaikalWestCom",
      "id": "indicator--c8896f87-5745-457d-9ad1-ae5718fee0c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.67.31.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T06:05:03.000Z",
      "valid_until": "2026-04-23T06:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-22T05:34:26.804Z",
      "x_nadsec_last_seen": "2026-03-23T07:12:24.232Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50187"
      ],
      "x_nadsec_orgs": [
        "BaikalWestCom"
      ]
    },
    {
      "created": "2026-03-22T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f5a06fcc-bba3-4b3d-a529-d4720a9c6fab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T06:05:03.000Z",
      "valid_until": "2026-04-23T06:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T05:34:47.294Z",
      "x_nadsec_last_seen": "2026-03-26T08:36:28.003Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-22T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135780; asn_org=AirFiber Networks Pvt Ltd",
      "id": "indicator--325fddc7-011f-49ee-aa15-c130bb02207e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.176.167.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:05:03.000Z",
      "valid_until": "2026-04-23T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T06:14:03.473Z",
      "x_nadsec_last_seen": "2026-03-22T06:16:08.006Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135780"
      ],
      "x_nadsec_orgs": [
        "AirFiber Networks Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-22T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=HK; asn=132883; asn_org=TOPWAY GLOBAL LIMITED",
      "id": "indicator--dafe0464-c7ce-4d58-8d55-e073a4d1a80f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.27.109.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:05:03.000Z",
      "valid_until": "2026-04-23T07:05:01.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-22T07:01:53.879Z",
      "x_nadsec_last_seen": "2026-03-30T02:11:40.742Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "132883"
      ],
      "x_nadsec_orgs": [
        "TOPWAY GLOBAL LIMITED"
      ]
    },
    {
      "created": "2026-03-22T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--da3447a2-14fa-4232-98a8-54e69f69c0b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.199.238.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:05:03.000Z",
      "valid_until": "2026-04-23T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T06:59:45.520Z",
      "x_nadsec_last_seen": "2026-03-22T06:59:45.520Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-22T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fabb36bc-93cf-43ff-975e-7419f9f5a17e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.233.112.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:05:03.000Z",
      "valid_until": "2026-04-23T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T06:19:44.409Z",
      "x_nadsec_last_seen": "2026-03-22T06:19:44.409Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-22T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--40763366-70bb-4c51-a48a-c34eaa98dae1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.175.37.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:05:03.000Z",
      "valid_until": "2026-04-23T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T07:02:51.922Z",
      "x_nadsec_last_seen": "2026-03-22T07:04:58.260Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-22T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0a41d434-f23a-4046-a897-0f7ed805d9f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:05:03.000Z",
      "valid_until": "2026-04-23T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T06:54:38.920Z",
      "x_nadsec_last_seen": "2026-03-22T17:18:03.494Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-22T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=40021; asn_org=Contabo Inc.",
      "id": "indicator--e36b21c5-7a3b-4b3d-abba-284b510f9484",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.93.141.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:05:03.000Z",
      "valid_until": "2026-04-23T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T06:15:00.733Z",
      "x_nadsec_last_seen": "2026-03-22T06:15:05.815Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "40021"
      ],
      "x_nadsec_orgs": [
        "Contabo Inc."
      ]
    },
    {
      "created": "2026-03-22T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3462b620-a325-4579-b51d-38ca5b68f17e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.42.84.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:05:03.000Z",
      "valid_until": "2026-04-23T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T06:16:00.477Z",
      "x_nadsec_last_seen": "2026-03-22T06:16:00.549Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-22T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=26827; asn_org=EPB Fiber Optics",
      "id": "indicator--46e3af23-6b4c-4d28-bfe3-9f36a63faa04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.18.51.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:05:03.000Z",
      "valid_until": "2026-04-23T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T06:48:03.585Z",
      "x_nadsec_last_seen": "2026-03-22T06:50:09.492Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "26827"
      ],
      "x_nadsec_orgs": [
        "EPB Fiber Optics"
      ]
    },
    {
      "created": "2026-03-22T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=UA; asn=34187; asn_org=LLC Renome-Service",
      "id": "indicator--1aafc808-9da1-42ac-bd2f-8d2e40ad0e42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.26.151.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:05:03.000Z",
      "valid_until": "2026-04-23T07:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-22T06:43:34.280Z",
      "x_nadsec_last_seen": "2026-03-22T07:48:41.415Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "34187"
      ],
      "x_nadsec_orgs": [
        "LLC Renome-Service"
      ]
    },
    {
      "created": "2026-03-22T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5ccfc3ea-8b68-4de8-93f4-550d9d1a829f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:05:03.000Z",
      "valid_until": "2026-04-23T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T06:30:53.057Z",
      "x_nadsec_last_seen": "2026-03-22T06:30:53.057Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-22T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--468230a8-b0e8-4d72-9d14-8c2853f5ae88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:05:03.000Z",
      "valid_until": "2026-04-23T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T06:30:42.727Z",
      "x_nadsec_last_seen": "2026-03-22T06:30:42.727Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-22T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=PK; asn=151330; asn_org=PLAY BROADBAND PRIVATE LIMITED",
      "id": "indicator--158531ed-9619-477e-90e1-66127158bf07",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.152.100.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:05:04.000Z",
      "valid_until": "2026-04-23T08:05:01.000Z",
      "x_nadsec_event_count": 3145,
      "x_nadsec_first_seen": "2026-03-22T07:46:33.536Z",
      "x_nadsec_last_seen": "2026-03-22T14:17:43.967Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "151330"
      ],
      "x_nadsec_orgs": [
        "PLAY BROADBAND PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-22T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=TG; asn=24691; asn_org=TOGOTEL-AS TogoTelecom, Togo; user(top)=**",
      "id": "indicator--f64b6857-59ec-4ea4-a450-60b7d1a4f04f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.242.192.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:05:04.000Z",
      "valid_until": "2026-04-23T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T07:52:31.860Z",
      "x_nadsec_last_seen": "2026-03-22T07:52:33.374Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TG"
      ],
      "x_nadsec_asns": [
        "24691"
      ],
      "x_nadsec_orgs": [
        "TOGOTEL-AS TogoTelecom, Togo"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-22T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7508e95f-f80a-4d10-8f23-c31a2a16eecd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:05:04.000Z",
      "valid_until": "2026-04-23T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T07:16:41.120Z",
      "x_nadsec_last_seen": "2026-03-22T07:16:41.120Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-22T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--3828d96f-95cf-4adc-acf8-bd4c4a77df6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.33.44.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:05:04.000Z",
      "valid_until": "2026-04-23T08:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-22T07:11:53.079Z",
      "x_nadsec_last_seen": "2026-03-22T07:23:37.060Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-22T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=SG; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--c6938fb3-1578-4159-8909-59dc4df77689",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.255.129.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:05:04.000Z",
      "valid_until": "2026-04-23T08:05:01.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-03-22T07:22:23.852Z",
      "x_nadsec_last_seen": "2026-03-22T07:26:53.547Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-22T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:05:04.000Z",
      "valid_until": "2026-04-23T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T00:34:54.279Z",
      "x_nadsec_last_seen": "2026-03-26T13:54:44.855Z",
      "x_nadsec_ports": [
        "1883",
        "135"
      ],
      "x_nadsec_services": [
        "mqttd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-22T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--88a3c04a-4bfb-4335-9a5e-04768294b846",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.148.255.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:05:04.000Z",
      "valid_until": "2026-04-23T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T07:36:05.190Z",
      "x_nadsec_last_seen": "2026-03-22T07:36:05.190Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-03-22T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--76c5992b-4aab-4ad6-ad10-60fbe8b214d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:05:04.000Z",
      "valid_until": "2026-04-23T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T07:22:52.085Z",
      "x_nadsec_last_seen": "2026-03-22T07:22:52.085Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-22T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7f4cbc6e-6665-4c22-9c0e-d4e701e01200",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:05:04.000Z",
      "valid_until": "2026-04-23T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T07:22:52.384Z",
      "x_nadsec_last_seen": "2026-03-22T07:22:52.384Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-22T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--dd8df2d5-77b2-44db-be8d-d754bd3c1cf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.201.38.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:05:03.000Z",
      "valid_until": "2026-04-23T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T08:56:59.376Z",
      "x_nadsec_last_seen": "2026-03-22T08:56:59.376Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-03-22T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fc5db8f4-1799-49c0-8656-66591f3b814e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.199.224.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:05:03.000Z",
      "valid_until": "2026-04-23T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T09:03:12.588Z",
      "x_nadsec_last_seen": "2026-03-22T09:03:12.588Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-22T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--be50ca16-c407-4642-a89f-9128f7ee4be1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:05:03.000Z",
      "valid_until": "2026-04-23T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T08:13:28.577Z",
      "x_nadsec_last_seen": "2026-03-22T08:13:28.577Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-22T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CG; asn=37463; asn_org=MTN-CONGO",
      "id": "indicator--03b98991-e9bf-4f35-8db0-acbe8f310415",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '169.255.122.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:05:03.000Z",
      "valid_until": "2026-04-23T09:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-22T08:34:03.627Z",
      "x_nadsec_last_seen": "2026-03-22T08:36:08.951Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CG"
      ],
      "x_nadsec_asns": [
        "37463"
      ],
      "x_nadsec_orgs": [
        "MTN-CONGO"
      ]
    },
    {
      "created": "2026-03-22T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--cc08972b-addf-4820-95d3-5f97c0c709a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.82.97.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:05:03.000Z",
      "valid_until": "2026-04-23T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T08:35:40.584Z",
      "x_nadsec_last_seen": "2026-03-22T08:37:45.905Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-22T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mqttd; ports=1883; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--5b10eeef-ca17-49cd-be39-2598a1f97fbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.155.90.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:05:03.000Z",
      "valid_until": "2026-04-23T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T08:07:46.245Z",
      "x_nadsec_last_seen": "2026-03-22T08:07:46.645Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-22T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CG; asn=37550; asn_org=airtelcg",
      "id": "indicator--0e4ac8fc-c3ad-4b13-bd20-575c96e667d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.214.251.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:05:03.000Z",
      "valid_until": "2026-04-23T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T08:36:11.166Z",
      "x_nadsec_last_seen": "2026-03-22T08:36:11.166Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CG"
      ],
      "x_nadsec_asns": [
        "37550"
      ],
      "x_nadsec_orgs": [
        "airtelcg"
      ]
    },
    {
      "created": "2026-03-22T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--434b0670-e0f8-47bc-bb69-e033e9d1e175",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:05:03.000Z",
      "valid_until": "2026-04-23T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T08:45:00.926Z",
      "x_nadsec_last_seen": "2026-03-22T08:45:11.085Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-22T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--1c861f64-cc95-498c-9e02-fe6dd51bba87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.136.176.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:05:03.000Z",
      "valid_until": "2026-04-23T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T08:12:22.775Z",
      "x_nadsec_last_seen": "2026-03-22T08:15:56.292Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-03-22T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8d6cb90a-561e-4dad-873a-6b7ef768d103",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:05:03.000Z",
      "valid_until": "2026-04-23T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T08:33:31.656Z",
      "x_nadsec_last_seen": "2026-03-22T08:33:32.091Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-22T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=KZ; asn=43873; asn_org=Bazovaya Set LLP; user(top)=**",
      "id": "indicator--5624d1bb-cf2a-42c4-9cfd-08f73d505765",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.140.232.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:05:03.000Z",
      "valid_until": "2026-04-23T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T08:27:29.880Z",
      "x_nadsec_last_seen": "2026-03-22T08:27:29.880Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "43873"
      ],
      "x_nadsec_orgs": [
        "Bazovaya Set LLP"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-22T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--8151a4aa-f311-48a9-926a-2aa3eef85eee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.4.121.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:05:03.000Z",
      "valid_until": "2026-04-23T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T09:38:59.732Z",
      "x_nadsec_last_seen": "2026-03-22T09:41:04.561Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-22T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d9617e34-5827-44f4-8aa1-75cead576862",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:05:03.000Z",
      "valid_until": "2026-04-23T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T09:34:05.753Z",
      "x_nadsec_last_seen": "2026-03-22T09:34:05.753Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-22T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--5857a75f-3118-4f2a-a53c-86668fe0c4b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.5.167.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:05:03.000Z",
      "valid_until": "2026-04-23T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T09:18:47.674Z",
      "x_nadsec_last_seen": "2026-03-22T09:20:52.177Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-22T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=37148; asn_org=globacom-as",
      "id": "indicator--4a515adc-7d11-452f-9e9b-0e48d350490d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.211.59.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:05:03.000Z",
      "valid_until": "2026-04-23T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T09:52:08.117Z",
      "x_nadsec_last_seen": "2026-03-22T09:54:24.182Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "37148"
      ],
      "x_nadsec_orgs": [
        "globacom-as"
      ]
    },
    {
      "created": "2026-03-22T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=49718; asn_org=Nizhnevolzhskie Telecommunication Networks Real LLC",
      "id": "indicator--dd0671dd-6966-4a79-866c-d1ae4b671ff5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.108.174.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:05:03.000Z",
      "valid_until": "2026-04-23T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T09:53:53.513Z",
      "x_nadsec_last_seen": "2026-03-22T09:53:53.548Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "49718"
      ],
      "x_nadsec_orgs": [
        "Nizhnevolzhskie Telecommunication Networks Real LLC"
      ]
    },
    {
      "created": "2026-03-22T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--ba84a898-f6e3-4066-aa48-4ae1fe351fb0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.132.37.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:05:03.000Z",
      "valid_until": "2026-04-23T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T09:32:52.765Z",
      "x_nadsec_last_seen": "2026-03-22T09:34:57.458Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-22T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--24ed83da-f670-4036-982d-ee370734be98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:05:03.000Z",
      "valid_until": "2026-04-23T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T09:46:35.118Z",
      "x_nadsec_last_seen": "2026-03-22T09:46:35.118Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-22T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=267214; asn_org=CLICKPLAY PROVEDOR DE ACESSO LTDA - ME",
      "id": "indicator--847afd42-e46c-4ed8-9c42-26fc96c780f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.230.161.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:05:03.000Z",
      "valid_until": "2026-04-23T10:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-22T09:44:30.518Z",
      "x_nadsec_last_seen": "2026-03-26T00:45:54.181Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "267214"
      ],
      "x_nadsec_orgs": [
        "CLICKPLAY PROVEDOR DE ACESSO LTDA - ME"
      ]
    },
    {
      "created": "2026-03-22T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--27e07d84-342d-4f27-8832-38f3ffd8cec6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:05:03.000Z",
      "valid_until": "2026-04-23T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T09:36:02.934Z",
      "x_nadsec_last_seen": "2026-03-22T09:36:02.934Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-22T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--29c6ed06-b3c6-4846-bbaf-eacc53b42361",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.181.180.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:05:03.000Z",
      "valid_until": "2026-04-23T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T09:39:31.542Z",
      "x_nadsec_last_seen": "2026-03-22T09:41:39.128Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-03-22T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AZ; asn=8814; asn_org=Aztelekom LLC; user(top)=**",
      "id": "indicator--198fbb68-e263-4aba-9982-41fcc994b4cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.69.58.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:05:03.000Z",
      "valid_until": "2026-04-23T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T09:43:07.834Z",
      "x_nadsec_last_seen": "2026-03-22T09:43:07.834Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "8814"
      ],
      "x_nadsec_orgs": [
        "Aztelekom LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-22T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=9583; asn_org=Sify Limited",
      "id": "indicator--f827acf2-e0b6-4f72-9c69-9bf3e03ad8a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.6.224.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T11:05:03.000Z",
      "valid_until": "2026-04-23T11:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T10:35:15.290Z",
      "x_nadsec_last_seen": "2026-03-22T10:35:15.461Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9583"
      ],
      "x_nadsec_orgs": [
        "Sify Limited"
      ]
    },
    {
      "created": "2026-03-22T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=HK; asn=132883; asn_org=TOPWAY GLOBAL LIMITED; user(top)=**; pass(top)=1****6",
      "id": "indicator--042c07c1-734a-4d03-8b17-e2ffe654fa38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.27.108.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T11:05:03.000Z",
      "valid_until": "2026-04-23T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T10:20:14.305Z",
      "x_nadsec_last_seen": "2026-03-30T22:51:31.240Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "132883"
      ],
      "x_nadsec_orgs": [
        "TOPWAY GLOBAL LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-03-22T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9e1b3628-a8c3-40b6-896a-0620264db1ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T11:05:03.000Z",
      "valid_until": "2026-04-23T11:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T10:56:01.166Z",
      "x_nadsec_last_seen": "2026-03-22T10:56:01.551Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-22T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CL; asn=16629; asn_org=CTC. CORP S.A. TELEFONICA EMPRESAS",
      "id": "indicator--10669b83-ec11-4068-af6b-bca494f21f50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.54.102.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T11:05:03.000Z",
      "valid_until": "2026-04-23T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T11:02:33.013Z",
      "x_nadsec_last_seen": "2026-03-22T11:04:40.285Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "16629"
      ],
      "x_nadsec_orgs": [
        "CTC. CORP S.A. TELEFONICA EMPRESAS"
      ]
    },
    {
      "created": "2026-03-22T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--5ff21e6a-52d6-4748-82ea-bf56a5ad5f99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.61.129.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T11:05:03.000Z",
      "valid_until": "2026-04-23T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T10:49:54.798Z",
      "x_nadsec_last_seen": "2026-03-22T10:51:59.473Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-03-22T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--301a197d-04fc-4522-b12a-615f0d910271",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T11:05:03.000Z",
      "valid_until": "2026-04-23T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T10:33:21.419Z",
      "x_nadsec_last_seen": "2026-03-22T10:33:21.419Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-22T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--8c06ea27-5fae-4a80-8f15-2e2acc40bdf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.16.30.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:05:02.000Z",
      "valid_until": "2026-04-23T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T11:33:03.381Z",
      "x_nadsec_last_seen": "2026-03-22T11:35:08.104Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-22T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b0ade785-344b-424f-9d5e-d1ded8521103",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.160.26.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:05:02.000Z",
      "valid_until": "2026-04-23T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T11:57:05.371Z",
      "x_nadsec_last_seen": "2026-03-22T11:57:10.088Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-22T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:05:02.000Z",
      "valid_until": "2026-04-23T12:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-22T11:59:01.443Z",
      "x_nadsec_last_seen": "2026-03-31T13:17:56.693Z",
      "x_nadsec_ports": [
        "1723",
        "1883",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mqttd",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-22T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28220; asn_org=Alares Cabo Servicos de Telecomunicacoes S.A.",
      "id": "indicator--9114b2e7-c9dc-4eb5-a856-445c919b3157",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.124.135.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:05:02.000Z",
      "valid_until": "2026-04-23T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T11:27:41.964Z",
      "x_nadsec_last_seen": "2026-03-22T11:29:48.068Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28220"
      ],
      "x_nadsec_orgs": [
        "Alares Cabo Servicos de Telecomunicacoes S.A."
      ]
    },
    {
      "created": "2026-03-22T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--a748fb2a-4226-454d-8aea-26864112328c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.23.161.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:05:02.000Z",
      "valid_until": "2026-04-23T12:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-22T11:19:20.936Z",
      "x_nadsec_last_seen": "2026-03-22T11:26:17.642Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-22T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AM; asn=50635; asn_org=Skynet Telecom LLC",
      "id": "indicator--4eb028e4-e044-4345-a873-e05d2ee74cc8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.113.10.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:05:02.000Z",
      "valid_until": "2026-04-23T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T12:03:10.803Z",
      "x_nadsec_last_seen": "2026-03-22T12:05:18.047Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "50635"
      ],
      "x_nadsec_orgs": [
        "Skynet Telecom LLC"
      ]
    },
    {
      "created": "2026-03-22T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=56568; asn_org=X-communication Llp",
      "id": "indicator--7f163fed-1065-43e2-acde-77fe2cbb7ba0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.46.97.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:05:02.000Z",
      "valid_until": "2026-04-23T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T11:26:06.527Z",
      "x_nadsec_last_seen": "2026-03-22T11:26:15.014Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "56568"
      ],
      "x_nadsec_orgs": [
        "X-communication Llp"
      ]
    },
    {
      "created": "2026-03-22T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SC; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--07243cf2-0793-4c7b-baed-4152f2fe4e80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.61.209.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:05:02.000Z",
      "valid_until": "2026-04-23T12:05:00.000Z",
      "x_nadsec_event_count": 19,
      "x_nadsec_first_seen": "2026-03-22T11:41:22.643Z",
      "x_nadsec_last_seen": "2026-03-31T10:44:03.093Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-03-22T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=57128; asn_org=JSC Ufanet",
      "id": "indicator--f7b8ac1d-5a21-4a22-9988-218a0abd1ed9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '84.39.247.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T12:05:02.000Z",
      "valid_until": "2026-04-23T12:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-22T11:42:19.388Z",
      "x_nadsec_last_seen": "2026-03-22T11:47:48.704Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57128"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-03-22T13:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--861ff1e3-56f2-4780-93ed-038e6980407a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T13:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.91.92.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:05:32.000Z",
      "valid_until": "2026-04-23T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T12:43:40.724Z",
      "x_nadsec_last_seen": "2026-03-22T12:45:48.157Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-22T13:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--f71198fe-8c56-4461-974b-dbf8205e321d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T13:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.23.110.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:05:32.000Z",
      "valid_until": "2026-04-23T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T12:36:23.855Z",
      "x_nadsec_last_seen": "2026-03-22T12:38:31.292Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-22T13:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--a83a0439-eb65-4e73-99e5-33f4af2ba49f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T13:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.165.59.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:05:32.000Z",
      "valid_until": "2026-04-23T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T12:22:57.779Z",
      "x_nadsec_last_seen": "2026-03-22T12:25:03.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-03-22T13:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d319f6d4-058b-43df-b8f5-7ba253d4990b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T13:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '67.205.137.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:05:32.000Z",
      "valid_until": "2026-04-23T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T12:21:18.157Z",
      "x_nadsec_last_seen": "2026-03-22T12:21:21.449Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-22T13:05:32.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=CA; asn=12989; asn_org=Black HOST Ltd",
      "id": "indicator--c8d7f83e-5f8d-42ba-99ed-cdb3b5ded5c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T13:05:32.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:05:32.000Z",
      "valid_until": "2026-04-23T13:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-22T12:38:15.188Z",
      "x_nadsec_last_seen": "2026-03-29T14:47:40.208Z",
      "x_nadsec_ports": [
        "1433",
        "135"
      ],
      "x_nadsec_services": [
        "mssqld",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "12989"
      ],
      "x_nadsec_orgs": [
        "Black HOST Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-22T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--303e6e8f-c086-4fbf-8042-acae685db941",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.20.3.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T15:05:02.000Z",
      "valid_until": "2026-04-23T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-13T08:28:40.738Z",
      "x_nadsec_last_seen": "2026-03-22T14:27:40.921Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-22T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=61889; asn_org=BR.Digital Telecom",
      "id": "indicator--8d79a158-db27-4057-9e4d-23d2458a3adc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.195.226.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T15:05:02.000Z",
      "valid_until": "2026-04-23T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T14:23:14.855Z",
      "x_nadsec_last_seen": "2026-03-22T14:27:38.012Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "61889"
      ],
      "x_nadsec_orgs": [
        "BR.Digital Telecom"
      ]
    },
    {
      "created": "2026-03-22T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--8e9d20ec-e251-45a9-8a9c-d0b67a5112b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.206.222.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T15:05:02.000Z",
      "valid_until": "2026-04-23T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T14:32:21.261Z",
      "x_nadsec_last_seen": "2026-03-22T14:32:25.762Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-22T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1d5ab50a-eab7-4a01-bcbe-3ec36f0d7250",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.77.239.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T15:05:02.000Z",
      "valid_until": "2026-04-23T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T14:04:40.676Z",
      "x_nadsec_last_seen": "2026-03-22T14:06:46.011Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-22T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--58380ad3-990b-4ef7-8040-db18613ff1df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.163.158.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T15:05:02.000Z",
      "valid_until": "2026-04-23T15:05:01.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-22T14:58:28.091Z",
      "x_nadsec_last_seen": "2026-03-22T14:58:48.406Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "0**3"
      ]
    },
    {
      "created": "2026-03-22T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T15:05:02.000Z",
      "valid_until": "2026-04-23T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T14:14:04.909Z",
      "x_nadsec_last_seen": "2026-03-28T13:44:07.188Z",
      "x_nadsec_ports": [
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-22T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=206026; asn_org=Kar-Tel LLC",
      "id": "indicator--e59f510b-fe26-4319-8c74-d2e41dd9c182",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.82.117.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T15:05:02.000Z",
      "valid_until": "2026-04-23T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T14:50:30.578Z",
      "x_nadsec_last_seen": "2026-03-22T14:52:38.154Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "206026"
      ],
      "x_nadsec_orgs": [
        "Kar-Tel LLC"
      ]
    },
    {
      "created": "2026-03-22T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=24173; asn_org=Netnam Company",
      "id": "indicator--ba025811-759b-478b-a6dd-7634fc5fcd65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.96.114.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:05:02.000Z",
      "valid_until": "2026-04-23T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T15:35:31.628Z",
      "x_nadsec_last_seen": "2026-03-22T18:00:04.925Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24173"
      ],
      "x_nadsec_orgs": [
        "Netnam Company"
      ]
    },
    {
      "created": "2026-03-22T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45609; asn_org=Bharti Airtel Ltd. AS for GPRS Service",
      "id": "indicator--586e039b-0cbc-4549-b6c4-a3481cf654fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.195.109.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:05:02.000Z",
      "valid_until": "2026-04-23T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T15:54:51.763Z",
      "x_nadsec_last_seen": "2026-03-22T15:56:56.958Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45609"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd. AS for GPRS Service"
      ]
    },
    {
      "created": "2026-03-22T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=KR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f363d783-a3b4-4c6a-88af-9d9ae232d031",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.193.69.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:05:02.000Z",
      "valid_until": "2026-04-23T16:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-22T15:20:40.751Z",
      "x_nadsec_last_seen": "2026-03-22T15:21:01.667Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-22T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=135097; asn_org=LUOGELANG FRANCE LIMITED",
      "id": "indicator--617f859a-a521-499f-8112-c8412cf17d8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.224.139.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:05:02.000Z",
      "valid_until": "2026-04-23T16:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-13T07:33:20.566Z",
      "x_nadsec_last_seen": "2026-03-22T15:35:40.249Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135097"
      ],
      "x_nadsec_orgs": [
        "LUOGELANG FRANCE LIMITED"
      ]
    },
    {
      "created": "2026-03-22T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--678649ff-6223-4a6b-8ab8-1958b48017b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.190.2.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:05:02.000Z",
      "valid_until": "2026-04-23T16:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-22T15:49:51.914Z",
      "x_nadsec_last_seen": "2026-03-22T20:35:56.796Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=smbd; ports=445; cc=PK; asn=24435; asn_org=Supernet Limited Transit Autonomous System Number",
      "id": "indicator--a404e100-f078-4909-a9b2-09e26881a7ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.27.22.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T17:05:03.000Z",
      "valid_until": "2026-04-23T17:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-22T16:53:32.314Z",
      "x_nadsec_last_seen": "2026-03-22T16:57:57.671Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "24435"
      ],
      "x_nadsec_orgs": [
        "Supernet Limited Transit Autonomous System Number"
      ]
    },
    {
      "created": "2026-03-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--76d32724-83ef-4d68-85b8-95d1c7866946",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.246.231.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T17:05:03.000Z",
      "valid_until": "2026-04-23T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T16:32:11.795Z",
      "x_nadsec_last_seen": "2026-03-22T16:32:11.795Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=smbd; ports=445; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--1f34b5cf-a162-4576-b885-abc844c2fbdb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.235.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T17:05:03.000Z",
      "valid_until": "2026-04-23T17:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-22T16:27:01.239Z",
      "x_nadsec_last_seen": "2026-03-22T16:28:05.758Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--27d0d07b-efce-4d5f-9197-ed61a33d1509",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.248.159.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T17:05:03.000Z",
      "valid_until": "2026-04-23T17:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-22T16:25:03.289Z",
      "x_nadsec_last_seen": "2026-03-31T17:10:36.358Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-03-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d35036a6-8ee3-45a1-8e69-e95977175e92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.29.21.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T17:05:03.000Z",
      "valid_until": "2026-04-23T17:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-22T16:59:35.934Z",
      "x_nadsec_last_seen": "2026-03-30T21:40:24.040Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--89a035b6-b585-44a7-9b6d-006fe315cc72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.49.169.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T17:05:03.000Z",
      "valid_until": "2026-04-23T17:05:01.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-22T16:55:28.237Z",
      "x_nadsec_last_seen": "2026-03-22T16:58:43.595Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-22T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--47809d0d-a27d-40b5-ac10-f585f5a3ef3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.79.7.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T17:05:03.000Z",
      "valid_until": "2026-04-23T17:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-22T16:40:50.810Z",
      "x_nadsec_last_seen": "2026-03-30T20:26:27.877Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-03-22T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5ebab2e6-de34-4fa2-90d7-7b767497d328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.209.67.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:05:02.000Z",
      "valid_until": "2026-04-23T18:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-22T17:25:17.467Z",
      "x_nadsec_last_seen": "2026-03-23T05:28:32.807Z",
      "x_nadsec_ports": [
        "1883",
        "1433",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mongod",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-22T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--446dec01-9dee-4151-b9ca-0bd1cb49ad1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:05:02.000Z",
      "valid_until": "2026-04-23T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T17:38:47.881Z",
      "x_nadsec_last_seen": "2026-03-22T17:38:47.881Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-22T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b17c40d9-5365-40e6-93f9-bb6b7c481630",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.234.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:05:02.000Z",
      "valid_until": "2026-04-23T18:05:01.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-03-22T17:22:26.016Z",
      "x_nadsec_last_seen": "2026-03-22T17:25:14.108Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-22T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=35805; asn_org=JSC Silknet",
      "id": "indicator--93835160-2876-4504-a46e-0e2e334da0e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.146.179.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:05:02.000Z",
      "valid_until": "2026-04-23T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T17:06:45.347Z",
      "x_nadsec_last_seen": "2026-03-22T17:08:52.094Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "35805"
      ],
      "x_nadsec_orgs": [
        "JSC Silknet"
      ]
    },
    {
      "created": "2026-03-22T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c5919236-d97c-45b3-ae42-4f52ae483551",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:05:02.000Z",
      "valid_until": "2026-04-23T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T17:54:56.449Z",
      "x_nadsec_last_seen": "2026-03-22T17:55:06.608Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-22T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--3e58c6ca-89f7-4ff8-ac7b-c98c016e557c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.33.112.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:05:02.000Z",
      "valid_until": "2026-04-23T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T17:24:03.999Z",
      "x_nadsec_last_seen": "2026-03-22T17:24:03.999Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-22T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IT; asn=12850; asn_org=Retelit Digital Services S.p.A.",
      "id": "indicator--68f252f0-17be-445d-a309-03203504ab55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.247.73.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:05:02.000Z",
      "valid_until": "2026-04-23T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T18:02:37.261Z",
      "x_nadsec_last_seen": "2026-03-22T18:02:37.401Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12850"
      ],
      "x_nadsec_orgs": [
        "Retelit Digital Services S.p.A."
      ]
    },
    {
      "created": "2026-03-22T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--401926ca-dcd0-420c-ac22-c8e81741e17f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.53.3.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:05:02.000Z",
      "valid_until": "2026-04-23T18:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-22T18:00:57.810Z",
      "x_nadsec_last_seen": "2026-03-22T19:42:40.921Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-03-22T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--0658dd9e-1bd4-4053-95de-56a916788f86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.237.63.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:05:02.000Z",
      "valid_until": "2026-04-23T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T17:43:08.499Z",
      "x_nadsec_last_seen": "2026-03-22T17:45:15.257Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-22T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=35566; asn_org=Kar-Tel LLC",
      "id": "indicator--318f6c56-7c57-4445-b287-423becdd160c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.247.12.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:05:02.000Z",
      "valid_until": "2026-04-23T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T17:32:50.339Z",
      "x_nadsec_last_seen": "2026-03-22T17:34:57.281Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "35566"
      ],
      "x_nadsec_orgs": [
        "Kar-Tel LLC"
      ]
    },
    {
      "created": "2026-03-22T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--9f723794-98a4-4c92-a62e-88e321430ace",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.58.207.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T19:05:02.000Z",
      "valid_until": "2026-04-23T19:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-22T18:18:00.267Z",
      "x_nadsec_last_seen": "2026-03-22T18:18:23.385Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-22T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c5fc6822-3375-465c-bad6-e7d57b4e46a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.74.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T19:05:02.000Z",
      "valid_until": "2026-04-23T19:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T18:46:52.703Z",
      "x_nadsec_last_seen": "2026-03-22T18:47:02.844Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-22T19:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UZ; asn=8193; asn_org=Uzbektelekom Joint Stock Company",
      "id": "indicator--7b1e92fa-319d-4247-bf00-b2dc3747621c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T19:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.230.127.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T19:05:02.000Z",
      "valid_until": "2026-04-23T19:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T18:58:41.260Z",
      "x_nadsec_last_seen": "2026-03-22T19:00:46.703Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "8193"
      ],
      "x_nadsec_orgs": [
        "Uzbektelekom Joint Stock Company"
      ]
    },
    {
      "created": "2026-03-22T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=63199; asn_org=CDS Global Cloud Co., Ltd",
      "id": "indicator--460c5cc9-c807-47c9-ad2b-b849cb6196fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.153.56.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T20:05:03.000Z",
      "valid_until": "2026-04-23T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T19:51:56.176Z",
      "x_nadsec_last_seen": "2026-03-22T19:52:56.470Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63199"
      ],
      "x_nadsec_orgs": [
        "CDS Global Cloud Co., Ltd"
      ]
    },
    {
      "created": "2026-03-22T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=263396; asn_org=BK Telecomunicacoes LTDA",
      "id": "indicator--d45a4c58-5456-45ae-82ea-1a9113b6697f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.125.253.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T20:05:03.000Z",
      "valid_until": "2026-04-23T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T19:23:40.121Z",
      "x_nadsec_last_seen": "2026-03-22T19:25:46.394Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263396"
      ],
      "x_nadsec_orgs": [
        "BK Telecomunicacoes LTDA"
      ]
    },
    {
      "created": "2026-03-22T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=262851; asn_org=PLIM TELECOMUNICACOES LTDA-ME",
      "id": "indicator--397a401f-c34c-490d-a02e-5c18e8a216de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.242.126.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T20:05:03.000Z",
      "valid_until": "2026-04-23T20:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-22T19:23:05.893Z",
      "x_nadsec_last_seen": "2026-03-22T19:30:49.981Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262851"
      ],
      "x_nadsec_orgs": [
        "PLIM TELECOMUNICACOES LTDA-ME"
      ]
    },
    {
      "created": "2026-03-22T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--409b7e88-af8c-4075-8179-62492ba1b5b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.228.82.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T20:05:03.000Z",
      "valid_until": "2026-04-23T20:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-22T19:17:33.753Z",
      "x_nadsec_last_seen": "2026-03-22T19:25:18.071Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-03-22T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--2f2352f5-39a4-44fb-8402-818449665b25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.0.229.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T21:05:02.000Z",
      "valid_until": "2026-04-23T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T20:15:09.881Z",
      "x_nadsec_last_seen": "2026-03-22T20:17:14.612Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-22T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=28; services=smbd; ports=445; cc=ID; asn=9905; asn_org=Linknet ASN",
      "id": "indicator--865cf892-ae10-4755-b6b1-2c9dfc7b2ffe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.255.199.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T21:05:02.000Z",
      "valid_until": "2026-04-23T21:05:00.000Z",
      "x_nadsec_event_count": 47,
      "x_nadsec_first_seen": "2026-03-22T21:00:27.447Z",
      "x_nadsec_last_seen": "2026-03-22T21:04:50.584Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9905"
      ],
      "x_nadsec_orgs": [
        "Linknet ASN"
      ]
    },
    {
      "created": "2026-03-22T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--15387033-bb07-4aed-bf18-39b0054597cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T21:05:02.000Z",
      "valid_until": "2026-04-23T21:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T20:19:20.302Z",
      "x_nadsec_last_seen": "2026-03-22T20:19:20.302Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-22T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--943d2793-f4c3-47dd-bcc5-e9935d95e5ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.197.127.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T21:05:02.000Z",
      "valid_until": "2026-04-23T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T20:30:42.787Z",
      "x_nadsec_last_seen": "2026-03-22T20:32:49.769Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-22T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--00321099-af7d-4ff5-a15b-1a0208a9d736",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.34.246.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T21:05:02.000Z",
      "valid_until": "2026-04-23T21:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-22T21:00:41.515Z",
      "x_nadsec_last_seen": "2026-03-22T22:04:52.676Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-03-22T21:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=25; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--75ae9606-d947-4ebb-80f4-0c3a205826bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T21:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.191.247.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T21:05:02.000Z",
      "valid_until": "2026-04-23T21:05:00.000Z",
      "x_nadsec_event_count": 3128,
      "x_nadsec_first_seen": "2026-03-22T20:18:40.975Z",
      "x_nadsec_last_seen": "2026-03-23T22:43:00.857Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-22T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--946e95d7-f9b3-43b9-acc9-38ee8da4e55e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.51.226.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T22:05:02.000Z",
      "valid_until": "2026-04-23T22:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-22T21:08:01.940Z",
      "x_nadsec_last_seen": "2026-03-24T10:48:30.020Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-03-22T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=TM; asn=200593; asn_org=Prospero Ooo",
      "id": "indicator--7a4fc418-eedc-457e-bf5e-919b834b651d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.202.233.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T22:05:02.000Z",
      "valid_until": "2026-04-23T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T21:44:27.658Z",
      "x_nadsec_last_seen": "2026-03-22T21:44:27.658Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "TM"
      ],
      "x_nadsec_asns": [
        "200593"
      ],
      "x_nadsec_orgs": [
        "Prospero Ooo"
      ]
    },
    {
      "created": "2026-03-22T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--29db4b55-b44e-4747-b955-4c1e26d8a1b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '144.172.116.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:05:10.000Z",
      "valid_until": "2026-04-23T23:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-22T22:58:54.899Z",
      "x_nadsec_last_seen": "2026-03-22T23:05:05.654Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-03-22T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--14960a28-91cb-4642-a46a-11344338fb16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.82.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:05:10.000Z",
      "valid_until": "2026-04-23T23:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T22:17:26.618Z",
      "x_nadsec_last_seen": "2026-03-22T22:17:37.886Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-22T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--4a987030-a535-4a33-8224-1860ae2245d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.91.234.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:05:10.000Z",
      "valid_until": "2026-04-23T23:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-22T22:49:43.272Z",
      "x_nadsec_last_seen": "2026-03-22T22:56:48.511Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-22T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--9d34902a-5153-4077-80e9-b895d1e8eca9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.143.102.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:05:10.000Z",
      "valid_until": "2026-04-23T23:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T22:06:03.510Z",
      "x_nadsec_last_seen": "2026-03-22T22:06:09.659Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-03-22T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VE; asn=394684; asn_org=GOLD DATA USA INC",
      "id": "indicator--5410c856-bb8b-42d9-8ca2-86a97bbeaddb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.52.100.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:05:10.000Z",
      "valid_until": "2026-04-23T23:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-22T22:06:22.867Z",
      "x_nadsec_last_seen": "2026-03-22T22:11:15.225Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "394684"
      ],
      "x_nadsec_orgs": [
        "GOLD DATA USA INC"
      ]
    },
    {
      "created": "2026-03-22T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--f93f9315-b387-43bf-a9af-1a246fe05f8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:05:10.000Z",
      "valid_until": "2026-04-23T23:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T22:13:01.949Z",
      "x_nadsec_last_seen": "2026-03-22T22:13:01.949Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-22T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c63ac833-6f36-42de-b4e2-e92a2c70b3a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.201.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:05:10.000Z",
      "valid_until": "2026-04-23T23:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T22:09:57.758Z",
      "x_nadsec_last_seen": "2026-03-22T22:10:07.927Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-22T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--10a906ba-a63f-4ce3-b210-e5fdf5f98fba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.20.129.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:05:10.000Z",
      "valid_until": "2026-04-23T23:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-22T22:38:10.544Z",
      "x_nadsec_last_seen": "2026-03-22T22:38:55.440Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-22T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=267033; asn_org=serrasul telecom ltda",
      "id": "indicator--ecfa1d54-b0f1-4c11-8049-a0c173eff712",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.227.186.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:05:10.000Z",
      "valid_until": "2026-04-23T23:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-22T22:24:53.560Z",
      "x_nadsec_last_seen": "2026-03-22T22:32:37.674Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "267033"
      ],
      "x_nadsec_orgs": [
        "serrasul telecom ltda"
      ]
    },
    {
      "created": "2026-03-22T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--37aa5987-f497-4377-a4e9-52f3df383359",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.52.92.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:05:10.000Z",
      "valid_until": "2026-04-23T23:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T22:11:12.812Z",
      "x_nadsec_last_seen": "2026-03-22T22:13:21.286Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-22T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6864b9ee-54e4-448b-b19f-bb3fa17dc7f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.235.100.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:05:10.000Z",
      "valid_until": "2026-04-23T23:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T22:51:51.494Z",
      "x_nadsec_last_seen": "2026-03-22T22:52:01.883Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-22T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--b54be057-c1fe-4993-a49b-019a698dea4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.171.100.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:05:10.000Z",
      "valid_until": "2026-04-23T23:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-22T22:09:48.635Z",
      "x_nadsec_last_seen": "2026-03-22T22:17:17.843Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-22T23:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=47845; asn_org=Tiger-Telecom Ltd.",
      "id": "indicator--39915cbb-6cca-4de6-bee3-a6d0e318602a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-22T23:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.47.246.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:05:10.000Z",
      "valid_until": "2026-04-23T23:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-22T22:24:38.203Z",
      "x_nadsec_last_seen": "2026-03-22T22:32:34.663Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "47845"
      ],
      "x_nadsec_orgs": [
        "Tiger-Telecom Ltd."
      ]
    },
    {
      "created": "2026-03-23T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e3b8ad25-0046-479a-89fc-f40280b3a778",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:05:03.000Z",
      "valid_until": "2026-04-24T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-22T23:47:39.206Z",
      "x_nadsec_last_seen": "2026-03-22T23:47:39.206Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-23T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--edfc4b81-981f-4e1e-8127-19cc6dca0a1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.30.139.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:05:03.000Z",
      "valid_until": "2026-04-24T00:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-23T00:01:49.962Z",
      "x_nadsec_last_seen": "2026-03-23T00:36:57.519Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-23T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "id": "indicator--93611194-09c5-43fb-b156-6effa7adcc3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.200.184.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:05:03.000Z",
      "valid_until": "2026-04-24T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T23:47:22.535Z",
      "x_nadsec_last_seen": "2026-03-22T23:49:29.302Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ]
    },
    {
      "created": "2026-03-23T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--ffd88ad0-addf-4144-9bd1-7c5e826c0957",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.94.7.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:05:03.000Z",
      "valid_until": "2026-04-24T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T23:19:36.178Z",
      "x_nadsec_last_seen": "2026-03-22T23:21:43.443Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-23T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--e3c54216-51cd-4f4e-9823-3343e7e69501",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.96.125.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:05:03.000Z",
      "valid_until": "2026-04-24T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-22T23:58:49.340Z",
      "x_nadsec_last_seen": "2026-03-23T00:00:55.377Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-23T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.",
      "id": "indicator--f7993408-54ea-4751-ac4e-7260ca17aef3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.186.8.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:05:03.000Z",
      "valid_until": "2026-04-24T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-23T00:00:52.687Z",
      "x_nadsec_last_seen": "2026-03-23T00:07:33.468Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9269"
      ],
      "x_nadsec_orgs": [
        "Hong Kong Broadband Network Ltd."
      ]
    },
    {
      "created": "2026-03-23T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TR; asn=12735; asn_org=TurkNet Iletisim Hizmetleri A.S.",
      "id": "indicator--d971a37f-d44c-42b5-8b9d-2f549d063384",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.223.41.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:05:03.000Z",
      "valid_until": "2026-04-24T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T23:34:36.561Z",
      "x_nadsec_last_seen": "2026-03-22T23:34:36.674Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "12735"
      ],
      "x_nadsec_orgs": [
        "TurkNet Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-23T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--c2935550-a027-4ec4-94f5-eea90eec905b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.235.103.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:05:03.000Z",
      "valid_until": "2026-04-24T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T00:00:54.065Z",
      "x_nadsec_last_seen": "2026-03-23T00:02:58.779Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-23T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8b5b33cb-a955-40dc-aaf2-16876a3dcefd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:05:03.000Z",
      "valid_until": "2026-04-24T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-22T23:33:00.639Z",
      "x_nadsec_last_seen": "2026-03-23T03:31:36.885Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-23T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f6abde93-ed8e-411b-baf1-9956bab3aba3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.89.125.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:05:02.000Z",
      "valid_until": "2026-04-24T01:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T00:27:45.199Z",
      "x_nadsec_last_seen": "2026-03-23T00:27:45.199Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-23T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=271129; asn_org=Rt Comunicacoes LTDA",
      "id": "indicator--8812df52-8d69-4973-ad40-f988b7833ad3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.42.56.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:05:02.000Z",
      "valid_until": "2026-04-24T01:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T00:38:17.800Z",
      "x_nadsec_last_seen": "2026-03-23T00:40:22.803Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "271129"
      ],
      "x_nadsec_orgs": [
        "Rt Comunicacoes LTDA"
      ]
    },
    {
      "created": "2026-03-23T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--d7bc47c4-2a33-4e3f-a0bb-9f085c5ae4a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.198.62.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:05:02.000Z",
      "valid_until": "2026-04-24T01:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T01:01:16.784Z",
      "x_nadsec_last_seen": "2026-03-23T01:03:21.897Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-03-23T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--0551705c-3001-4c23-88d0-a99a9f7afb3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.231.255.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:05:02.000Z",
      "valid_until": "2026-04-24T01:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T01:01:46.281Z",
      "x_nadsec_last_seen": "2026-03-23T01:03:51.721Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-23T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=6306; asn_org=TELEFONICA VENEZOLANA, C.A.",
      "id": "indicator--07b6b110-3eca-4d19-87d8-77747bbf9901",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.35.94.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:05:02.000Z",
      "valid_until": "2026-04-24T01:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T00:52:13.459Z",
      "x_nadsec_last_seen": "2026-03-23T00:54:19.156Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "6306"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA VENEZOLANA, C.A."
      ]
    },
    {
      "created": "2026-03-23T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PH; asn=4775; asn_org=Globe Telecoms",
      "id": "indicator--fc5d39ee-a92e-4c60-8978-bef312d55842",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.177.99.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:05:02.000Z",
      "valid_until": "2026-04-24T01:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-23T00:28:45.777Z",
      "x_nadsec_last_seen": "2026-03-23T00:35:28.813Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "4775"
      ],
      "x_nadsec_orgs": [
        "Globe Telecoms"
      ]
    },
    {
      "created": "2026-03-23T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ES; asn=3262; asn_org=SAREnet, S.A.",
      "id": "indicator--a2f0fc74-a7a0-4bba-b051-98de09ff0574",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.81.212.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:05:02.000Z",
      "valid_until": "2026-04-24T01:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T00:56:11.624Z",
      "x_nadsec_last_seen": "2026-03-23T00:56:12.041Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3262"
      ],
      "x_nadsec_orgs": [
        "SAREnet, S.A."
      ]
    },
    {
      "created": "2026-03-23T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--0adf6614-10c7-4240-bb1a-ecd413073382",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.167.207.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:05:02.000Z",
      "valid_until": "2026-04-24T01:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T00:06:12.096Z",
      "x_nadsec_last_seen": "2026-03-23T00:07:29.301Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-23T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e8c2a11c-46ec-4cc1-8d3b-58018c61f615",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:05:02.000Z",
      "valid_until": "2026-04-24T01:05:00.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-03-23T00:56:40.706Z",
      "x_nadsec_last_seen": "2026-03-23T01:12:55.699Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-23T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--c79e3b78-8f61-433d-9902-0afcb3de3004",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.113.223.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:05:02.000Z",
      "valid_until": "2026-04-24T01:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-23T00:10:51.837Z",
      "x_nadsec_last_seen": "2026-03-23T00:17:40.749Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-23T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--d4953601-b317-486f-a4e6-009c3d5acc1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.86.179.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:05:02.000Z",
      "valid_until": "2026-04-24T01:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T00:55:28.467Z",
      "x_nadsec_last_seen": "2026-03-23T00:55:28.467Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-23T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--2bda168e-aea6-4247-9295-2d8d6f572d41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.147.8.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:05:02.000Z",
      "valid_until": "2026-04-24T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T01:44:25.594Z",
      "x_nadsec_last_seen": "2026-03-23T01:46:32.177Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-23T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--9f574f68-79a8-49d5-afed-86387179b7a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.26.165.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:05:02.000Z",
      "valid_until": "2026-04-24T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T01:32:48.156Z",
      "x_nadsec_last_seen": "2026-03-23T01:34:55.582Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-23T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--c0444c04-ef63-4163-b56b-cf7f211a9a62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.199.206.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:05:02.000Z",
      "valid_until": "2026-04-24T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T01:50:56.067Z",
      "x_nadsec_last_seen": "2026-03-23T01:50:56.067Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=IN; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9106a385-945e-407c-8d5c-f52c985e6a8d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.59.95.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:05:02.000Z",
      "valid_until": "2026-04-24T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T01:50:57.957Z",
      "x_nadsec_last_seen": "2026-03-23T01:50:57.957Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3546e5fa-3a66-4252-b531-d36fb91dceab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.185.87.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:05:02.000Z",
      "valid_until": "2026-04-24T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T01:36:42.895Z",
      "x_nadsec_last_seen": "2026-03-23T01:38:47.614Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-23T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--259e4a85-6656-4139-81af-35224358aa39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.227.45.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:05:02.000Z",
      "valid_until": "2026-04-24T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T01:51:35.998Z",
      "x_nadsec_last_seen": "2026-03-23T01:51:35.998Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6b16db1f-3932-43f1-acdc-51a4017c7e42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.168.7.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:05:02.000Z",
      "valid_until": "2026-04-24T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T01:56:28.459Z",
      "x_nadsec_last_seen": "2026-03-23T01:56:28.459Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-23T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134032; asn_org=INFONET COMM ENTERPRISES",
      "id": "indicator--29b8742f-ff34-4d4c-9624-a7ed040889d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.137.255.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:05:02.000Z",
      "valid_until": "2026-04-24T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T01:10:14.149Z",
      "x_nadsec_last_seen": "2026-03-23T01:12:18.851Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134032"
      ],
      "x_nadsec_orgs": [
        "INFONET COMM ENTERPRISES"
      ]
    },
    {
      "created": "2026-03-23T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NP; asn=17501; asn_org=WorldLink Communications Pvt Ltd",
      "id": "indicator--5ba4ec8b-f30c-49cd-bd74-2f6e8ead9120",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.79.60.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:05:02.000Z",
      "valid_until": "2026-04-24T02:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-23T01:14:10.087Z",
      "x_nadsec_last_seen": "2026-03-23T01:20:42.677Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "17501"
      ],
      "x_nadsec_orgs": [
        "WorldLink Communications Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-23T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--17e1fa2f-36b0-460b-ada1-fe74eccf0a93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.189.239.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:05:02.000Z",
      "valid_until": "2026-04-24T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T01:51:29.148Z",
      "x_nadsec_last_seen": "2026-03-23T01:51:29.148Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e99dff4f-9596-4644-9582-27853c15cb9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '24.199.94.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:05:02.000Z",
      "valid_until": "2026-04-24T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T02:01:07.030Z",
      "x_nadsec_last_seen": "2026-03-23T02:01:07.030Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--9814f9cf-f86d-4925-b107-3705dfa8b1f7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.109.51.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:05:02.000Z",
      "valid_until": "2026-04-24T02:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-23T01:10:30.948Z",
      "x_nadsec_last_seen": "2026-03-26T05:27:15.140Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-23T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=AT; asn=31543; asn_org=myNet GmbH",
      "id": "indicator--5ef7dc6c-7c5b-4dc3-af78-3a39bd3e02fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.217.38.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:05:02.000Z",
      "valid_until": "2026-04-24T02:05:00.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-11T15:29:31.849Z",
      "x_nadsec_last_seen": "2026-03-24T20:21:44.016Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AT"
      ],
      "x_nadsec_asns": [
        "31543"
      ],
      "x_nadsec_orgs": [
        "myNet GmbH"
      ]
    },
    {
      "created": "2026-03-23T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1ab672f6-6ba2-4587-a61a-9b2e2a2a2338",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:05:02.000Z",
      "valid_until": "2026-04-24T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T02:44:45.573Z",
      "x_nadsec_last_seen": "2026-03-23T02:44:45.953Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-23T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--c752faa9-6801-4120-8ff1-1477c5649c11",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:05:02.000Z",
      "valid_until": "2026-04-24T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T02:57:17.860Z",
      "x_nadsec_last_seen": "2026-03-23T02:57:47.860Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-23T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--df7bd0dc-4bda-4692-9a20-f86039421d6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.97.26.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:05:02.000Z",
      "valid_until": "2026-04-24T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T02:10:49.471Z",
      "x_nadsec_last_seen": "2026-03-23T02:10:49.471Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-23T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--5da8dbf9-78d7-430c-ba6c-576433b98d24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.88.247.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:05:02.000Z",
      "valid_until": "2026-04-24T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-23T03:01:07.078Z",
      "x_nadsec_last_seen": "2026-03-23T06:15:51.733Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-23T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--a8bd60c7-e36f-4358-aa09-4a1525bbdafb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.198.241.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:05:02.000Z",
      "valid_until": "2026-04-24T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T02:48:19.572Z",
      "x_nadsec_last_seen": "2026-03-23T02:50:29.556Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-03-23T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--54b5358f-cffa-45d8-97ad-c3aa442d48cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:05:02.000Z",
      "valid_until": "2026-04-24T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T03:00:24.608Z",
      "x_nadsec_last_seen": "2026-03-23T03:00:24.608Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-23T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--72d5cee0-2389-456d-82b8-8e7cf10a6a68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.204.144.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:05:02.000Z",
      "valid_until": "2026-04-24T03:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-23T03:03:10.921Z",
      "x_nadsec_last_seen": "2026-03-23T06:15:51.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-23T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--d2533351-c9a2-4280-9356-8d3520b37e4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.76.35.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:05:02.000Z",
      "valid_until": "2026-04-24T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T02:47:11.748Z",
      "x_nadsec_last_seen": "2026-03-23T02:47:11.748Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-23T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--5963635c-4ff2-4604-a6d5-2526ce7751a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.77.219.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:05:02.000Z",
      "valid_until": "2026-04-24T03:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T02:47:12.340Z",
      "x_nadsec_last_seen": "2026-03-27T19:14:03.479Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mysqld",
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IQ; asn=199739; asn_org=Earthlink Telecommunications Equipment Trading & Services DMCC",
      "id": "indicator--57e0f552-bf94-4410-b365-9c7cee38b86a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.237.191.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T03:05:02.000Z",
      "valid_until": "2026-04-24T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T02:24:55.743Z",
      "x_nadsec_last_seen": "2026-03-23T02:24:56.045Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IQ"
      ],
      "x_nadsec_asns": [
        "199739"
      ],
      "x_nadsec_orgs": [
        "Earthlink Telecommunications Equipment Trading & Services DMCC"
      ]
    },
    {
      "created": "2026-03-23T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--53f224d2-b906-480e-810d-070b298dd493",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.167.248.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:05:03.000Z",
      "valid_until": "2026-04-24T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T03:37:37.289Z",
      "x_nadsec_last_seen": "2026-03-23T03:39:43.657Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-23T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7e1ce357-d873-454d-a0f0-b26be50481fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:05:03.000Z",
      "valid_until": "2026-04-24T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T03:37:52.683Z",
      "x_nadsec_last_seen": "2026-03-23T03:37:52.683Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-23T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH",
      "id": "indicator--13d9f24a-7772-40fd-bf1f-6a4e85cda9cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:05:03.000Z",
      "valid_until": "2026-04-24T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T03:06:23.580Z",
      "x_nadsec_last_seen": "2026-03-23T03:06:23.580Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "215778"
      ],
      "x_nadsec_orgs": [
        "Alpha Strike Labs GmbH"
      ]
    },
    {
      "created": "2026-03-23T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--bc0c9f7c-2dc3-48e0-ba8e-f5a2d78cabf6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:05:03.000Z",
      "valid_until": "2026-04-24T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T03:30:18.924Z",
      "x_nadsec_last_seen": "2026-03-24T21:16:44.682Z",
      "x_nadsec_ports": [
        "445",
        "27017"
      ],
      "x_nadsec_services": [
        "smbd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-23T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--4bb6e4a6-0294-4aed-b654-39cdee82ff48",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.63.203.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:05:03.000Z",
      "valid_until": "2026-04-24T04:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T03:20:45.784Z",
      "x_nadsec_last_seen": "2026-03-23T03:26:41.880Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-23T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MN; asn=9484; asn_org=Mobinet LLC. AS Mobinet Internet Service Provider",
      "id": "indicator--8c1385ee-b2e8-442b-b7cc-49bbf70871a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.131.238.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:05:03.000Z",
      "valid_until": "2026-04-24T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T03:55:32.837Z",
      "x_nadsec_last_seen": "2026-03-23T03:57:40.720Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "9484"
      ],
      "x_nadsec_orgs": [
        "Mobinet LLC. AS Mobinet Internet Service Provider"
      ]
    },
    {
      "created": "2026-03-23T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--9e492ce3-e965-4d19-84d8-0f4ff4a7df27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.77.161.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:05:03.000Z",
      "valid_until": "2026-04-24T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T03:27:33.077Z",
      "x_nadsec_last_seen": "2026-03-23T03:27:37.913Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-23T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--bcb427be-e572-4809-837c-cd919bf0c4cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.85.204.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:05:03.000Z",
      "valid_until": "2026-04-24T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T03:21:30.684Z",
      "x_nadsec_last_seen": "2026-03-23T03:23:35.673Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-23T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ZM; asn=37532; asn_org=ZAMREN; user(top)=**",
      "id": "indicator--b4753967-22c0-41e7-b24c-8917ba82717e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.63.0.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:05:03.000Z",
      "valid_until": "2026-04-24T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T03:05:57.244Z",
      "x_nadsec_last_seen": "2026-03-23T03:05:57.244Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ZM"
      ],
      "x_nadsec_asns": [
        "37532"
      ],
      "x_nadsec_orgs": [
        "ZAMREN"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--08934c6b-322b-46c1-bffb-14f7f949d41e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:05:03.000Z",
      "valid_until": "2026-04-24T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T03:47:35.331Z",
      "x_nadsec_last_seen": "2026-03-31T00:00:32.864Z",
      "x_nadsec_ports": [
        "445",
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-23T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=24626; asn_org=Joint Stock Company TransTeleCom",
      "id": "indicator--b971620f-972c-4e93-8c54-90e106fa2e1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.18.134.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:05:03.000Z",
      "valid_until": "2026-04-24T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T03:35:55.990Z",
      "x_nadsec_last_seen": "2026-03-23T03:43:20.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24626"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company TransTeleCom"
      ]
    },
    {
      "created": "2026-03-23T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=IN; asn=135139; asn_org=Skylink Fibernet Private Limited",
      "id": "indicator--2c69a6c3-48d8-4b7e-9c86-d063bb0dec8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.99.149.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:05:02.000Z",
      "valid_until": "2026-04-24T05:05:01.000Z",
      "x_nadsec_event_count": 3149,
      "x_nadsec_first_seen": "2026-03-23T05:01:56.266Z",
      "x_nadsec_last_seen": "2026-03-23T05:28:16.929Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135139"
      ],
      "x_nadsec_orgs": [
        "Skylink Fibernet Private Limited"
      ]
    },
    {
      "created": "2026-03-23T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--c424eba4-a62c-4ef1-bf63-b3366c1b3f0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.163.203.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:05:02.000Z",
      "valid_until": "2026-04-24T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T04:22:53.607Z",
      "x_nadsec_last_seen": "2026-03-23T04:24:57.936Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-23T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--19b52180-7892-453c-864a-39448b5175b4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.24.73.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:05:02.000Z",
      "valid_until": "2026-04-24T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T04:53:03.621Z",
      "x_nadsec_last_seen": "2026-03-23T04:55:08.305Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-23T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3c120958-be82-4a17-b3eb-b6c595f40c3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:05:02.000Z",
      "valid_until": "2026-04-24T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T04:12:42.589Z",
      "x_nadsec_last_seen": "2026-03-23T04:12:42.973Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-23T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AF; asn=55330; asn_org=AFGHANTELECOM GOVERNMENT COMMUNICATION NETWORK",
      "id": "indicator--967935a4-df34-4825-bb4d-65e1fd354936",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '149.54.11.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:05:02.000Z",
      "valid_until": "2026-04-24T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T04:25:54.664Z",
      "x_nadsec_last_seen": "2026-03-23T04:28:01.138Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AF"
      ],
      "x_nadsec_asns": [
        "55330"
      ],
      "x_nadsec_orgs": [
        "AFGHANTELECOM GOVERNMENT COMMUNICATION NETWORK"
      ]
    },
    {
      "created": "2026-03-23T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--ce8e5246-2474-4f38-8fc3-2879ecfd935a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.82.2.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:05:02.000Z",
      "valid_until": "2026-04-24T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T04:42:20.645Z",
      "x_nadsec_last_seen": "2026-03-23T04:44:26.596Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-23T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--a669c7fe-1a8a-4f41-867b-dda677353edc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.63.203.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:05:02.000Z",
      "valid_until": "2026-04-24T05:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T04:15:36.253Z",
      "x_nadsec_last_seen": "2026-03-23T04:21:45.522Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-23T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--9c5fb789-0593-446b-9eed-613dcd292a2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.103.134.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:05:02.000Z",
      "valid_until": "2026-04-24T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T04:32:50.023Z",
      "x_nadsec_last_seen": "2026-03-23T04:34:57.531Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-23T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--620a7fb5-bf0f-483b-8b05-b8cd3f5e3eb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.218.158.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:05:02.000Z",
      "valid_until": "2026-04-24T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T04:08:21.043Z",
      "x_nadsec_last_seen": "2026-03-23T04:10:27.557Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-23T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=701; asn_org=Verizon Business",
      "id": "indicator--bc8d371e-1c78-4ed8-a1c0-2166b67b947a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '96.246.234.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:05:02.000Z",
      "valid_until": "2026-04-24T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-23T04:40:32.477Z",
      "x_nadsec_last_seen": "2026-03-23T04:47:28.996Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "701"
      ],
      "x_nadsec_orgs": [
        "Verizon Business"
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--e3643939-c485-47d5-a3ed-9ebcee65c7fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.55.14.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T05:19:56.142Z",
      "x_nadsec_last_seen": "2026-03-23T05:19:56.481Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--78db4083-d425-4963-ab2e-5167a40cda22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.182.195.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-23T05:59:20.474Z",
      "x_nadsec_last_seen": "2026-03-23T06:03:35.053Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134863; asn_org=SP INTERNET TECHNOLOGIES PRIVATE LTD",
      "id": "indicator--a0da60fb-bcc2-472d-97d2-3f112cfa7469",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.207.4.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T05:19:10.827Z",
      "x_nadsec_last_seen": "2026-03-23T05:21:15.447Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134863"
      ],
      "x_nadsec_orgs": [
        "SP INTERNET TECHNOLOGIES PRIVATE LTD"
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=HK; asn=133073; asn_org=TELEGLOBAL COMMUNICATION SERVICES LIMITED",
      "id": "indicator--7d9333c8-903d-46e9-91d3-05c1cca47927",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.68.183.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-03-23T05:21:05.945Z",
      "x_nadsec_last_seen": "2026-03-25T04:16:49.241Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "133073"
      ],
      "x_nadsec_orgs": [
        "TELEGLOBAL COMMUNICATION SERVICES LIMITED"
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0b744a64-41e3-4c09-b2af-fff41a483b83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.209.64.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T05:28:32.892Z",
      "x_nadsec_last_seen": "2026-03-23T05:28:32.892Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fff4a3d9-3694-4f5a-8738-72d29230568d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.64.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-23T05:42:30.880Z",
      "x_nadsec_last_seen": "2026-03-23T05:44:29.125Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "3306",
        "27017",
        "33617"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "mongod",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9eebd927-1199-46a2-a527-bf9016cab00a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.243.173.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T05:28:32.210Z",
      "x_nadsec_last_seen": "2026-03-23T05:28:32.210Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=47895; asn_org=LTD Erline",
      "id": "indicator--d9e28219-548f-4612-b0df-14d5945cea6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.59.244.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T05:50:26.969Z",
      "x_nadsec_last_seen": "2026-03-23T05:52:33.861Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "47895"
      ],
      "x_nadsec_orgs": [
        "LTD Erline"
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=201776; asn_org=Miranda-Media Ltd",
      "id": "indicator--f52de28b-f222-4526-942d-a5a5567a1326",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.148.55.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T05:50:12.998Z",
      "x_nadsec_last_seen": "2026-03-23T05:51:46.462Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "201776"
      ],
      "x_nadsec_orgs": [
        "Miranda-Media Ltd"
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.",
      "id": "indicator--708d24ce-b8dd-4dcd-b2ea-4bdb59acc96b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.94.131.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T05:18:55.064Z",
      "x_nadsec_last_seen": "2026-03-23T05:18:55.498Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11172"
      ],
      "x_nadsec_orgs": [
        "Alestra, S. de R.L. de C.V."
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--d9838051-4084-4e02-a21c-762101ad6c97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.94.67.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T06:01:10.326Z",
      "x_nadsec_last_seen": "2026-03-23T06:03:15.726Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=28775; asn_org=Ooo Transtelecom",
      "id": "indicator--bd6ce9eb-c453-4473-95ae-ccd4b86a3e30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.21.210.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T05:48:15.953Z",
      "x_nadsec_last_seen": "2026-03-23T05:50:22.700Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28775"
      ],
      "x_nadsec_orgs": [
        "Ooo Transtelecom"
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=EC; asn=22724; asn_org=PUNTONET S.A.; user(top)=**",
      "id": "indicator--0a4d0c5c-bd37-4476-af71-851ebab2f19c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.224.81.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T06:01:40.416Z",
      "x_nadsec_last_seen": "2026-03-28T19:58:24.783Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "22724"
      ],
      "x_nadsec_orgs": [
        "PUNTONET S.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45458; asn_org=SBN-ISPAWN-ISP and SBN-NIXAWN-NIX",
      "id": "indicator--22ef7c46-aa1b-4b43-809e-421cf751c31d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.231.225.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T05:37:19.616Z",
      "x_nadsec_last_seen": "2026-03-23T05:39:24.142Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45458"
      ],
      "x_nadsec_orgs": [
        "SBN-ISPAWN-ISP and SBN-NIXAWN-NIX"
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CA; asn=16276; asn_org=OVH SAS",
      "id": "indicator--639c03e5-f9ac-4ca6-8be6-b5eb568cde0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '51.222.38.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 50,
      "x_nadsec_first_seen": "2026-03-23T06:00:22.379Z",
      "x_nadsec_last_seen": "2026-03-25T04:12:17.753Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "16276"
      ],
      "x_nadsec_orgs": [
        "OVH SAS"
      ]
    },
    {
      "created": "2026-03-23T06:05:30.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=NL; asn=202425; asn_org=IP Volume inc",
      "id": "indicator--a2f6cc02-b477-4aaa-91c0-5318a669db37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T06:05:30.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.82.77.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:05:30.000Z",
      "valid_until": "2026-04-24T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T05:45:36.528Z",
      "x_nadsec_last_seen": "2026-03-23T05:45:36.528Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "202425"
      ],
      "x_nadsec_orgs": [
        "IP Volume inc"
      ]
    },
    {
      "created": "2026-03-23T07:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--25fe4e08-55c1-4981-b4c1-4c0f6929f87f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.176.81.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:05:07.000Z",
      "valid_until": "2026-04-24T07:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T06:11:48.439Z",
      "x_nadsec_last_seen": "2026-03-23T06:13:54.783Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-23T07:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--0fcc8154-0860-4a25-8aa7-0bf4a5b8d6ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.69.161.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:05:07.000Z",
      "valid_until": "2026-04-24T07:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T06:58:26.266Z",
      "x_nadsec_last_seen": "2026-03-23T07:00:31.696Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-23T07:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--8eb307cf-afce-4a77-9668-8d5059db3c36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.253.104.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:05:07.000Z",
      "valid_until": "2026-04-24T07:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T06:17:22.075Z",
      "x_nadsec_last_seen": "2026-03-23T06:17:26.514Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-03-23T07:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23974; asn_org=Ministry of education",
      "id": "indicator--cdd937f7-8779-4139-819e-001ffa3168d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.172.212.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:05:07.000Z",
      "valid_until": "2026-04-24T07:05:05.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-23T06:49:34.539Z",
      "x_nadsec_last_seen": "2026-03-24T06:01:27.849Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23974"
      ],
      "x_nadsec_orgs": [
        "Ministry of education"
      ]
    },
    {
      "created": "2026-03-23T07:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--53bbe547-7ee4-497a-8f10-10a992031738",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:05:07.000Z",
      "valid_until": "2026-04-24T07:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T06:25:03.198Z",
      "x_nadsec_last_seen": "2026-03-23T06:25:03.198Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-23T07:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=41034; asn_org=Ltd. SPAImpulse",
      "id": "indicator--c535049f-8eb7-4c25-aa45-57cc4f90bc17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T07:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.236.65.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:05:07.000Z",
      "valid_until": "2026-04-24T07:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T06:32:56.789Z",
      "x_nadsec_last_seen": "2026-03-23T06:34:10.811Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "41034"
      ],
      "x_nadsec_orgs": [
        "Ltd. SPAImpulse"
      ]
    },
    {
      "created": "2026-03-23T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133692; asn_org=Fastnet Communication Pvt. Ltd.",
      "id": "indicator--95756c28-9039-4b1a-8c8a-447aa6d6cc16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.47.218.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T08:05:10.000Z",
      "valid_until": "2026-04-24T08:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T07:49:27.163Z",
      "x_nadsec_last_seen": "2026-03-23T07:51:32.322Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133692"
      ],
      "x_nadsec_orgs": [
        "Fastnet Communication Pvt. Ltd."
      ]
    },
    {
      "created": "2026-03-23T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--1dcca188-908c-49ac-819f-b5aca15167a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.8.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T08:05:10.000Z",
      "valid_until": "2026-04-24T08:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T07:09:34.449Z",
      "x_nadsec_last_seen": "2026-03-23T07:11:41.578Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-23T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--04f52c67-5935-4f82-b206-38d9f264e33c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.80.189.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T08:05:10.000Z",
      "valid_until": "2026-04-24T08:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T07:29:17.978Z",
      "x_nadsec_last_seen": "2026-03-23T07:31:22.373Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-23T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--279776ff-3c2c-45ab-8646-962403c7ee75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.118.32.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T08:05:10.000Z",
      "valid_until": "2026-04-24T08:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T08:04:07.695Z",
      "x_nadsec_last_seen": "2026-03-23T08:04:08.410Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-23T08:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PE; asn=265691; asn_org=WI-NET TELECOM S.A.C.",
      "id": "indicator--f68032f5-cf86-4778-869f-3c13bf1e5b40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T08:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.25.42.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T08:05:10.000Z",
      "valid_until": "2026-04-24T08:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T07:26:27.991Z",
      "x_nadsec_last_seen": "2026-03-23T07:26:28.032Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "265691"
      ],
      "x_nadsec_orgs": [
        "WI-NET TELECOM S.A.C."
      ]
    },
    {
      "created": "2026-03-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--04ec0675-2aea-4af1-ad48-924dcbad7108",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.41.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:05:10.000Z",
      "valid_until": "2026-04-24T09:05:03.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T08:59:17.757Z",
      "x_nadsec_last_seen": "2026-03-23T08:59:29.176Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s"
      ]
    },
    {
      "created": "2026-03-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--00155eb3-a736-4c9e-92ae-f1d6f9a46a22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.88.228.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:05:10.000Z",
      "valid_until": "2026-04-24T09:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T08:13:18.664Z",
      "x_nadsec_last_seen": "2026-03-23T08:15:23.049Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=22689; asn_org=SERCOMTEL SA TELECOMUNICACOES",
      "id": "indicator--aca1091e-e6be-4bba-919f-394445734bcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.0.127.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:05:10.000Z",
      "valid_until": "2026-04-24T09:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T08:45:14.526Z",
      "x_nadsec_last_seen": "2026-03-23T08:47:21.135Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "22689"
      ],
      "x_nadsec_orgs": [
        "SERCOMTEL SA TELECOMUNICACOES"
      ]
    },
    {
      "created": "2026-03-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--e85a5a5c-45e2-4b70-a659-f56e02a5fb13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.158.28.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:05:10.000Z",
      "valid_until": "2026-04-24T09:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T08:08:07.799Z",
      "x_nadsec_last_seen": "2026-03-23T08:08:07.799Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--acab9001-2f30-4b32-8530-05afa2ef877f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.254.34.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:05:10.000Z",
      "valid_until": "2026-04-24T09:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T09:01:41.165Z",
      "x_nadsec_last_seen": "2026-03-23T09:03:45.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--6bcfb678-d402-4a1d-a2b6-b44170404cfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.233.42.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:05:10.000Z",
      "valid_until": "2026-04-24T09:05:03.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T08:08:27.986Z",
      "x_nadsec_last_seen": "2026-03-23T08:08:27.986Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=OM; asn=28885; asn_org=Oman Telecommunications Company (S.A.O.G)",
      "id": "indicator--0f7e4217-e18b-4921-b9ec-d74dbed56159",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.41.189.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:05:10.000Z",
      "valid_until": "2026-04-24T09:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T08:51:38.586Z",
      "x_nadsec_last_seen": "2026-03-23T08:53:44.915Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "OM"
      ],
      "x_nadsec_asns": [
        "28885"
      ],
      "x_nadsec_orgs": [
        "Oman Telecommunications Company (S.A.O.G)"
      ]
    },
    {
      "created": "2026-03-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZM; asn=30844; asn_org=Liquid Telecommunications Ltd",
      "id": "indicator--04a2af52-5952-4c43-ac5b-28be72de0564",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.60.156.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:05:10.000Z",
      "valid_until": "2026-04-24T09:05:03.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T08:46:38.841Z",
      "x_nadsec_last_seen": "2026-03-23T08:48:47.179Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZM"
      ],
      "x_nadsec_asns": [
        "30844"
      ],
      "x_nadsec_orgs": [
        "Liquid Telecommunications Ltd"
      ]
    },
    {
      "created": "2026-03-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--0cfac61a-7b2c-448c-8445-8c760a7b97c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.199.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:05:10.000Z",
      "valid_until": "2026-04-24T09:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T08:52:38.179Z",
      "x_nadsec_last_seen": "2026-03-23T08:52:38.607Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=RU; asn=12389; asn_org=Rostelecom; user(top)=**",
      "id": "indicator--0e417471-8b7b-48e2-a9f9-c4cee45561be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.100.126.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:05:10.000Z",
      "valid_until": "2026-04-24T09:05:03.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T08:32:37.465Z",
      "x_nadsec_last_seen": "2026-03-23T08:32:38.678Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T09:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--295b5b99-373c-419a-8381-4a2a6ff4f57e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T09:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.36.249.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:05:10.000Z",
      "valid_until": "2026-04-24T09:05:03.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-23T08:42:39.114Z",
      "x_nadsec_last_seen": "2026-03-30T11:39:26.444Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-03-23T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--553cf8cb-4aa3-47c7-a414-46d8c5403f3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.222.215.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T10:05:02.000Z",
      "valid_until": "2026-04-24T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T09:13:49.590Z",
      "x_nadsec_last_seen": "2026-03-23T09:15:54.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-23T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--6baff7a5-be3d-4b50-9e69-d2a84b29f9ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.0.139.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T10:05:02.000Z",
      "valid_until": "2026-04-24T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T09:21:04.990Z",
      "x_nadsec_last_seen": "2026-03-23T09:23:09.827Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-23T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b1b7a042-142f-4a00-9add-64d8d0342a37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.78.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T10:05:02.000Z",
      "valid_until": "2026-04-24T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-23T09:40:54.251Z",
      "x_nadsec_last_seen": "2026-03-23T09:45:32.271Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-23T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=327726; asn_org=Newtelco",
      "id": "indicator--6b5353b4-1850-4470-b071-46723ae6c30f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.72.6.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T10:05:02.000Z",
      "valid_until": "2026-04-24T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T09:30:31.619Z",
      "x_nadsec_last_seen": "2026-03-23T09:32:39.681Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "327726"
      ],
      "x_nadsec_orgs": [
        "Newtelco"
      ]
    },
    {
      "created": "2026-03-23T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--245a10d9-6b11-4127-802c-5f35a4e18b44",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '175.167.148.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T10:05:02.000Z",
      "valid_until": "2026-04-24T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-23T09:30:31.175Z",
      "x_nadsec_last_seen": "2026-03-23T09:38:10.999Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-23T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--dd1df446-a6ec-4f8d-b353-9ab4ce885420",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.119.164.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T10:05:02.000Z",
      "valid_until": "2026-04-24T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T09:56:43.820Z",
      "x_nadsec_last_seen": "2026-03-23T09:58:50.543Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-23T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PE; asn=265691; asn_org=WI-NET TELECOM S.A.C.; user(top)=**",
      "id": "indicator--ef768eaf-2b17-4307-8a1f-e8c7cd3c1f58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.25.30.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T10:05:02.000Z",
      "valid_until": "2026-04-24T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T09:29:26.124Z",
      "x_nadsec_last_seen": "2026-03-23T09:29:26.124Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "265691"
      ],
      "x_nadsec_orgs": [
        "WI-NET TELECOM S.A.C."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--de385e9f-d19a-4adc-854e-a7c9f686e942",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.68.133.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T10:05:02.000Z",
      "valid_until": "2026-04-24T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T09:09:42.168Z",
      "x_nadsec_last_seen": "2026-03-23T09:11:59.644Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-03-23T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--a2fcb351-7b30-48d5-b5e3-9a748b7f9de7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.1.214.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:05:13.000Z",
      "valid_until": "2026-04-24T11:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-23T10:39:31.798Z",
      "x_nadsec_last_seen": "2026-03-23T10:45:54.995Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-23T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--9f3a0b66-1936-4a1d-b007-3ae4740aed1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.98.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:05:13.000Z",
      "valid_until": "2026-04-24T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T10:57:21.147Z",
      "x_nadsec_last_seen": "2026-03-23T10:59:38.053Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-23T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--307cf04e-988f-4114-b4aa-6cf434d788cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.177.112.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:05:13.000Z",
      "valid_until": "2026-04-24T11:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T10:08:11.078Z",
      "x_nadsec_last_seen": "2026-03-23T10:08:11.369Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-23T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--ba055a24-b02e-436b-bf10-0cc1ef996124",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.39.100.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:05:13.000Z",
      "valid_until": "2026-04-24T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T10:50:58.794Z",
      "x_nadsec_last_seen": "2026-03-23T10:53:04.927Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-23T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--94c9cd16-d414-441c-8b2c-c16188ba4a7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.18.169.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:05:13.000Z",
      "valid_until": "2026-04-24T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T10:20:20.701Z",
      "x_nadsec_last_seen": "2026-03-23T10:25:32.342Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-23T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=15704; asn_org=Xtra Telecom S.A.",
      "id": "indicator--0a6c3239-a05c-47aa-8400-dfefea0e1e83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.230.181.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:05:13.000Z",
      "valid_until": "2026-04-24T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T10:45:17.058Z",
      "x_nadsec_last_seen": "2026-03-23T10:47:23.428Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "15704"
      ],
      "x_nadsec_orgs": [
        "Xtra Telecom S.A."
      ]
    },
    {
      "created": "2026-03-23T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132115; asn_org=INDINET SERVICE PRIVATE LIMITED",
      "id": "indicator--4b392d72-1c7f-4ab3-8c8c-07031119a4b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.117.202.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:05:13.000Z",
      "valid_until": "2026-04-24T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T10:08:24.034Z",
      "x_nadsec_last_seen": "2026-03-23T10:10:28.775Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132115"
      ],
      "x_nadsec_orgs": [
        "INDINET SERVICE PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-23T11:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--662d4a4a-3e13-4337-b2ec-bff62bb66149",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T11:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.174.198.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:05:13.000Z",
      "valid_until": "2026-04-24T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T10:11:08.981Z",
      "x_nadsec_last_seen": "2026-03-23T10:13:16.858Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-23T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=134044; asn_org=Webberstop India; user(top)=**",
      "id": "indicator--a8b86056-3f7e-4be1-bda2-9e07937afee8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.59.180.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T12:05:03.000Z",
      "valid_until": "2026-04-24T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T11:46:32.888Z",
      "x_nadsec_last_seen": "2026-03-23T11:46:32.888Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134044"
      ],
      "x_nadsec_orgs": [
        "Webberstop India"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--f3289284-7d0e-426b-818d-d6afe00286df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.96.52.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T12:05:03.000Z",
      "valid_until": "2026-04-24T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T11:32:12.596Z",
      "x_nadsec_last_seen": "2026-03-23T11:34:20.276Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-23T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--28be3811-4af4-4fd8-be98-1def5a169fa6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.178.83.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T12:05:03.000Z",
      "valid_until": "2026-04-24T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T11:35:29.664Z",
      "x_nadsec_last_seen": "2026-03-23T11:35:29.664Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-23T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=MD; asn=31252; asn_org=StarNet Solutii SRL; user(top)=**",
      "id": "indicator--92ef170a-8c57-41bb-bf64-fc8475325de2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.233.12.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T12:05:03.000Z",
      "valid_until": "2026-04-24T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T11:51:13.764Z",
      "x_nadsec_last_seen": "2026-03-23T11:51:13.764Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MD"
      ],
      "x_nadsec_asns": [
        "31252"
      ],
      "x_nadsec_orgs": [
        "StarNet Solutii SRL"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--081cf61c-8a6c-42cf-b500-ecc3c6d20b7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T12:05:03.000Z",
      "valid_until": "2026-04-24T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T11:32:50.616Z",
      "x_nadsec_last_seen": "2026-03-23T11:32:50.616Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-23T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RO; asn=8953; asn_org=Orange Romania S.A.",
      "id": "indicator--7767e18f-6e03-4153-9b33-4f527c9d6708",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.180.48.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T12:05:03.000Z",
      "valid_until": "2026-04-24T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T11:50:34.897Z",
      "x_nadsec_last_seen": "2026-03-23T11:52:41.513Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "8953"
      ],
      "x_nadsec_orgs": [
        "Orange Romania S.A."
      ]
    },
    {
      "created": "2026-03-23T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--9483e81b-db6b-4346-b130-62e8d5d256b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T13:05:02.000Z",
      "valid_until": "2026-04-24T13:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-23T12:19:31.135Z",
      "x_nadsec_last_seen": "2026-03-31T23:51:12.804Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-23T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--0b35184c-3cc1-41bc-8207-c323e880bce9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.97.26.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T13:05:02.000Z",
      "valid_until": "2026-04-24T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T12:27:46.190Z",
      "x_nadsec_last_seen": "2026-03-23T12:27:46.190Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-23T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--c4d05620-7bdb-4e9f-ac54-c2be5da3ba5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.188.179.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T13:05:02.000Z",
      "valid_until": "2026-04-24T13:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-23T12:47:39.046Z",
      "x_nadsec_last_seen": "2026-03-31T10:02:30.695Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-23T13:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--cf119544-23e4-4d2e-9b31-17f0ce7c118c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T13:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.210.193.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T13:05:02.000Z",
      "valid_until": "2026-04-24T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T12:36:00.792Z",
      "x_nadsec_last_seen": "2026-03-23T12:38:05.732Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-23T14:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--c0f19adb-12e7-452b-94e8-291e51b6b589",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T14:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.2.239.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T14:05:06.000Z",
      "valid_until": "2026-04-24T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T13:31:42.784Z",
      "x_nadsec_last_seen": "2026-03-23T13:33:47.588Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-23T14:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=LU; asn=53667; asn_org=FranTech Solutions",
      "id": "indicator--d407ba1c-ee99-45ea-85c3-c06ff1d8919b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T14:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '107.189.30.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T14:05:06.000Z",
      "valid_until": "2026-04-24T14:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-23T13:14:24.733Z",
      "x_nadsec_last_seen": "2026-03-29T13:57:56.360Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "LU"
      ],
      "x_nadsec_asns": [
        "53667"
      ],
      "x_nadsec_orgs": [
        "FranTech Solutions"
      ]
    },
    {
      "created": "2026-03-23T14:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PE; asn=6147; asn_org=INTEGRATEL PERU S.A.A.",
      "id": "indicator--96d51bc3-c04f-4980-9730-936a7273149c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T14:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.67.238.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T14:05:06.000Z",
      "valid_until": "2026-04-24T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T13:31:17.723Z",
      "x_nadsec_last_seen": "2026-03-23T22:19:15.443Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "6147"
      ],
      "x_nadsec_orgs": [
        "INTEGRATEL PERU S.A.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T14:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--5fa2e4ff-dc72-4ac5-a91d-2af73ec98722",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T14:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.210.54.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T14:05:06.000Z",
      "valid_until": "2026-04-24T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-23T13:40:49.547Z",
      "x_nadsec_last_seen": "2026-03-23T13:49:02.727Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-23T14:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.",
      "id": "indicator--96199207-705d-4f19-959a-3d53c9a0a8bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T14:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.45.94.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T14:05:06.000Z",
      "valid_until": "2026-04-24T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T13:46:30.053Z",
      "x_nadsec_last_seen": "2026-03-23T13:48:37.649Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7303"
      ],
      "x_nadsec_orgs": [
        "Telecom Argentina S.A."
      ]
    },
    {
      "created": "2026-03-23T14:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=OM; asn=28885; asn_org=Oman Telecommunications Company (S.A.O.G)",
      "id": "indicator--37f34a47-2655-4512-8595-f8a36ef57e3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T14:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.154.10.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T14:05:06.000Z",
      "valid_until": "2026-04-24T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T13:21:46.939Z",
      "x_nadsec_last_seen": "2026-03-23T13:21:54.323Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "OM"
      ],
      "x_nadsec_asns": [
        "28885"
      ],
      "x_nadsec_orgs": [
        "Oman Telecommunications Company (S.A.O.G)"
      ]
    },
    {
      "created": "2026-03-23T14:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=25515; asn_org=Rostelecom",
      "id": "indicator--167ea377-be13-4be2-9604-8c4c38bf9696",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T14:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.109.233.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T14:05:06.000Z",
      "valid_until": "2026-04-24T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T13:38:29.053Z",
      "x_nadsec_last_seen": "2026-03-23T13:40:34.228Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25515"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-23T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=141329; asn_org=Udupi Fastnet Private Limited",
      "id": "indicator--2f0b1494-8be4-452a-9009-2bb2d178ed35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.171.194.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T15:05:03.000Z",
      "valid_until": "2026-04-24T15:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-23T14:28:01.414Z",
      "x_nadsec_last_seen": "2026-03-23T14:34:20.553Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "141329"
      ],
      "x_nadsec_orgs": [
        "Udupi Fastnet Private Limited"
      ]
    },
    {
      "created": "2026-03-23T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9dbd23d1-43e6-4105-a635-d98fc11c3ad6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T15:05:03.000Z",
      "valid_until": "2026-04-24T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T14:59:14.119Z",
      "x_nadsec_last_seen": "2026-03-23T14:59:14.119Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-23T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--921f65e5-9c81-40ba-8fb9-817cce242cbd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.211.102.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T15:05:03.000Z",
      "valid_until": "2026-04-24T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T14:45:31.273Z",
      "x_nadsec_last_seen": "2026-03-23T14:45:31.332Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-23T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=47524; asn_org=Turksat Uydu Haberlesme ve Kablo TV Isletme A.S.",
      "id": "indicator--930e6fde-d931-404d-a526-690edf3a7de4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '24.133.81.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T15:05:03.000Z",
      "valid_until": "2026-04-24T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T14:27:14.852Z",
      "x_nadsec_last_seen": "2026-03-23T14:29:21.984Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "47524"
      ],
      "x_nadsec_orgs": [
        "Turksat Uydu Haberlesme ve Kablo TV Isletme A.S."
      ]
    },
    {
      "created": "2026-03-23T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--52fd2c3f-0552-4f45-810a-79716ad92904",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.38.193.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T15:05:03.000Z",
      "valid_until": "2026-04-24T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T14:37:08.175Z",
      "x_nadsec_last_seen": "2026-03-23T14:39:14.556Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-23T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=48642; asn_org=Joint stock company For",
      "id": "indicator--b59de13e-7640-4ee6-8b7f-1b6ab30e572b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.230.131.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T15:05:03.000Z",
      "valid_until": "2026-04-24T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T14:50:53.965Z",
      "x_nadsec_last_seen": "2026-03-23T14:53:00.714Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48642"
      ],
      "x_nadsec_orgs": [
        "Joint stock company For"
      ]
    },
    {
      "created": "2026-03-23T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--be8e35c3-fcd4-4067-981a-e5725e0c3588",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.140.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T16:05:02.000Z",
      "valid_until": "2026-04-24T16:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T15:12:46.879Z",
      "x_nadsec_last_seen": "2026-03-23T15:12:46.879Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--8ec72244-f4ad-4405-bd30-41b8a266680e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T16:05:02.000Z",
      "valid_until": "2026-04-24T16:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-23T15:51:53.426Z",
      "x_nadsec_last_seen": "2026-03-23T15:52:33.709Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-03-23T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--44e15be3-1a3e-400d-af4b-680fbb551e3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.175.211.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T16:05:02.000Z",
      "valid_until": "2026-04-24T16:05:00.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-03-23T15:12:58.231Z",
      "x_nadsec_last_seen": "2026-03-23T15:13:54.275Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-23T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=266647; asn_org=I360 Solucoes para Interacao e Com. Corp. Ltda",
      "id": "indicator--4d0121f3-73e5-4a07-ba12-faf0f8313983",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.201.164.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:05:03.000Z",
      "valid_until": "2026-04-24T17:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T16:35:06.715Z",
      "x_nadsec_last_seen": "2026-03-23T16:35:08.683Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "266647"
      ],
      "x_nadsec_orgs": [
        "I360 Solucoes para Interacao e Com. Corp. Ltda"
      ]
    },
    {
      "created": "2026-03-23T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--391bf55e-3166-44c3-823d-ff2c96e09f10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.197.204.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:05:03.000Z",
      "valid_until": "2026-04-24T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T16:16:08.805Z",
      "x_nadsec_last_seen": "2026-03-23T16:16:08.805Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--1910728e-b527-47f5-81d1-383f8b4a1cdd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.182.219.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:05:03.000Z",
      "valid_until": "2026-04-24T17:05:01.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-03-23T16:19:05.388Z",
      "x_nadsec_last_seen": "2026-03-23T16:20:02.813Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e1c00159-feb0-4c74-b24e-088fe9839e21",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.229.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:05:03.000Z",
      "valid_until": "2026-04-24T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T16:56:15.608Z",
      "x_nadsec_last_seen": "2026-03-23T16:56:15.608Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c0f3dba1-643c-45c4-8f52-e93d09580ded",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:05:03.000Z",
      "valid_until": "2026-04-24T17:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-23T16:40:06.518Z",
      "x_nadsec_last_seen": "2026-03-23T16:40:36.387Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-23T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SV; asn=263763; asn_org=REDES HIBRIDAS, S. A.",
      "id": "indicator--353a7e16-0871-4ae9-8c81-64699438257e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.84.99.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:05:03.000Z",
      "valid_until": "2026-04-24T17:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T16:51:59.295Z",
      "x_nadsec_last_seen": "2026-03-23T16:51:59.348Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SV"
      ],
      "x_nadsec_asns": [
        "263763"
      ],
      "x_nadsec_orgs": [
        "REDES HIBRIDAS, S. A."
      ]
    },
    {
      "created": "2026-03-23T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--164c359f-966e-4df8-ae3c-600cf131ecb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:05:03.000Z",
      "valid_until": "2026-04-24T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T16:08:52.917Z",
      "x_nadsec_last_seen": "2026-03-23T16:08:52.917Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-23T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=18182; asn_org=Sony Network Taiwan Limited",
      "id": "indicator--f45f6134-ac16-4551-9136-4aa6d166fe8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '219.85.187.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:05:03.000Z",
      "valid_until": "2026-04-24T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T16:15:09.202Z",
      "x_nadsec_last_seen": "2026-03-23T16:35:06.997Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "18182"
      ],
      "x_nadsec_orgs": [
        "Sony Network Taiwan Limited"
      ]
    },
    {
      "created": "2026-03-23T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IL; asn=12400; asn_org=Partner Communications Ltd.",
      "id": "indicator--7a0006bd-c9e1-42c3-a0f6-a5d677d8b1a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.154.162.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:05:03.000Z",
      "valid_until": "2026-04-24T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T16:35:06.690Z",
      "x_nadsec_last_seen": "2026-03-23T16:35:06.690Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "12400"
      ],
      "x_nadsec_orgs": [
        "Partner Communications Ltd."
      ]
    },
    {
      "created": "2026-03-23T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=45536; asn_org=Readylink Internet Services Limited; user(top)=**",
      "id": "indicator--1c778c44-03cb-4009-806e-5e95cdc84cbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.225.164.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:05:03.000Z",
      "valid_until": "2026-04-24T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T16:49:57.339Z",
      "x_nadsec_last_seen": "2026-03-23T16:49:57.339Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45536"
      ],
      "x_nadsec_orgs": [
        "Readylink Internet Services Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--1acfd67c-f4ea-43ca-9a29-3c62ac894f8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:05:03.000Z",
      "valid_until": "2026-04-24T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T16:15:33.236Z",
      "x_nadsec_last_seen": "2026-03-23T16:15:33.236Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-23T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--390ea71b-063a-4ebb-b53b-99b8970a6b72",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:05:03.000Z",
      "valid_until": "2026-04-24T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T16:14:54.947Z",
      "x_nadsec_last_seen": "2026-03-23T16:14:54.947Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-23T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b877f502-a85f-40dd-b0ab-482f3399a22a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:05:03.000Z",
      "valid_until": "2026-04-24T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T16:15:22.926Z",
      "x_nadsec_last_seen": "2026-03-23T16:15:22.926Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-23T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3bdb222b-d635-41b5-9b3a-a60e00532a57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:05:03.000Z",
      "valid_until": "2026-04-24T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T16:14:55.250Z",
      "x_nadsec_last_seen": "2026-03-23T16:14:55.250Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-23T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=ID; asn=135450; asn_org=PT Berkah Solusi Teknologi Informasi; user(top)=**",
      "id": "indicator--8d3e4b62-1063-4c97-b6aa-ce0390ba3e36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.65.237.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T18:05:02.000Z",
      "valid_until": "2026-04-24T18:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T17:45:00.365Z",
      "x_nadsec_last_seen": "2026-03-23T17:45:00.365Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "135450"
      ],
      "x_nadsec_orgs": [
        "PT Berkah Solusi Teknologi Informasi"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=BR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--46fb3d34-342b-40d0-aceb-c87e5ce325b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.197.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T18:05:02.000Z",
      "valid_until": "2026-04-24T18:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T17:58:01.167Z",
      "x_nadsec_last_seen": "2026-03-23T17:58:30.823Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-23T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--f42f9d03-fa53-494c-97e4-1c2797fe154d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T18:05:02.000Z",
      "valid_until": "2026-04-24T18:05:00.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-23T17:10:37.856Z",
      "x_nadsec_last_seen": "2026-03-23T17:10:59.654Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-23T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=52419; asn_org=CESOP",
      "id": "indicator--618334f8-f4b8-4722-961d-3b1b3f892c97",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.192.79.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T18:05:02.000Z",
      "valid_until": "2026-04-24T18:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T17:56:18.282Z",
      "x_nadsec_last_seen": "2026-03-23T17:56:24.866Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "52419"
      ],
      "x_nadsec_orgs": [
        "CESOP"
      ]
    },
    {
      "created": "2026-03-23T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=53222; asn_org=Seanet Telecom Ltda",
      "id": "indicator--a683db53-99a4-495f-93e7-9c5a648c6251",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.251.22.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T18:05:02.000Z",
      "valid_until": "2026-04-24T18:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T17:35:04.157Z",
      "x_nadsec_last_seen": "2026-03-23T17:35:10.792Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53222"
      ],
      "x_nadsec_orgs": [
        "Seanet Telecom Ltda"
      ]
    },
    {
      "created": "2026-03-23T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--ca292ef4-d975-4b3d-a77e-043e838be33e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.50.155.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T18:05:02.000Z",
      "valid_until": "2026-04-24T18:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T17:16:42.021Z",
      "x_nadsec_last_seen": "2026-03-23T17:16:42.242Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-03-23T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=2381; asn_org=WiscNet",
      "id": "indicator--11b43278-a96e-4ea0-8ff9-bde9b062a075",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.56.34.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T18:05:02.000Z",
      "valid_until": "2026-04-24T18:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T18:03:29.917Z",
      "x_nadsec_last_seen": "2026-03-23T18:03:34.205Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "2381"
      ],
      "x_nadsec_orgs": [
        "WiscNet"
      ]
    },
    {
      "created": "2026-03-23T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--38f16557-c30d-47f5-a100-2407378fdc9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.33.214.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T18:05:02.000Z",
      "valid_until": "2026-04-24T18:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T18:04:11.111Z",
      "x_nadsec_last_seen": "2026-03-23T18:06:17.441Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-23T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--d336f1f0-a3cb-487f-9e02-0aca4060251b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.100.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:05:03.000Z",
      "valid_until": "2026-04-24T19:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-23T18:31:32.088Z",
      "x_nadsec_last_seen": "2026-03-23T18:39:38.595Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-23T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=CN; asn=58466; asn_org=CHINANET Guangdong province network",
      "id": "indicator--f6b10150-9292-4d01-8689-b1df72b4191c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.75.164.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:05:03.000Z",
      "valid_until": "2026-04-24T19:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T18:51:46.669Z",
      "x_nadsec_last_seen": "2026-03-23T18:51:54.292Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "58466"
      ],
      "x_nadsec_orgs": [
        "CHINANET Guangdong province network"
      ]
    },
    {
      "created": "2026-03-23T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3b345870-2f37-468b-86ad-ed9175c93a62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.224.187.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:05:03.000Z",
      "valid_until": "2026-04-24T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T18:50:05.500Z",
      "x_nadsec_last_seen": "2026-03-23T18:52:10.458Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-23T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=ID; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--3e2c89ca-335d-409c-b635-a4b4ec70306e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.153.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:05:03.000Z",
      "valid_until": "2026-04-24T19:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T18:09:47.524Z",
      "x_nadsec_last_seen": "2026-03-23T18:10:08.678Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SN; asn=328148; asn_org=ADIE-AS",
      "id": "indicator--9140320e-3c05-487a-bd87-5f62ffbff325",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.0.140.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:05:03.000Z",
      "valid_until": "2026-04-24T19:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-23T18:37:04.555Z",
      "x_nadsec_last_seen": "2026-03-24T00:01:35.580Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SN"
      ],
      "x_nadsec_asns": [
        "328148"
      ],
      "x_nadsec_orgs": [
        "ADIE-AS"
      ]
    },
    {
      "created": "2026-03-23T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--91abe904-a74a-4fa2-86bd-7d94128c9186",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.138.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:05:03.000Z",
      "valid_until": "2026-04-24T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T18:48:11.561Z",
      "x_nadsec_last_seen": "2026-03-23T18:48:31.498Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-23T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=31; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--65fa5799-287a-471f-862a-031671125eff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.211.117.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:05:03.000Z",
      "valid_until": "2026-04-24T19:05:01.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-03-23T18:35:39.917Z",
      "x_nadsec_last_seen": "2026-03-23T18:38:28.437Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f0a2b573-95a3-4823-b7cc-0718d01533e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:05:03.000Z",
      "valid_until": "2026-04-24T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T18:35:41.871Z",
      "x_nadsec_last_seen": "2026-03-23T18:35:41.871Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-23T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--d567a83d-ba81-4a01-a4a9-3d477135dcfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:05:03.000Z",
      "valid_until": "2026-04-24T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T18:49:58.080Z",
      "x_nadsec_last_seen": "2026-03-23T18:49:58.421Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-23T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--832bdd36-f53c-4ebf-a8a6-9dd508b2ad65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.227.7.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:05:03.000Z",
      "valid_until": "2026-04-24T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T18:38:30.941Z",
      "x_nadsec_last_seen": "2026-03-24T03:37:34.749Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=16637; asn_org=MTN Business Solutions",
      "id": "indicator--832aa1dc-a33c-460e-846e-e8b1bf22db66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.8.6.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:05:03.000Z",
      "valid_until": "2026-04-24T19:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-23T18:07:45.446Z",
      "x_nadsec_last_seen": "2026-03-24T17:06:22.456Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "16637"
      ],
      "x_nadsec_orgs": [
        "MTN Business Solutions"
      ]
    },
    {
      "created": "2026-03-23T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--4c1d554a-b440-4cba-97b6-8f5d590837db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.164.203.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T20:05:03.000Z",
      "valid_until": "2026-04-24T20:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-23T19:59:14.608Z",
      "x_nadsec_last_seen": "2026-03-23T20:18:12.151Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-23T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--554ed8bb-4014-402c-87b9-9dc71f24a578",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.16.76.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T20:05:03.000Z",
      "valid_until": "2026-04-24T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T19:14:26.233Z",
      "x_nadsec_last_seen": "2026-03-23T19:16:33.281Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-23T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=266323; asn_org=HPN TELECOMUNICACOES LTDA",
      "id": "indicator--5348185b-646d-4b14-90c2-15a6f79c61ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.238.156.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T20:05:03.000Z",
      "valid_until": "2026-04-24T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T19:44:33.565Z",
      "x_nadsec_last_seen": "2026-03-23T19:46:40.633Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "266323"
      ],
      "x_nadsec_orgs": [
        "HPN TELECOMUNICACOES LTDA"
      ]
    },
    {
      "created": "2026-03-23T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--5fb0a10d-98b1-4856-ad81-da062b34abec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.18.184.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T20:05:03.000Z",
      "valid_until": "2026-04-24T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T19:16:32.568Z",
      "x_nadsec_last_seen": "2026-03-24T02:06:06.070Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-23T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28300; asn_org=Speed Servicos de Internet Ltda",
      "id": "indicator--da8632f6-38a2-4705-ba2d-92c943ac3b28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.28.166.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T20:05:03.000Z",
      "valid_until": "2026-04-24T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T19:46:18.115Z",
      "x_nadsec_last_seen": "2026-03-23T19:48:27.606Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28300"
      ],
      "x_nadsec_orgs": [
        "Speed Servicos de Internet Ltda"
      ]
    },
    {
      "created": "2026-03-23T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--728fbee6-0704-40ee-9b09-ca2c2d99ad08",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.252.6.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T20:05:03.000Z",
      "valid_until": "2026-04-24T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T19:57:09.299Z",
      "x_nadsec_last_seen": "2026-03-23T19:59:15.326Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-23T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--e3ef5f53-b2d5-48fb-8720-68faaba7bde3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.61.44.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T20:05:03.000Z",
      "valid_until": "2026-04-24T20:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T19:08:19.237Z",
      "x_nadsec_last_seen": "2026-03-24T17:34:37.878Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--0b941f9d-076a-4fd0-9664-79149b4a0c61",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '86.98.49.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T20:05:03.000Z",
      "valid_until": "2026-04-24T20:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-23T19:15:30.601Z",
      "x_nadsec_last_seen": "2026-03-28T04:52:19.656Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-03-23T21:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--e9df8461-52ba-4965-be59-9a8217b01342",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.30.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:05:54.000Z",
      "valid_until": "2026-04-24T21:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T20:31:01.820Z",
      "x_nadsec_last_seen": "2026-03-23T20:31:02.325Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-23T21:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=262606; asn_org=MICROTELL SCM LTDA",
      "id": "indicator--2249068a-b560-44ad-a864-cc10b38986f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.101.43.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:05:54.000Z",
      "valid_until": "2026-04-24T21:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T20:17:07.646Z",
      "x_nadsec_last_seen": "2026-03-23T20:17:08.045Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262606"
      ],
      "x_nadsec_orgs": [
        "MICROTELL SCM LTDA"
      ]
    },
    {
      "created": "2026-03-23T21:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=28580; asn_org=Cilnet Comunicacao e Informatica S.A.",
      "id": "indicator--4dd84991-ef34-48cf-82c4-ddaad8fc81fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.84.8.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:05:54.000Z",
      "valid_until": "2026-04-24T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T20:36:26.600Z",
      "x_nadsec_last_seen": "2026-03-23T20:38:34.293Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28580"
      ],
      "x_nadsec_orgs": [
        "Cilnet Comunicacao e Informatica S.A."
      ]
    },
    {
      "created": "2026-03-23T21:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--f0d1a70e-b01d-469b-b532-2e0a9ae5081d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.221.149.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:05:54.000Z",
      "valid_until": "2026-04-24T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T20:33:25.858Z",
      "x_nadsec_last_seen": "2026-03-23T20:35:32.554Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-03-23T21:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--7330c72d-a585-4b4d-848a-f43b86826036",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:05:54.000Z",
      "valid_until": "2026-04-24T21:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T21:03:34.918Z",
      "x_nadsec_last_seen": "2026-03-24T03:40:31.275Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-23T21:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=AT; asn=174; asn_org=Cogent Communications, LLC",
      "id": "indicator--6f170d19-b760-4fd6-851c-0901c289fefe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.59.22.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:05:54.000Z",
      "valid_until": "2026-04-24T21:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T20:31:22.782Z",
      "x_nadsec_last_seen": "2026-03-23T20:31:29.700Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AT"
      ],
      "x_nadsec_asns": [
        "174"
      ],
      "x_nadsec_orgs": [
        "Cogent Communications, LLC"
      ],
      "x_nadsec_usernames_attempted": [
        ""
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T21:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--49f5baeb-5c51-49ef-a970-f1a75bf5b47e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:05:54.000Z",
      "valid_until": "2026-04-24T21:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T20:59:26.356Z",
      "x_nadsec_last_seen": "2026-03-28T15:33:04.919Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-23T21:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=43132; asn_org=Rostelecom",
      "id": "indicator--10687ca4-59c7-48e1-a65f-66b39ec1e41f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.173.112.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:05:54.000Z",
      "valid_until": "2026-04-24T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T20:57:50.406Z",
      "x_nadsec_last_seen": "2026-03-23T20:59:57.441Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "43132"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-23T21:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f5796544-3100-473d-84f5-75d5b77e5a3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:05:54.000Z",
      "valid_until": "2026-04-24T21:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T20:28:14.811Z",
      "x_nadsec_last_seen": "2026-03-29T07:16:07.979Z",
      "x_nadsec_ports": [
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-23T21:05:54.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--34502983-4b02-4b1a-835a-3c4a12e131fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T21:05:54.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T21:05:54.000Z",
      "valid_until": "2026-04-24T21:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T20:28:15.240Z",
      "x_nadsec_last_seen": "2026-03-23T20:28:15.240Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-23T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d29ea6fb-039c-430a-adbf-8f2b7d99ba0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.224.228.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T22:05:03.000Z",
      "valid_until": "2026-04-24T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T21:43:53.343Z",
      "x_nadsec_last_seen": "2026-03-23T21:45:58.042Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-23T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "id": "indicator--0548eb24-fdf0-4c0b-8d71-4f12927cdcc2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.117.159.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T22:05:03.000Z",
      "valid_until": "2026-04-24T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T21:50:33.142Z",
      "x_nadsec_last_seen": "2026-03-23T21:52:39.904Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ]
    },
    {
      "created": "2026-03-23T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--749fd5c3-d88a-41b5-b394-e4a98592edd8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.189.84.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T22:05:03.000Z",
      "valid_until": "2026-04-24T22:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T21:26:46.901Z",
      "x_nadsec_last_seen": "2026-03-27T01:44:12.892Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KZ; asn=9198; asn_org=JSC Kazakhtelecom",
      "id": "indicator--53d17ed0-bea3-43a7-acc7-c51f9191933a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.200.178.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T22:05:03.000Z",
      "valid_until": "2026-04-24T22:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-23T22:02:23.659Z",
      "x_nadsec_last_seen": "2026-03-23T22:34:54.543Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "9198"
      ],
      "x_nadsec_orgs": [
        "JSC Kazakhtelecom"
      ]
    },
    {
      "created": "2026-03-23T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--a00ce505-5f52-4b3f-adee-37c4364ba5b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T22:05:03.000Z",
      "valid_until": "2026-04-24T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T21:16:30.067Z",
      "x_nadsec_last_seen": "2026-03-23T21:16:30.067Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-23T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--c6648356-d3e0-4f45-8d5f-f166044c564e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.50.37.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:05:03.000Z",
      "valid_until": "2026-04-24T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T22:18:45.237Z",
      "x_nadsec_last_seen": "2026-03-23T22:20:51.978Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-23T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7b0bf389-5edd-49ed-91f5-6933d2f66b4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:05:03.000Z",
      "valid_until": "2026-04-24T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T23:01:17.727Z",
      "x_nadsec_last_seen": "2026-03-23T23:01:17.727Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-23T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=DZ; asn=36947; asn_org=Telecom Algeria; user(top)=**",
      "id": "indicator--95f30e5f-86e4-472f-bc4d-f1416c758ec8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.241.84.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:05:03.000Z",
      "valid_until": "2026-04-24T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T22:08:35.387Z",
      "x_nadsec_last_seen": "2026-03-23T22:08:35.387Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-23T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--610eea6f-7b4e-4ad4-b9c6-f0d2bfcef174",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.128.124.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:05:03.000Z",
      "valid_until": "2026-04-24T23:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-23T22:08:42.159Z",
      "x_nadsec_last_seen": "2026-03-25T11:19:11.928Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-23T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--bd368653-9758-40d3-a424-f177c62d7600",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-23T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.155.126.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:05:03.000Z",
      "valid_until": "2026-04-24T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T22:22:41.973Z",
      "x_nadsec_last_seen": "2026-03-23T22:24:47.858Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-24T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--0f9ad332-84d4-4202-811e-12767118af78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.99.151.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T00:05:03.000Z",
      "valid_until": "2026-04-25T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-23T23:29:15.414Z",
      "x_nadsec_last_seen": "2026-03-23T23:31:22.065Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-03-24T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bb0afc63-7e8a-4ef7-89c7-ea123c581c68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T00:05:03.000Z",
      "valid_until": "2026-04-25T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T23:07:09.983Z",
      "x_nadsec_last_seen": "2026-03-23T23:07:09.983Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-24T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--87f696c0-d7fb-4a22-98ff-baad3862f1fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T00:05:03.000Z",
      "valid_until": "2026-04-25T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-23T23:31:45.223Z",
      "x_nadsec_last_seen": "2026-03-31T09:13:01.078Z",
      "x_nadsec_ports": [
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-24T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--5dc1076b-c099-4acb-8031-22246e358b6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T00:05:03.000Z",
      "valid_until": "2026-04-25T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-23T23:28:13.304Z",
      "x_nadsec_last_seen": "2026-03-23T23:28:13.304Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-24T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--28a7418f-7529-4008-8c32-872163704a4f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '100.55.25.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:05:02.000Z",
      "valid_until": "2026-04-25T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T00:51:28.233Z",
      "x_nadsec_last_seen": "2026-03-24T00:51:28.233Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-24T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--1a9c75e0-f5bc-4d49-a2ae-4008e07c8df5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.201.108.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:05:02.000Z",
      "valid_until": "2026-04-25T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T00:49:25.170Z",
      "x_nadsec_last_seen": "2026-03-24T00:51:29.746Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-24T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--b4266fea-5e24-41e6-b4e4-9d75c9a1d8c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.127.10.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:05:02.000Z",
      "valid_until": "2026-04-25T01:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T00:14:59.124Z",
      "x_nadsec_last_seen": "2026-03-24T00:21:20.301Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-24T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--cb8dd650-c2b1-4ccb-99f7-002fb2bba4dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.49.94.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:05:02.000Z",
      "valid_until": "2026-04-25T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T00:49:32.525Z",
      "x_nadsec_last_seen": "2026-03-24T00:51:36.906Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-03-24T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=SG; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b76f7624-cc90-4350-9daa-5efbe47b093f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '168.144.40.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:05:02.000Z",
      "valid_until": "2026-04-25T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T00:07:58.297Z",
      "x_nadsec_last_seen": "2026-03-24T00:07:58.297Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-24T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--e1e6e3f8-e643-4a87-b715-35187adcf16c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.88.119.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:05:02.000Z",
      "valid_until": "2026-04-25T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T00:13:48.928Z",
      "x_nadsec_last_seen": "2026-03-24T00:15:54.898Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-24T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TN; asn=37671; asn_org=GLOBALNET-AS",
      "id": "indicator--466c702b-674b-49f4-a269-73f6ccbcc2f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.225.231.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:05:02.000Z",
      "valid_until": "2026-04-25T01:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T00:05:33.327Z",
      "x_nadsec_last_seen": "2026-03-24T00:12:35.283Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37671"
      ],
      "x_nadsec_orgs": [
        "GLOBALNET-AS"
      ]
    },
    {
      "created": "2026-03-24T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--57f2c39f-debe-4cba-9bda-1931064157cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.193.74.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:05:02.000Z",
      "valid_until": "2026-04-25T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T01:56:43.571Z",
      "x_nadsec_last_seen": "2026-03-24T01:56:43.571Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-24T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=12252; asn_org=America Movil Peru S.A.C.",
      "id": "indicator--62701cdf-aa89-4d1f-a0ab-119b1c294d39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.6.1.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:05:02.000Z",
      "valid_until": "2026-04-25T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T01:28:16.226Z",
      "x_nadsec_last_seen": "2026-03-24T01:28:22.368Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "12252"
      ],
      "x_nadsec_orgs": [
        "America Movil Peru S.A.C."
      ]
    },
    {
      "created": "2026-03-24T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--9e376067-677e-4ac3-8822-335a76c8baf5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.35.35.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:05:02.000Z",
      "valid_until": "2026-04-25T02:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-24T01:14:25.729Z",
      "x_nadsec_last_seen": "2026-03-24T01:15:19.529Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-24T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--cb5c7e53-f8f0-436d-9d81-80427400823d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.81.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:05:02.000Z",
      "valid_until": "2026-04-25T02:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T01:28:19.898Z",
      "x_nadsec_last_seen": "2026-03-24T01:28:20.470Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-24T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ab896f87-10de-4245-af16-f38c99ee94d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.172.70.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:05:02.000Z",
      "valid_until": "2026-04-25T02:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T01:51:50.919Z",
      "x_nadsec_last_seen": "2026-03-24T01:52:01.070Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-24T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=LA; asn=9873; asn_org=Lao Telecom Communication, LTC",
      "id": "indicator--a1d7d8f5-5a93-4b23-8d4f-c78ab4cd26f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.137.154.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:05:02.000Z",
      "valid_until": "2026-04-25T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T02:01:08.501Z",
      "x_nadsec_last_seen": "2026-03-24T02:03:13.195Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "9873"
      ],
      "x_nadsec_orgs": [
        "Lao Telecom Communication, LTC"
      ]
    },
    {
      "created": "2026-03-24T02:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--1406f9b1-5c62-40f3-997e-a70ca6e808f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T02:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:05:02.000Z",
      "valid_until": "2026-04-25T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T01:51:21.789Z",
      "x_nadsec_last_seen": "2026-03-24T01:51:21.789Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-24T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=136119; asn_org=PT Bali Towerindo Sentra, Tbk",
      "id": "indicator--8f84d249-f150-4d33-bf2b-110bb71a4cee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.119.147.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:05:04.000Z",
      "valid_until": "2026-04-25T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T02:27:23.204Z",
      "x_nadsec_last_seen": "2026-03-24T02:33:33.927Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "136119"
      ],
      "x_nadsec_orgs": [
        "PT Bali Towerindo Sentra, Tbk"
      ]
    },
    {
      "created": "2026-03-24T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--a223ab13-2558-4c14-96ae-68cc9a8f37e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.75.40.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:05:04.000Z",
      "valid_until": "2026-04-25T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T02:28:54.081Z",
      "x_nadsec_last_seen": "2026-03-24T02:29:00.703Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-03-24T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--9dd1d4bb-45ed-4f3b-a214-db2e8c12dd58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.93.48.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:05:04.000Z",
      "valid_until": "2026-04-25T03:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-24T02:59:45.867Z",
      "x_nadsec_last_seen": "2026-03-24T04:03:20.793Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-03-24T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--2825a5be-e878-4737-bb54-724a87c27600",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.178.35.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:05:04.000Z",
      "valid_until": "2026-04-25T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T02:36:52.464Z",
      "x_nadsec_last_seen": "2026-03-24T02:38:57.171Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-24T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--e4251a95-ca85-43ef-a738-6c4748ce64f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.241.67.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:05:04.000Z",
      "valid_until": "2026-04-25T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T02:39:28.432Z",
      "x_nadsec_last_seen": "2026-03-24T02:41:34.971Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-24T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--8dd8c9c5-1aa1-4987-8efa-de51a738f475",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.148.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:05:04.000Z",
      "valid_until": "2026-04-25T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T02:12:59.855Z",
      "x_nadsec_last_seen": "2026-03-24T02:13:11.057Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-24T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=RU; asn=43826; asn_org=CSIT LLC; user(top)=a***n; pass(top)=a***n",
      "id": "indicator--667ca896-67fa-47ac-9bdb-6c82d6f20ca9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.132.240.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:05:04.000Z",
      "valid_until": "2026-04-25T03:05:01.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-24T01:59:51.148Z",
      "x_nadsec_last_seen": "2026-03-24T06:19:36.302Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "43826"
      ],
      "x_nadsec_orgs": [
        "CSIT LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a***n",
        "g***t",
        "u**r"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "1**4",
        "1***5",
        "1****6",
        "1*****7"
      ]
    },
    {
      "created": "2026-03-24T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--fd0d6262-9c42-4d9f-9f40-46c62099a1a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.211.99.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:05:04.000Z",
      "valid_until": "2026-04-25T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T02:25:42.209Z",
      "x_nadsec_last_seen": "2026-03-24T02:25:42.209Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-24T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=28015; asn_org=MERCO COMUNICACIONES",
      "id": "indicator--02bec273-c43f-4178-8de8-66894786a296",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.219.170.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:05:04.000Z",
      "valid_until": "2026-04-25T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T02:52:14.511Z",
      "x_nadsec_last_seen": "2026-03-24T02:54:21.034Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "28015"
      ],
      "x_nadsec_orgs": [
        "MERCO COMUNICACIONES"
      ]
    },
    {
      "created": "2026-03-24T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f6069f7b-736b-40f9-b9b0-45af81ba76ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.189.226.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:05:04.000Z",
      "valid_until": "2026-04-25T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T02:44:06.913Z",
      "x_nadsec_last_seen": "2026-03-24T02:44:06.913Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-24T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9b5b60b6-ede7-4c44-9503-bb869105dd56",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '24.144.110.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:05:04.000Z",
      "valid_until": "2026-04-25T03:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-24T02:13:11.738Z",
      "x_nadsec_last_seen": "2026-03-24T07:42:39.722Z",
      "x_nadsec_ports": [
        "1883",
        "1433"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-24T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--560064df-2cfb-40e2-8af8-bc86df615393",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.140.251.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:05:04.000Z",
      "valid_until": "2026-04-25T03:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-24T02:53:11.674Z",
      "x_nadsec_last_seen": "2026-03-24T03:13:35.134Z",
      "x_nadsec_ports": [
        "21",
        "445"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-24T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--4224f695-37a2-4bc8-96ee-dcc6de3c8a3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.181.181.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:05:04.000Z",
      "valid_until": "2026-04-25T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T02:45:33.891Z",
      "x_nadsec_last_seen": "2026-03-24T02:53:02.449Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-03-24T03:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--8d9d5657-6a90-483c-bd1e-91954b8b35ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T03:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:05:04.000Z",
      "valid_until": "2026-04-25T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T02:05:25.316Z",
      "x_nadsec_last_seen": "2026-03-24T02:05:25.316Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-24T04:06:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--20ef3851-86bc-4061-9465-43c9b3c7ea5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T04:06:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.178.46.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T04:06:18.000Z",
      "valid_until": "2026-04-25T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T03:16:02.960Z",
      "x_nadsec_last_seen": "2026-03-24T03:18:07.676Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-24T04:06:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0f56676c-4612-4fe7-8ef9-89627400d239",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T04:06:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.182.178.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T04:06:18.000Z",
      "valid_until": "2026-04-25T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T03:37:34.754Z",
      "x_nadsec_last_seen": "2026-03-24T03:37:34.754Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-24T04:06:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--93e08838-a06a-4a1e-8f29-2a7473d5ec7e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T04:06:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.199.67.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T04:06:18.000Z",
      "valid_until": "2026-04-25T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T03:26:44.664Z",
      "x_nadsec_last_seen": "2026-03-24T03:26:44.664Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-24T04:06:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--9d7acb73-4b06-4f69-b6a8-ca543aa17cae",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T04:06:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.205.38.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T04:06:18.000Z",
      "valid_until": "2026-04-25T04:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T03:06:33.363Z",
      "x_nadsec_last_seen": "2026-03-24T03:12:48.001Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-24T04:06:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=23688; asn_org=Link3 Technologies Ltd.",
      "id": "indicator--9b78cb97-9204-43f6-b635-430089279553",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T04:06:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.147.137.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T04:06:18.000Z",
      "valid_until": "2026-04-25T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T03:06:30.318Z",
      "x_nadsec_last_seen": "2026-03-24T03:08:36.296Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23688"
      ],
      "x_nadsec_orgs": [
        "Link3 Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-24T04:06:18.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--56474382-41f2-495c-b9f8-6a3a1f1044a5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T04:06:18.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '68.183.18.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T04:06:18.000Z",
      "valid_until": "2026-04-25T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T03:37:33.936Z",
      "x_nadsec_last_seen": "2026-03-24T03:37:33.936Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-24T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--06bcbd4c-a92b-463a-afd4-ef8878557588",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.108.169.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:05:02.000Z",
      "valid_until": "2026-04-25T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T04:32:50.171Z",
      "x_nadsec_last_seen": "2026-03-24T04:34:54.816Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-24T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=45588; asn_org=Bangladesh Telecommunications Company Limited BTCL, Nationwide PSTN Operator and Data and In",
      "id": "indicator--301aaddd-2b77-4bbc-b06d-aeafd97c8fbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.130.168.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:05:02.000Z",
      "valid_until": "2026-04-25T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T04:21:52.830Z",
      "x_nadsec_last_seen": "2026-03-24T04:27:21.639Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "45588"
      ],
      "x_nadsec_orgs": [
        "Bangladesh Telecommunications Company Limited BTCL, Nationwide PSTN Operator and Data and In"
      ]
    },
    {
      "created": "2026-03-24T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--adaec145-0f13-41a5-bfdf-c3055fa493e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.118.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:05:02.000Z",
      "valid_until": "2026-04-25T05:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-24T04:16:09.066Z",
      "x_nadsec_last_seen": "2026-03-24T04:18:17.755Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-24T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--807cebde-32e3-40b8-8a17-5d4b64293ad6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.102.36.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:05:02.000Z",
      "valid_until": "2026-04-25T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T04:15:35.793Z",
      "x_nadsec_last_seen": "2026-03-24T04:15:35.821Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-24T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--60e6dd63-225e-474f-9c8f-d6c574edd192",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:05:02.000Z",
      "valid_until": "2026-04-25T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T04:33:59.687Z",
      "x_nadsec_last_seen": "2026-03-24T04:34:00.120Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-24T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--096fd641-1529-4971-be0d-a1de640e09a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:05:02.000Z",
      "valid_until": "2026-04-25T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T04:31:50.283Z",
      "x_nadsec_last_seen": "2026-03-24T04:31:50.283Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-24T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--ff7c6c6c-6f15-4a73-b045-61340e4fc2b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:05:02.000Z",
      "valid_until": "2026-04-25T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T04:35:09.132Z",
      "x_nadsec_last_seen": "2026-03-30T23:35:46.797Z",
      "x_nadsec_ports": [
        "135",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-24T05:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=21056; asn_org=Vianova S.p.A",
      "id": "indicator--282142fd-f5a2-486b-ab39-4a7219dfdae5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T05:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.135.36.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:05:02.000Z",
      "valid_until": "2026-04-25T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T04:18:28.734Z",
      "x_nadsec_last_seen": "2026-03-24T04:20:35.398Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "21056"
      ],
      "x_nadsec_orgs": [
        "Vianova S.p.A"
      ]
    },
    {
      "created": "2026-03-24T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134021; asn_org=Airgenie Communications Private Limited",
      "id": "indicator--e071440a-7205-475a-9b33-a727cbc610fd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.220.39.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:05:02.000Z",
      "valid_until": "2026-04-25T06:05:00.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-24T05:34:11.260Z",
      "x_nadsec_last_seen": "2026-03-25T01:24:13.649Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134021"
      ],
      "x_nadsec_orgs": [
        "Airgenie Communications Private Limited"
      ]
    },
    {
      "created": "2026-03-24T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b255294e-bac8-4602-b935-ccffcb1c32e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.89.125.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:05:02.000Z",
      "valid_until": "2026-04-25T06:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T05:46:25.965Z",
      "x_nadsec_last_seen": "2026-03-24T05:46:36.139Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-24T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--df970ce4-fa6c-4381-8f23-d41abdece00c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.177.134.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:05:02.000Z",
      "valid_until": "2026-04-25T06:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T05:12:30.739Z",
      "x_nadsec_last_seen": "2026-03-24T05:19:08.833Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-24T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6cb93448-e7fe-4497-90ca-09aaab290332",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:05:02.000Z",
      "valid_until": "2026-04-25T06:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T05:55:43.845Z",
      "x_nadsec_last_seen": "2026-03-27T18:37:40.688Z",
      "x_nadsec_ports": [
        "135",
        "3306"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-24T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--4322b169-9b5f-41eb-8c99-62a071c3322a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.44.152.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:05:02.000Z",
      "valid_until": "2026-04-25T06:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T05:44:34.472Z",
      "x_nadsec_last_seen": "2026-03-24T05:46:41.639Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-24T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=34058; asn_org=Limited Liability Company lifecell",
      "id": "indicator--87e86e53-f0c1-4d33-9599-9c5619def54f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.73.1.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:05:02.000Z",
      "valid_until": "2026-04-25T06:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T05:34:08.522Z",
      "x_nadsec_last_seen": "2026-03-24T05:36:15.389Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "34058"
      ],
      "x_nadsec_orgs": [
        "Limited Liability Company lifecell"
      ]
    },
    {
      "created": "2026-03-24T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--db787301-9c02-42df-ba2f-67af6f8de11d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:05:02.000Z",
      "valid_until": "2026-04-25T06:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T05:52:16.626Z",
      "x_nadsec_last_seen": "2026-03-24T05:52:26.962Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-24T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--1623e66b-dd4c-434b-8049-e98573450f7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.210.158.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:05:02.000Z",
      "valid_until": "2026-04-25T06:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T05:41:41.267Z",
      "x_nadsec_last_seen": "2026-03-24T05:41:41.267Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-24T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--8337d2c3-6ae8-4261-8bc7-226e63a09452",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.109.250.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:05:03.000Z",
      "valid_until": "2026-04-25T07:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T06:58:48.282Z",
      "x_nadsec_last_seen": "2026-03-24T06:58:48.405Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-24T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--8f0d84b8-0692-4656-96b0-20ad9ad95692",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.242.98.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:05:03.000Z",
      "valid_until": "2026-04-25T07:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T06:24:54.150Z",
      "x_nadsec_last_seen": "2026-03-24T06:24:54.348Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-24T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b1c59f00-25c1-486d-9da6-df9ab1b3227d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.236.12.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:05:03.000Z",
      "valid_until": "2026-04-25T07:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T06:46:19.433Z",
      "x_nadsec_last_seen": "2026-03-24T06:52:53.506Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-24T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--2189844c-a6b4-48cd-bddf-d32ae1f43109",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:05:03.000Z",
      "valid_until": "2026-04-25T07:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T06:35:49.394Z",
      "x_nadsec_last_seen": "2026-03-27T16:50:30.676Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-24T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--ce6ae76b-3571-487b-aa0c-86d327ad2725",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.235.123.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:05:03.000Z",
      "valid_until": "2026-04-25T07:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T07:04:53.477Z",
      "x_nadsec_last_seen": "2026-03-24T07:11:55.000Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-24T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=9387; asn_org=SHARP TELECOM PRIVATE LIMITED",
      "id": "indicator--ec0a70c2-78db-410d-af97-3ab7a95ec4f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.178.129.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:05:03.000Z",
      "valid_until": "2026-04-25T07:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T06:52:33.514Z",
      "x_nadsec_last_seen": "2026-03-24T06:54:38.978Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9387"
      ],
      "x_nadsec_orgs": [
        "SHARP TELECOM PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-24T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--da585f28-7473-4102-8035-e88fecb29aa1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:05:03.000Z",
      "valid_until": "2026-04-25T07:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T06:21:11.617Z",
      "x_nadsec_last_seen": "2026-03-24T06:21:12.532Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-24T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bf1982a2-68f5-4451-ac53-9b4898247edf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.102.116.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:05:03.000Z",
      "valid_until": "2026-04-25T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T06:32:49.975Z",
      "x_nadsec_last_seen": "2026-03-24T06:32:49.975Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-24T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--791305eb-d1ac-4570-a465-c27f829ebebf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.84.61.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:05:03.000Z",
      "valid_until": "2026-04-25T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T06:32:42.765Z",
      "x_nadsec_last_seen": "2026-03-24T06:32:42.765Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-24T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--c317f5d7-ab95-4320-a10b-36b4b51e4c16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.205.166.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:05:03.000Z",
      "valid_until": "2026-04-25T07:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-24T06:59:40.748Z",
      "x_nadsec_last_seen": "2026-03-29T08:00:09.458Z",
      "x_nadsec_ports": [
        "27017",
        "3306"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-24T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--707c6c9a-a87f-448b-bea5-a45ae8828abf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.80.32.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:05:03.000Z",
      "valid_until": "2026-04-25T07:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-24T07:03:34.559Z",
      "x_nadsec_last_seen": "2026-03-24T07:05:40.169Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-03-24T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--6d22ab3d-9c64-4ee4-a0bc-34a9fe0ccdac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T07:05:03.000Z",
      "valid_until": "2026-04-25T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T06:34:12.341Z",
      "x_nadsec_last_seen": "2026-03-24T06:34:12.341Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-24T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=IN; asn=136287; asn_org=Falconet Internet Pvt.ltd.",
      "id": "indicator--1846902c-f7f1-43d0-ada2-7243894a4996",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.164.204.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T08:05:02.000Z",
      "valid_until": "2026-04-25T08:05:00.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-03-24T08:01:28.300Z",
      "x_nadsec_last_seen": "2026-03-24T08:03:04.183Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "136287"
      ],
      "x_nadsec_orgs": [
        "Falconet Internet Pvt.ltd."
      ]
    },
    {
      "created": "2026-03-24T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=23956; asn_org=AmberIT Limited",
      "id": "indicator--0dcae8e0-b3e8-4816-b423-ebdf80923e6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.179.220.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T08:05:02.000Z",
      "valid_until": "2026-04-25T08:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T07:44:50.863Z",
      "x_nadsec_last_seen": "2026-03-24T07:46:55.599Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23956"
      ],
      "x_nadsec_orgs": [
        "AmberIT Limited"
      ]
    },
    {
      "created": "2026-03-24T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=28150; asn_org=CDT Network Ltda",
      "id": "indicator--3577dd40-9127-4ff1-bbc5-9ca1553a8b91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.60.22.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T08:05:02.000Z",
      "valid_until": "2026-04-25T08:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-24T07:09:36.668Z",
      "x_nadsec_last_seen": "2026-03-24T07:10:48.461Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28150"
      ],
      "x_nadsec_orgs": [
        "CDT Network Ltda"
      ]
    },
    {
      "created": "2026-03-24T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--11f89c53-590a-48cb-a8ff-11615816e110",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T08:05:02.000Z",
      "valid_until": "2026-04-25T08:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T07:10:18.219Z",
      "x_nadsec_last_seen": "2026-03-24T07:10:50.873Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-24T08:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--3f400e42-cdfb-4150-b6d4-fb109eea3ba8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T08:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '208.68.37.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T08:05:02.000Z",
      "valid_until": "2026-04-25T08:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T07:42:31.947Z",
      "x_nadsec_last_seen": "2026-03-24T07:42:31.947Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-24T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--4fb48577-725c-4400-8ae9-9e92240bb10e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.4.113.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:05:02.000Z",
      "valid_until": "2026-04-25T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T08:49:39.660Z",
      "x_nadsec_last_seen": "2026-03-24T08:51:44.344Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-24T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--b33d09bc-de36-4972-b152-c665f1c76e02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.70.80.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:05:02.000Z",
      "valid_until": "2026-04-25T09:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T08:58:53.261Z",
      "x_nadsec_last_seen": "2026-03-24T09:04:56.303Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-24T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--8e6bd8cc-11a0-431f-a5f1-83011bff30e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.107.131.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:05:02.000Z",
      "valid_until": "2026-04-25T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T08:34:51.133Z",
      "x_nadsec_last_seen": "2026-03-24T08:36:56.031Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-24T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--27e317ab-5210-44ef-a722-843f1b8da34e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:05:02.000Z",
      "valid_until": "2026-04-25T09:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T08:42:56.126Z",
      "x_nadsec_last_seen": "2026-03-24T08:42:56.398Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-24T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--c9d3951e-90ca-4598-a563-b89c91277187",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.18.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:05:02.000Z",
      "valid_until": "2026-04-25T09:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T08:19:10.468Z",
      "x_nadsec_last_seen": "2026-03-24T08:25:40.437Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-24T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--633b0b50-3a79-434e-b01a-3f6bc37c76f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.118.101.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:05:02.000Z",
      "valid_until": "2026-04-25T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T08:25:41.001Z",
      "x_nadsec_last_seen": "2026-03-24T08:27:47.701Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-03-24T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--8f008bfa-530b-446a-a01d-68ed411cf885",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.33.134.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:05:02.000Z",
      "valid_until": "2026-04-25T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T08:51:08.302Z",
      "x_nadsec_last_seen": "2026-03-24T08:53:14.997Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-03-24T09:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--72ca4efb-ddb0-42c6-89f5-edaee13646c9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T09:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.33.106.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:05:02.000Z",
      "valid_until": "2026-04-25T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T08:36:05.266Z",
      "x_nadsec_last_seen": "2026-03-24T08:36:11.558Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-24T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=140950; asn_org=SYNC ONLINE",
      "id": "indicator--589ffdb5-39d8-41c0-adbb-49ca0cd31d28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.153.174.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T10:05:03.000Z",
      "valid_until": "2026-04-25T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T09:50:28.937Z",
      "x_nadsec_last_seen": "2026-03-24T09:57:38.161Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "140950"
      ],
      "x_nadsec_orgs": [
        "SYNC ONLINE"
      ]
    },
    {
      "created": "2026-03-24T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--33a69046-6ce4-4719-9ec2-031d2d1d8bfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T10:05:03.000Z",
      "valid_until": "2026-04-25T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T09:10:46.350Z",
      "x_nadsec_last_seen": "2026-03-24T09:10:46.350Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-24T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--6fe425a5-f90d-4d1e-a537-778ec3a9d290",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.80.80.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T10:05:03.000Z",
      "valid_until": "2026-04-25T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T09:46:29.982Z",
      "x_nadsec_last_seen": "2026-03-24T09:46:30.329Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-24T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=23974; asn_org=Ministry of education",
      "id": "indicator--1154af21-0d58-4e7e-8eab-66573f8444e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.172.176.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T10:05:03.000Z",
      "valid_until": "2026-04-25T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T09:09:54.620Z",
      "x_nadsec_last_seen": "2026-03-24T09:11:59.835Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23974"
      ],
      "x_nadsec_orgs": [
        "Ministry of education"
      ]
    },
    {
      "created": "2026-03-24T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--b7c0864b-d865-4970-9b4e-b29e427869e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.77.28.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T10:05:03.000Z",
      "valid_until": "2026-04-25T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T09:58:45.310Z",
      "x_nadsec_last_seen": "2026-03-24T10:04:44.076Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-24T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--47bf310b-f3e5-4fb3-a8da-50161c230025",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.33.221.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T10:05:03.000Z",
      "valid_until": "2026-04-25T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T09:58:33.593Z",
      "x_nadsec_last_seen": "2026-03-24T10:05:13.517Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-24T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=48642; asn_org=Joint stock company For",
      "id": "indicator--6ce34661-942c-49a0-9521-8240d851047e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.36.23.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T10:05:03.000Z",
      "valid_until": "2026-04-25T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T09:52:47.272Z",
      "x_nadsec_last_seen": "2026-03-24T09:58:36.641Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "48642"
      ],
      "x_nadsec_orgs": [
        "Joint stock company For"
      ]
    },
    {
      "created": "2026-03-24T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--62927db6-1af5-48f4-ac83-97feade90ed8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T10:05:03.000Z",
      "valid_until": "2026-04-25T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T09:50:49.977Z",
      "x_nadsec_last_seen": "2026-03-30T18:56:17.652Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-24T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--8f6b965c-af31-4fee-b31c-bba76dc58c8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.223.105.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T10:05:03.000Z",
      "valid_until": "2026-04-25T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T09:50:31.863Z",
      "x_nadsec_last_seen": "2026-03-24T09:58:28.496Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-24T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d7dc1d65-d30f-4ecd-91a6-728945586548",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T10:05:03.000Z",
      "valid_until": "2026-04-25T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T09:24:59.016Z",
      "x_nadsec_last_seen": "2026-03-24T09:24:59.725Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-24T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=12735; asn_org=TurkNet Iletisim Hizmetleri A.S.",
      "id": "indicator--b1b266b1-3eda-4984-894c-1b85edd1d9e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.70.198.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T10:05:03.000Z",
      "valid_until": "2026-04-25T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T09:29:32.006Z",
      "x_nadsec_last_seen": "2026-03-24T09:31:38.218Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "12735"
      ],
      "x_nadsec_orgs": [
        "TurkNet Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-24T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--eb901f3c-ab7f-4165-ac2e-80735d7f4c17",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.99.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T11:05:02.000Z",
      "valid_until": "2026-04-25T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T10:20:11.204Z",
      "x_nadsec_last_seen": "2026-03-24T10:22:18.701Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-24T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fe1984dc-ba7f-4e6d-a39e-901d993cdeb3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.176.14.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T11:05:02.000Z",
      "valid_until": "2026-04-25T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T10:48:26.472Z",
      "x_nadsec_last_seen": "2026-03-24T10:54:52.592Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-24T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=NG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--2941c7e9-6756-45d7-93bf-c6b05ec74e9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.141.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T11:05:02.000Z",
      "valid_until": "2026-04-25T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T10:29:19.059Z",
      "x_nadsec_last_seen": "2026-03-24T10:29:39.816Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-24T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CO; asn=3816; asn_org=COLOMBIA TELECOMUNICACIONES S.A. ESP BIC",
      "id": "indicator--e842f894-a7b1-4f0a-9169-f36c3d55bc7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.119.139.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T11:05:02.000Z",
      "valid_until": "2026-04-25T11:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-05T13:47:47.824Z",
      "x_nadsec_last_seen": "2026-03-24T10:28:15.426Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "3816"
      ],
      "x_nadsec_orgs": [
        "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"
      ]
    },
    {
      "created": "2026-03-24T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--5c0d0049-2f2b-4a54-b9af-d757e34ce2e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.203.111.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T11:05:02.000Z",
      "valid_until": "2026-04-25T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T10:38:02.141Z",
      "x_nadsec_last_seen": "2026-03-24T10:38:02.141Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-03-24T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=154192; asn_org=NXG WEBFINITY PRIVATE LIMITED",
      "id": "indicator--318dbfe1-22d4-42c9-a30a-fd79831183ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.133.70.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T11:05:02.000Z",
      "valid_until": "2026-04-25T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T10:27:48.848Z",
      "x_nadsec_last_seen": "2026-03-24T10:29:53.900Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "154192"
      ],
      "x_nadsec_orgs": [
        "NXG WEBFINITY PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-24T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=17488; asn_org=Hathway IP Over Cable Internet",
      "id": "indicator--72128195-3309-41b6-890f-d4ed47669f04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.243.28.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T11:05:02.000Z",
      "valid_until": "2026-04-25T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T10:06:31.500Z",
      "x_nadsec_last_seen": "2026-03-24T10:12:50.060Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17488"
      ],
      "x_nadsec_orgs": [
        "Hathway IP Over Cable Internet"
      ]
    },
    {
      "created": "2026-03-24T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PL; asn=12741; asn_org=Netia SA",
      "id": "indicator--26406a51-9c03-4993-890e-0a6ae256c54c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.233.166.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T11:05:02.000Z",
      "valid_until": "2026-04-25T11:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-24T10:37:03.170Z",
      "x_nadsec_last_seen": "2026-03-24T11:26:46.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "12741"
      ],
      "x_nadsec_orgs": [
        "Netia SA"
      ]
    },
    {
      "created": "2026-03-24T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--08e66a45-a46e-496f-be58-01b6c990d8a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.205.4.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:05:02.000Z",
      "valid_until": "2026-04-25T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T11:13:42.923Z",
      "x_nadsec_last_seen": "2026-03-24T11:15:49.073Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-24T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UZ; asn=59706; asn_org=rubicon Wireless Communication LLC",
      "id": "indicator--3feb860b-cb87-4465-8720-3cd87626ab45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.137.152.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:05:02.000Z",
      "valid_until": "2026-04-25T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T11:15:15.211Z",
      "x_nadsec_last_seen": "2026-03-24T11:17:21.672Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "59706"
      ],
      "x_nadsec_orgs": [
        "rubicon Wireless Communication LLC"
      ]
    },
    {
      "created": "2026-03-24T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--7cc62970-103f-4a25-abdb-459f2c0cd356",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.188.109.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:05:02.000Z",
      "valid_until": "2026-04-25T12:05:00.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-24T11:56:18.737Z",
      "x_nadsec_last_seen": "2026-03-24T12:17:18.569Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-24T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=20485; asn_org=Joint Stock Company TransTeleCom",
      "id": "indicator--b45bebec-9855-4ced-a7d3-c364bc7b7b5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.150.39.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:05:02.000Z",
      "valid_until": "2026-04-25T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T11:14:35.757Z",
      "x_nadsec_last_seen": "2026-03-24T11:16:42.253Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "20485"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company TransTeleCom"
      ]
    },
    {
      "created": "2026-03-24T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SY; asn=29256; asn_org=Syrian Telecommunication Private Closed Joint Stock Company",
      "id": "indicator--0d05a0ae-143c-4dd4-9c28-6a9518333e93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.0.139.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:05:02.000Z",
      "valid_until": "2026-04-25T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T11:33:39.915Z",
      "x_nadsec_last_seen": "2026-03-24T11:35:47.822Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SY"
      ],
      "x_nadsec_asns": [
        "29256"
      ],
      "x_nadsec_orgs": [
        "Syrian Telecommunication Private Closed Joint Stock Company"
      ]
    },
    {
      "created": "2026-03-24T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=GB; asn=22351; asn_org=INTELSAT GLOBAL SERVICE CORPORATION",
      "id": "indicator--4def781e-6398-46bb-bc5e-7ac737da1d1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.255.40.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:05:02.000Z",
      "valid_until": "2026-04-25T12:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-24T12:02:42.430Z",
      "x_nadsec_last_seen": "2026-03-24T12:08:54.645Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "22351"
      ],
      "x_nadsec_orgs": [
        "INTELSAT GLOBAL SERVICE CORPORATION"
      ]
    },
    {
      "created": "2026-03-24T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=FR; asn=15557; asn_org=Societe Francaise Du Radiotelephone - SFR SA",
      "id": "indicator--e06cf1e6-471f-4059-aa87-495db52bc0d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '84.55.162.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:05:02.000Z",
      "valid_until": "2026-04-25T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T11:09:46.447Z",
      "x_nadsec_last_seen": "2026-03-24T11:11:52.974Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "15557"
      ],
      "x_nadsec_orgs": [
        "Societe Francaise Du Radiotelephone - SFR SA"
      ]
    },
    {
      "created": "2026-03-24T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=59191; asn_org=PEERCAST TELECOM INDIA PVT LTD",
      "id": "indicator--aa00ea58-79e2-491d-b551-65a80a85c2f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.218.134.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T13:05:04.000Z",
      "valid_until": "2026-04-25T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T12:08:14.274Z",
      "x_nadsec_last_seen": "2026-03-24T12:08:14.430Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "59191"
      ],
      "x_nadsec_orgs": [
        "PEERCAST TELECOM INDIA PVT LTD"
      ]
    },
    {
      "created": "2026-03-24T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--877cee68-ca39-4816-8089-73f9dbe928f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.243.90.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T13:05:04.000Z",
      "valid_until": "2026-04-25T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T12:37:01.603Z",
      "x_nadsec_last_seen": "2026-03-24T12:39:06.382Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-24T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--39af5df3-ec33-4bc1-b0da-1116934d1da0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.191.34.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T13:05:04.000Z",
      "valid_until": "2026-04-25T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T13:01:06.348Z",
      "x_nadsec_last_seen": "2026-03-24T13:03:11.040Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-24T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=53167; asn_org=SEBRATEL TECNOLOGIA LTDA",
      "id": "indicator--c4215424-5d7e-492d-8316-757aadceb639",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.202.133.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T13:05:04.000Z",
      "valid_until": "2026-04-25T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T12:23:00.810Z",
      "x_nadsec_last_seen": "2026-03-24T12:30:42.533Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "53167"
      ],
      "x_nadsec_orgs": [
        "SEBRATEL TECNOLOGIA LTDA"
      ]
    },
    {
      "created": "2026-03-24T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=16135; asn_org=Turkcell Iletisim Hizmetleri A.s.",
      "id": "indicator--5d79dcae-8b27-458f-b95b-7f18539aa950",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.237.199.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T13:05:04.000Z",
      "valid_until": "2026-04-25T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T12:50:59.418Z",
      "x_nadsec_last_seen": "2026-03-24T12:53:06.418Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "16135"
      ],
      "x_nadsec_orgs": [
        "Turkcell Iletisim Hizmetleri A.s."
      ]
    },
    {
      "created": "2026-03-24T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2083; services=smbd; ports=445; cc=BR; asn=19182; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--7d7343ed-c8f5-4c8c-a7a1-4d3c06699b6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.87.116.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T13:05:04.000Z",
      "valid_until": "2026-04-25T13:05:01.000Z",
      "x_nadsec_event_count": 3147,
      "x_nadsec_first_seen": "2026-03-24T12:19:03.451Z",
      "x_nadsec_last_seen": "2026-03-24T13:25:27.115Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "19182"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-24T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=23966; asn_org=LINKdotNET Telecom Limited",
      "id": "indicator--6030dd0e-b1f4-4972-a141-bbc10d3a5f58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '210.2.130.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T13:05:04.000Z",
      "valid_until": "2026-04-25T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T12:50:04.158Z",
      "x_nadsec_last_seen": "2026-03-24T12:50:04.208Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23966"
      ],
      "x_nadsec_orgs": [
        "LINKdotNET Telecom Limited"
      ]
    },
    {
      "created": "2026-03-24T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--1ff91c20-404d-4fab-bfcf-5e1283a1f954",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '219.217.47.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T13:05:04.000Z",
      "valid_until": "2026-04-25T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T12:16:22.386Z",
      "x_nadsec_last_seen": "2026-03-24T12:16:22.386Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4538"
      ],
      "x_nadsec_orgs": [
        "China Education and Research Network Center"
      ]
    },
    {
      "created": "2026-03-24T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.",
      "id": "indicator--4a9323e5-6084-444c-923a-2d911f55d826",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T13:05:04.000Z",
      "valid_until": "2026-04-25T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T12:38:45.090Z",
      "x_nadsec_last_seen": "2026-03-24T12:38:45.090Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "211680"
      ],
      "x_nadsec_orgs": [
        "Sistemas Informaticos, S.A."
      ]
    },
    {
      "created": "2026-03-24T14:06:40.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=pptpd; ports=1723; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--30f94b75-da7a-4498-b5c1-f29968bdc7d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T14:06:40.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.149.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T14:06:40.000Z",
      "valid_until": "2026-04-25T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-24T13:36:07.540Z",
      "x_nadsec_last_seen": "2026-03-24T13:36:18.985Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-24T14:06:40.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--a3ea5869-f62c-4910-8c48-f795fd702909",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T14:06:40.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.72.141.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T14:06:40.000Z",
      "valid_until": "2026-04-25T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T13:07:50.046Z",
      "x_nadsec_last_seen": "2026-03-24T13:07:50.361Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-03-24T14:06:40.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--de0e4dea-7cc7-4aac-8a77-1d76e7681836",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T14:06:40.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.47.61.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T14:06:40.000Z",
      "valid_until": "2026-04-25T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T13:20:40.749Z",
      "x_nadsec_last_seen": "2026-03-24T13:22:47.946Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-24T14:06:40.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=131; services=smbd; ports=445; cc=ES; asn=41608; asn_org=NextGenWebs, S.L.",
      "id": "indicator--00a7c61d-26a1-4417-8356-04ce7fea6b54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T14:06:40.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.170.172.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T14:06:40.000Z",
      "valid_until": "2026-04-25T14:05:01.000Z",
      "x_nadsec_event_count": 131,
      "x_nadsec_first_seen": "2026-03-24T13:08:05.399Z",
      "x_nadsec_last_seen": "2026-03-24T13:48:36.277Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "41608"
      ],
      "x_nadsec_orgs": [
        "NextGenWebs, S.L."
      ]
    },
    {
      "created": "2026-03-24T14:06:40.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--1df5d378-ca0a-4644-9d74-5a07c7de2a0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T14:06:40.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.246.86.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T14:06:40.000Z",
      "valid_until": "2026-04-25T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T13:08:59.714Z",
      "x_nadsec_last_seen": "2026-03-24T13:08:59.714Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-03-24T14:06:40.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=137692; asn_org=IOT Guangdong network, Chinatelecom, P.R.China.",
      "id": "indicator--5fc66f32-87c4-4aeb-8377-3d196fce3ccc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T14:06:40.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.168.18.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T14:06:40.000Z",
      "valid_until": "2026-04-25T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T13:51:31.079Z",
      "x_nadsec_last_seen": "2026-03-24T13:51:34.473Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "137692"
      ],
      "x_nadsec_orgs": [
        "IOT Guangdong network, Chinatelecom, P.R.China."
      ]
    },
    {
      "created": "2026-03-24T14:06:40.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17665; asn_org=ONEOTT INTERTAINMENT LIMITED",
      "id": "indicator--045dad7c-abb4-4e62-aa28-c7578bea0638",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T14:06:40.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.194.110.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T14:06:40.000Z",
      "valid_until": "2026-04-25T14:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-13T05:51:16.576Z",
      "x_nadsec_last_seen": "2026-03-24T13:29:57.736Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17665"
      ],
      "x_nadsec_orgs": [
        "ONEOTT INTERTAINMENT LIMITED"
      ]
    },
    {
      "created": "2026-03-24T14:06:40.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=GB; asn=201002; asn_org=PebbleHost Ltd",
      "id": "indicator--39bb51e8-9c01-49cb-a2bf-52c608a6f5f5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T14:06:40.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T14:06:40.000Z",
      "valid_until": "2026-04-25T14:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-13T07:43:31.260Z",
      "x_nadsec_last_seen": "2026-03-29T04:08:24.236Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201002"
      ],
      "x_nadsec_orgs": [
        "PebbleHost Ltd"
      ]
    },
    {
      "created": "2026-03-24T18:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--9a3fd2a5-9cfa-4041-bb46-d8342029c01a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T18:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.254.45.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T18:05:16.000Z",
      "valid_until": "2026-04-25T18:05:07.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-24T17:10:04.630Z",
      "x_nadsec_last_seen": "2026-03-24T18:54:53.009Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-24T18:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--b6786729-b884-482e-bbda-51fcb3c6c682",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T18:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.210.158.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T18:05:16.000Z",
      "valid_until": "2026-04-25T18:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T17:24:22.093Z",
      "x_nadsec_last_seen": "2026-03-24T17:26:29.679Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-24T18:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--91a9bf27-5b4d-4dd7-a89c-10a95d06d5ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T18:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.177.232.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T18:05:16.000Z",
      "valid_until": "2026-04-25T18:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T17:57:05.275Z",
      "x_nadsec_last_seen": "2026-03-24T18:02:00.777Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ]
    },
    {
      "created": "2026-03-24T18:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=262727; asn_org=AtualNet Provedor de Internet Ltda",
      "id": "indicator--7fd38837-1cd3-443d-9517-dc9c3ec2dfac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T18:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.192.71.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T18:05:16.000Z",
      "valid_until": "2026-04-25T18:05:07.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-24T17:50:03.694Z",
      "x_nadsec_last_seen": "2026-03-24T17:51:01.202Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262727"
      ],
      "x_nadsec_orgs": [
        "AtualNet Provedor de Internet Ltda"
      ]
    },
    {
      "created": "2026-03-24T18:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--8609c944-5451-40bb-88f9-3f47fb2a205f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T18:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.6.49.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T18:05:16.000Z",
      "valid_until": "2026-04-25T18:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T17:52:16.996Z",
      "x_nadsec_last_seen": "2026-03-24T17:54:22.629Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-03-24T18:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=GT; asn=26617; asn_org=Navega.com S.A.",
      "id": "indicator--57bb14ad-ec8b-45ab-baa2-78d7be1c3093",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T18:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.12.37.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T18:05:16.000Z",
      "valid_until": "2026-04-25T18:05:07.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-24T17:14:06.471Z",
      "x_nadsec_last_seen": "2026-03-24T17:14:11.043Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GT"
      ],
      "x_nadsec_asns": [
        "26617"
      ],
      "x_nadsec_orgs": [
        "Navega.com S.A."
      ]
    },
    {
      "created": "2026-03-24T18:05:16.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mssqld; ports=1433; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--98a1b2fe-6712-471c-b517-22dcd2721616",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T18:05:16.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.112.136.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T18:05:16.000Z",
      "valid_until": "2026-04-25T18:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T17:05:10.655Z",
      "x_nadsec_last_seen": "2026-03-24T17:05:34.175Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-24T19:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=RU; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--efef27b4-42dc-424c-91ab-bc7f5f59ea6b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T19:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.227.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:05:28.000Z",
      "valid_until": "2026-04-25T19:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T18:37:12.628Z",
      "x_nadsec_last_seen": "2026-03-24T18:37:42.392Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-24T19:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--ba4d4eb8-ddb1-4297-b141-1b18c886e0f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T19:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:05:28.000Z",
      "valid_until": "2026-04-25T19:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-24T18:46:48.500Z",
      "x_nadsec_last_seen": "2026-03-24T18:47:11.833Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-24T19:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--9dd6c369-0412-4753-bccd-6141cec33fcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T19:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:05:28.000Z",
      "valid_until": "2026-04-25T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T18:33:43.838Z",
      "x_nadsec_last_seen": "2026-03-24T18:33:43.838Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-24T19:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=7049; asn_org=Silica Networks Argentina S.A.",
      "id": "indicator--3c4b993c-52a5-42c6-bf90-6615408dd724",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T19:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.61.14.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:05:28.000Z",
      "valid_until": "2026-04-25T19:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T18:53:31.668Z",
      "x_nadsec_last_seen": "2026-03-24T19:00:34.085Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "7049"
      ],
      "x_nadsec_orgs": [
        "Silica Networks Argentina S.A."
      ]
    },
    {
      "created": "2026-03-24T19:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=267523; asn_org=LEMAX INTERNET",
      "id": "indicator--5525d8be-337b-40ad-9d4c-26fbd9be54ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T19:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.182.163.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:05:28.000Z",
      "valid_until": "2026-04-25T19:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-24T18:48:15.736Z",
      "x_nadsec_last_seen": "2026-03-24T18:56:06.613Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "267523"
      ],
      "x_nadsec_orgs": [
        "LEMAX INTERNET"
      ]
    },
    {
      "created": "2026-03-24T19:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--935837dc-8d07-487e-b21b-fc397251296d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T19:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:05:28.000Z",
      "valid_until": "2026-04-25T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T18:27:26.531Z",
      "x_nadsec_last_seen": "2026-03-24T18:27:26.531Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-24T19:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--684271b7-ee1e-41f7-8857-0c07543c78d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T19:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:05:28.000Z",
      "valid_until": "2026-04-25T19:05:08.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-24T18:15:37.804Z",
      "x_nadsec_last_seen": "2026-03-24T18:15:57.781Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-03-24T19:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8b552010-1b64-44a2-a8b6-61719bab0833",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T19:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:05:28.000Z",
      "valid_until": "2026-04-25T19:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T18:37:14.595Z",
      "x_nadsec_last_seen": "2026-03-24T18:37:14.595Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-24T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a0edfc85-4282-4f97-9fac-e6526083ded7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.236.236.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T20:05:10.000Z",
      "valid_until": "2026-04-25T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T19:59:39.918Z",
      "x_nadsec_last_seen": "2026-03-24T19:59:39.918Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-24T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NP; asn=23752; asn_org=Nepal Telecommunications Corporation, Internet Services",
      "id": "indicator--9d693495-d29e-49e7-8445-6cd18a0732e1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.199.231.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T20:05:10.000Z",
      "valid_until": "2026-04-25T20:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T19:26:39.686Z",
      "x_nadsec_last_seen": "2026-03-24T19:28:53.610Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "23752"
      ],
      "x_nadsec_orgs": [
        "Nepal Telecommunications Corporation, Internet Services"
      ]
    },
    {
      "created": "2026-03-24T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--5cdd0a97-7dc0-4555-9776-fbc07235f429",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.123.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T20:05:10.000Z",
      "valid_until": "2026-04-25T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T19:08:00.125Z",
      "x_nadsec_last_seen": "2026-03-24T19:08:00.125Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-24T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=AE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--68ef53ee-dfe4-4442-8bde-1b81e1f101de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.181.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T20:05:10.000Z",
      "valid_until": "2026-04-25T20:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T19:37:58.904Z",
      "x_nadsec_last_seen": "2026-03-24T19:38:18.899Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-24T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bc13c9bd-1c41-4fc1-98fb-6853a9ca390e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.223.147.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T20:05:10.000Z",
      "valid_until": "2026-04-25T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T19:57:26.600Z",
      "x_nadsec_last_seen": "2026-03-24T19:57:26.600Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-24T20:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--55a96ce6-beee-4af2-9679-a4b95c2d0183",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T20:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T20:05:10.000Z",
      "valid_until": "2026-04-25T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T19:42:13.308Z",
      "x_nadsec_last_seen": "2026-03-24T19:42:13.308Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-24T21:05:10.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--4cd2e8b7-767e-4d7f-83da-cddd3a08af1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T21:05:10.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.91.72.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T21:05:10.000Z",
      "valid_until": "2026-04-25T21:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T20:49:42.707Z",
      "x_nadsec_last_seen": "2026-03-24T20:49:50.358Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-24T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZA; asn=37457; asn_org=Telkom-Internet",
      "id": "indicator--f39185a8-5b30-4a0c-99e6-37f4106e2a5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.224.219.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:05:13.000Z",
      "valid_until": "2026-04-25T22:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-24T21:28:27.380Z",
      "x_nadsec_last_seen": "2026-03-24T21:30:33.096Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37457"
      ],
      "x_nadsec_orgs": [
        "Telkom-Internet"
      ]
    },
    {
      "created": "2026-03-24T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; user(top)=**",
      "id": "indicator--77866f86-b553-4864-9d8e-caa1f1848b10",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.26.50.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:05:13.000Z",
      "valid_until": "2026-04-25T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T21:48:52.094Z",
      "x_nadsec_last_seen": "2026-03-24T21:48:52.094Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-24T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=GB; asn=9009; asn_org=M247 Europe SRL",
      "id": "indicator--d2a9b7d8-c22a-42e8-a155-99d0ed9dab29",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.98.100.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:05:13.000Z",
      "valid_until": "2026-04-25T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T21:26:55.258Z",
      "x_nadsec_last_seen": "2026-03-24T21:26:55.258Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "9009"
      ],
      "x_nadsec_orgs": [
        "M247 Europe SRL"
      ]
    },
    {
      "created": "2026-03-24T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=ZA; asn=11845; asn_org=Vox-Telecom",
      "id": "indicator--5c3f30b8-f55b-4d57-bd4f-15f40343c3fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.245.24.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:05:13.000Z",
      "valid_until": "2026-04-25T22:05:00.000Z",
      "x_nadsec_event_count": 3145,
      "x_nadsec_first_seen": "2026-03-24T21:17:44.112Z",
      "x_nadsec_last_seen": "2026-03-24T23:27:25.515Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "11845"
      ],
      "x_nadsec_orgs": [
        "Vox-Telecom"
      ]
    },
    {
      "created": "2026-03-24T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fcdd1432-eca5-4b3a-a8e8-61893268c1ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.168.7.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:05:13.000Z",
      "valid_until": "2026-04-25T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T21:30:10.279Z",
      "x_nadsec_last_seen": "2026-03-24T21:30:10.279Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-24T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c1ecdc01-23c3-4730-82fa-0d49feca56c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:05:13.000Z",
      "valid_until": "2026-04-25T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T21:28:08.286Z",
      "x_nadsec_last_seen": "2026-03-24T21:28:08.286Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-24T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--47289d23-f5fd-4328-b6ba-a1baa23ebe02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:05:13.000Z",
      "valid_until": "2026-04-25T22:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T21:35:04.614Z",
      "x_nadsec_last_seen": "2026-03-28T20:31:07.713Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-24T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NL; asn=49453; asn_org=Global Layer B.V.",
      "id": "indicator--000c089b-f943-4d68-a9f1-a16a60aab744",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.152.161.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:05:13.000Z",
      "valid_until": "2026-04-25T22:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T21:14:38.351Z",
      "x_nadsec_last_seen": "2026-03-25T09:29:53.801Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "49453"
      ],
      "x_nadsec_orgs": [
        "Global Layer B.V."
      ]
    },
    {
      "created": "2026-03-24T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--b4a575ee-b702-47fc-92c7-4c1ee2f9a092",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:05:13.000Z",
      "valid_until": "2026-04-25T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T21:35:02.051Z",
      "x_nadsec_last_seen": "2026-03-24T21:35:02.051Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-24T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--60b7d436-d4cb-4634-a555-39729a921e50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.135.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:05:13.000Z",
      "valid_until": "2026-04-25T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T21:17:55.824Z",
      "x_nadsec_last_seen": "2026-03-24T21:17:55.824Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-24T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=GB; asn=209605; asn_org=UAB Host Baltic",
      "id": "indicator--0573dac1-2730-4e14-bc3b-fd68fe6274a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:05:13.000Z",
      "valid_until": "2026-04-25T22:05:00.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-24T16:37:23.450Z",
      "x_nadsec_last_seen": "2026-03-29T23:35:33.663Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "209605"
      ],
      "x_nadsec_orgs": [
        "UAB Host Baltic"
      ]
    },
    {
      "created": "2026-03-24T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--6c5dce6c-ed19-48f0-92b3-9a1367d426de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:05:13.000Z",
      "valid_until": "2026-04-25T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T22:02:46.494Z",
      "x_nadsec_last_seen": "2026-03-24T22:02:46.494Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-24T22:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--dad65889-cdfb-4ab0-810f-7b8f3d3be04c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T22:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:05:13.000Z",
      "valid_until": "2026-04-25T22:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T22:03:19.502Z",
      "x_nadsec_last_seen": "2026-03-24T22:03:19.502Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-24T23:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--063373f2-1573-4e8e-ae68-b4e4160d5c40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T23:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.9.113.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T23:05:19.000Z",
      "valid_until": "2026-04-25T23:05:09.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-24T22:57:26.175Z",
      "x_nadsec_last_seen": "2026-03-28T20:17:34.454Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-24T23:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6b5c1e40-25d2-459e-ad3d-efdc94a446c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T23:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T23:05:19.000Z",
      "valid_until": "2026-04-25T23:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T22:33:35.888Z",
      "x_nadsec_last_seen": "2026-03-24T22:33:35.888Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-24T23:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8b9ca2f1-23c5-4a2a-8678-a2fc18dbd232",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T23:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.83.185.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T23:05:19.000Z",
      "valid_until": "2026-04-25T23:05:09.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-24T22:59:19.976Z",
      "x_nadsec_last_seen": "2026-03-24T22:59:20.768Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-24T23:05:19.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=61832; asn_org=DB3 SERVICOS DE TELECOMUNICACOES S.A",
      "id": "indicator--d9a91763-b7da-4df7-9a6a-20df13d88e82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-24T23:05:19.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.236.68.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T23:05:19.000Z",
      "valid_until": "2026-04-25T23:05:09.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T22:49:15.430Z",
      "x_nadsec_last_seen": "2026-03-24T22:49:15.789Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "61832"
      ],
      "x_nadsec_orgs": [
        "DB3 SERVICOS DE TELECOMUNICACOES S.A"
      ]
    },
    {
      "created": "2026-03-25T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--8a98122e-4948-4378-beb0-c6a216f1800f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.188.122.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T00:05:04.000Z",
      "valid_until": "2026-04-26T00:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T23:08:16.779Z",
      "x_nadsec_last_seen": "2026-03-24T23:10:23.727Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-25T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--b04c3d60-79f3-4d9d-8a42-9ced19181e9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.172.29.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T00:05:04.000Z",
      "valid_until": "2026-04-26T00:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T23:14:39.082Z",
      "x_nadsec_last_seen": "2026-03-24T23:14:39.082Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-25T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--42c4b1e6-fcb0-4fe6-b6ca-129b3c9f0e22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.40.208.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T00:05:04.000Z",
      "valid_until": "2026-04-26T00:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T23:22:43.830Z",
      "x_nadsec_last_seen": "2026-03-24T23:22:54.005Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-25T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--568d6fd0-0c16-494d-9205-3633aa52369d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T00:05:04.000Z",
      "valid_until": "2026-04-26T00:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-24T23:40:14.133Z",
      "x_nadsec_last_seen": "2026-03-24T23:40:14.133Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-25T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--9496902a-2171-4488-aab7-d77ce34fee6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.147.174.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T00:05:04.000Z",
      "valid_until": "2026-04-26T00:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-24T23:25:05.888Z",
      "x_nadsec_last_seen": "2026-03-24T23:27:12.635Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-25T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=17885; asn_org=PT XL Axiata Tbk",
      "id": "indicator--343c7799-e390-4984-a710-6dc6c1b5dfa9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.52.64.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T01:05:13.000Z",
      "valid_until": "2026-04-26T01:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T00:17:16.746Z",
      "x_nadsec_last_seen": "2026-03-25T00:17:16.746Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17885"
      ],
      "x_nadsec_orgs": [
        "PT XL Axiata Tbk"
      ]
    },
    {
      "created": "2026-03-25T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--48ad0cc7-526e-4b94-8eb4-ae230a8d1f30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.203.201.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T01:05:13.000Z",
      "valid_until": "2026-04-26T01:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-25T00:31:15.710Z",
      "x_nadsec_last_seen": "2026-03-25T00:31:16.149Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-25T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=135175; asn_org=Facts Online Pvt Ltd",
      "id": "indicator--9115b390-35cc-40a9-b021-acdf738f363c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.61.77.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T01:05:13.000Z",
      "valid_until": "2026-04-26T01:05:07.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-25T00:34:19.176Z",
      "x_nadsec_last_seen": "2026-03-25T00:34:20.828Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135175"
      ],
      "x_nadsec_orgs": [
        "Facts Online Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-25T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--e822f189-7b10-494f-bb70-5fd6bffda2b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.86.97.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T01:05:13.000Z",
      "valid_until": "2026-04-26T01:05:07.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-25T00:32:08.011Z",
      "x_nadsec_last_seen": "2026-03-25T00:32:11.771Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-25T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=38769; asn_org=PT. Bit Technology Nusantara",
      "id": "indicator--fcffa55b-f9fc-4d0e-af0c-2b1b703dbc09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.230.28.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T01:05:13.000Z",
      "valid_until": "2026-04-26T01:05:07.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-25T00:55:22.416Z",
      "x_nadsec_last_seen": "2026-03-25T00:55:49.072Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "38769"
      ],
      "x_nadsec_orgs": [
        "PT. Bit Technology Nusantara"
      ]
    },
    {
      "created": "2026-03-25T01:05:13.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--d8724057-32e7-4cd8-83a6-3684eda92d30",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T01:05:13.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.81.156.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T01:05:13.000Z",
      "valid_until": "2026-04-26T01:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T00:54:25.202Z",
      "x_nadsec_last_seen": "2026-03-25T00:54:25.202Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-25T02:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--d15aea6b-5253-41da-a6e0-57ff323a85f2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T02:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.4.196.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T02:05:28.000Z",
      "valid_until": "2026-04-26T02:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-25T01:26:53.317Z",
      "x_nadsec_last_seen": "2026-03-25T01:26:53.469Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-25T02:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b3896636-1d0f-4369-a647-ec03d7df3638",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T02:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.227.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T02:05:28.000Z",
      "valid_until": "2026-04-26T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T01:55:51.599Z",
      "x_nadsec_last_seen": "2026-03-25T01:55:58.066Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-25T02:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--423b9d04-ef92-4aef-a3b2-fae5551cec86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T02:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.96.39.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T02:05:28.000Z",
      "valid_until": "2026-04-26T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T01:45:30.545Z",
      "x_nadsec_last_seen": "2026-03-25T01:45:35.778Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-25T02:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=MX; asn=8151; asn_org=UNINET; user(top)=**",
      "id": "indicator--b6af5e0c-4fd6-4cc9-af48-611b2e5b58af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T02:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.235.52.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T02:05:28.000Z",
      "valid_until": "2026-04-26T02:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-25T01:45:14.459Z",
      "x_nadsec_last_seen": "2026-03-25T01:45:17.895Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-25T02:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--830b36aa-7eef-41f9-987e-0002b8d1cd71",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T02:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.130.240.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T02:05:28.000Z",
      "valid_until": "2026-04-26T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T01:39:10.748Z",
      "x_nadsec_last_seen": "2026-03-25T01:39:10.748Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-25T02:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--4df895d7-0578-40b3-a24a-f942cb555f2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T02:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.156.91.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T02:05:28.000Z",
      "valid_until": "2026-04-26T02:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-25T01:11:10.842Z",
      "x_nadsec_last_seen": "2026-03-25T01:13:15.936Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-25T02:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--70a2b555-6af7-43c1-aba3-0471fbc6ed7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T02:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.124.158.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T02:05:28.000Z",
      "valid_until": "2026-04-26T02:05:00.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-13T08:06:34.590Z",
      "x_nadsec_last_seen": "2026-03-25T03:57:03.691Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-25T02:05:28.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=12989; asn_org=Black HOST Ltd",
      "id": "indicator--84b03f10-f707-4076-9b4f-5b3440814918",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T02:05:28.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T02:05:28.000Z",
      "valid_until": "2026-04-26T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T01:34:29.761Z",
      "x_nadsec_last_seen": "2026-03-25T01:34:29.761Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "12989"
      ],
      "x_nadsec_orgs": [
        "Black HOST Ltd"
      ]
    },
    {
      "created": "2026-03-25T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VE; asn=394684; asn_org=GOLD DATA USA INC",
      "id": "indicator--01d3b55f-7885-48ba-b062-e60105c03ee5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.52.99.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T03:05:14.000Z",
      "valid_until": "2026-04-26T03:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-25T02:21:11.500Z",
      "x_nadsec_last_seen": "2026-03-25T02:21:11.777Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "394684"
      ],
      "x_nadsec_orgs": [
        "GOLD DATA USA INC"
      ]
    },
    {
      "created": "2026-03-25T03:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--74dec2d4-43ef-4811-90ae-2375a8bf9891",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T03:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.84.167.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T03:05:14.000Z",
      "valid_until": "2026-04-26T03:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-25T02:08:28.307Z",
      "x_nadsec_last_seen": "2026-03-25T02:08:38.481Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-25T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2585; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--9e78babd-4f5b-45e1-a38d-ee1ca16e38e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.217.123.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:05:14.000Z",
      "valid_until": "2026-04-26T07:05:01.000Z",
      "x_nadsec_event_count": 3148,
      "x_nadsec_first_seen": "2026-03-25T05:52:05.010Z",
      "x_nadsec_last_seen": "2026-03-25T06:47:38.577Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-03-25T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--614227ee-d9e0-40e7-8a03-2d88fb3cdfa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.214.8.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:05:14.000Z",
      "valid_until": "2026-04-26T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T06:26:12.063Z",
      "x_nadsec_last_seen": "2026-03-25T06:28:17.272Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-25T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=45773; asn_org=PERN AS Content Servie Provider, Islamabad, Pakistan",
      "id": "indicator--fd154c0f-25a6-4451-b516-ab4e9e2c6d88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.68.111.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:05:14.000Z",
      "valid_until": "2026-04-26T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-25T06:14:09.175Z",
      "x_nadsec_last_seen": "2026-03-25T06:14:09.458Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "45773"
      ],
      "x_nadsec_orgs": [
        "PERN AS Content Servie Provider, Islamabad, Pakistan"
      ]
    },
    {
      "created": "2026-03-25T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--79bcf8db-4605-4c86-b914-d46ac37831c7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.250.29.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:05:14.000Z",
      "valid_until": "2026-04-26T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T06:40:34.241Z",
      "x_nadsec_last_seen": "2026-03-25T06:42:39.222Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-25T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=132165; asn_org=Connect Communications",
      "id": "indicator--36cae8bc-0042-4d75-b092-294178f6daa4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.103.238.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:05:14.000Z",
      "valid_until": "2026-04-26T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T06:16:13.897Z",
      "x_nadsec_last_seen": "2026-03-25T06:16:13.897Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "132165"
      ],
      "x_nadsec_orgs": [
        "Connect Communications"
      ]
    },
    {
      "created": "2026-03-25T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=45305; asn_org=Lintas Data Prima, PT",
      "id": "indicator--b51a42e4-0c0d-4d04-adf6-189b2caf15ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.40.252.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:05:14.000Z",
      "valid_until": "2026-04-26T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-25T06:14:06.973Z",
      "x_nadsec_last_seen": "2026-03-25T06:14:32.138Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "45305"
      ],
      "x_nadsec_orgs": [
        "Lintas Data Prima, PT"
      ]
    },
    {
      "created": "2026-03-25T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--87886f6e-7f78-481b-aa17-3efd1c16f85d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '136.239.247.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:05:14.000Z",
      "valid_until": "2026-04-26T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-25T06:44:19.785Z",
      "x_nadsec_last_seen": "2026-03-25T06:46:32.097Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-03-25T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--990f098b-121e-4267-9334-3ba0dbcc02c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.13.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:05:14.000Z",
      "valid_until": "2026-04-26T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T06:43:13.205Z",
      "x_nadsec_last_seen": "2026-03-25T06:45:20.957Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-25T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--b809088c-08e3-424a-89c9-f483aec52431",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.193.223.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:05:14.000Z",
      "valid_until": "2026-04-26T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-25T06:38:22.594Z",
      "x_nadsec_last_seen": "2026-03-25T06:46:32.202Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-25T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NP; asn=23752; asn_org=Nepal Telecommunications Corporation, Internet Services",
      "id": "indicator--451ab3e1-17c7-4a7e-a3bf-6a87f2b418d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.70.72.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:05:14.000Z",
      "valid_until": "2026-04-26T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T06:58:26.956Z",
      "x_nadsec_last_seen": "2026-03-25T07:00:31.952Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "23752"
      ],
      "x_nadsec_orgs": [
        "Nepal Telecommunications Corporation, Internet Services"
      ]
    },
    {
      "created": "2026-03-25T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NP; asn=17501; asn_org=WorldLink Communications Pvt Ltd",
      "id": "indicator--d9f7d2e6-3ac3-437a-bd30-0fd7b1378c35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.79.56.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:05:14.000Z",
      "valid_until": "2026-04-26T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T06:34:33.500Z",
      "x_nadsec_last_seen": "2026-03-25T06:36:38.469Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "17501"
      ],
      "x_nadsec_orgs": [
        "WorldLink Communications Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-25T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=23888; asn_org=National Telecommunication Corporation HQ",
      "id": "indicator--d626ca69-f55f-4074-b0de-ec5b705fc004",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.83.168.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:05:14.000Z",
      "valid_until": "2026-04-26T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T06:16:15.429Z",
      "x_nadsec_last_seen": "2026-03-25T06:16:15.429Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "23888"
      ],
      "x_nadsec_orgs": [
        "National Telecommunication Corporation HQ"
      ]
    },
    {
      "created": "2026-03-25T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=20978; asn_org=TT Mobil Iletisim Hizmetleri A.S",
      "id": "indicator--7409454e-3e88-4350-87ac-57c8c40425e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.47.110.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:05:14.000Z",
      "valid_until": "2026-04-26T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-25T06:15:44.345Z",
      "x_nadsec_last_seen": "2026-03-25T06:21:35.860Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "20978"
      ],
      "x_nadsec_orgs": [
        "TT Mobil Iletisim Hizmetleri A.S"
      ]
    },
    {
      "created": "2026-03-25T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2475f5a7-2a2c-49f7-8a01-22c61059d4ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:05:14.000Z",
      "valid_until": "2026-04-26T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-25T06:38:31.359Z",
      "x_nadsec_last_seen": "2026-03-29T11:31:39.152Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-25T07:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--28be7fb9-762d-438d-8ba8-a4d0577da6df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T07:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.122.197.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:05:14.000Z",
      "valid_until": "2026-04-26T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T06:55:40.027Z",
      "x_nadsec_last_seen": "2026-03-25T06:55:40.027Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-25T09:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--af1499ce-d040-4078-8642-8877c1cdd697",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.168.190.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:05:21.000Z",
      "valid_until": "2026-04-26T09:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T08:11:51.750Z",
      "x_nadsec_last_seen": "2026-03-25T08:13:56.449Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-25T09:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=131111; asn_org=PT Mora Telematika Indonesia",
      "id": "indicator--a6e78f25-fa22-43b2-9f3f-6a43014cd7cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.159.204.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:05:21.000Z",
      "valid_until": "2026-04-26T09:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T08:39:18.715Z",
      "x_nadsec_last_seen": "2026-03-25T08:41:23.305Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "131111"
      ],
      "x_nadsec_orgs": [
        "PT Mora Telematika Indonesia"
      ]
    },
    {
      "created": "2026-03-25T09:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CN; asn=4808; asn_org=China Unicom Beijing Province Network",
      "id": "indicator--7c32d52f-9ad8-482e-a036-f3e9035ad89b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.75.9.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:05:21.000Z",
      "valid_until": "2026-04-26T09:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T08:34:05.383Z",
      "x_nadsec_last_seen": "2026-03-25T08:34:05.383Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4808"
      ],
      "x_nadsec_orgs": [
        "China Unicom Beijing Province Network"
      ]
    },
    {
      "created": "2026-03-25T09:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--882751c2-5e7b-4c7d-a7b0-8543bc4064d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.77.111.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:05:21.000Z",
      "valid_until": "2026-04-26T09:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T09:01:21.272Z",
      "x_nadsec_last_seen": "2026-03-25T09:01:26.926Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-25T09:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--7507639c-33d0-465e-8bd7-68c9775a0079",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.240.9.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:05:21.000Z",
      "valid_until": "2026-04-26T09:05:04.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-25T08:01:40.042Z",
      "x_nadsec_last_seen": "2026-03-25T08:09:08.758Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-25T09:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--2a72af84-3711-44fb-b8cc-5b98c8063ca2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.29.85.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:05:21.000Z",
      "valid_until": "2026-04-26T09:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T08:13:48.257Z",
      "x_nadsec_last_seen": "2026-03-25T08:13:48.257Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-25T09:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--2732fda2-26e7-40bd-8f9d-858941b662b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '136.158.58.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:05:21.000Z",
      "valid_until": "2026-04-26T09:05:04.000Z",
      "x_nadsec_event_count": 46,
      "x_nadsec_first_seen": "2026-03-25T08:25:11.827Z",
      "x_nadsec_last_seen": "2026-03-25T08:28:27.624Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-03-25T09:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14956; asn_org=RouterHosting LLC",
      "id": "indicator--4c7c73b2-07cd-4408-afa4-95b59526e248",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '144.172.112.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:05:21.000Z",
      "valid_until": "2026-04-26T09:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T09:04:04.854Z",
      "x_nadsec_last_seen": "2026-03-25T09:04:04.854Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14956"
      ],
      "x_nadsec_orgs": [
        "RouterHosting LLC"
      ]
    },
    {
      "created": "2026-03-25T09:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--b46035c9-0d66-41f8-9868-78a91aa23331",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.176.139.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:05:21.000Z",
      "valid_until": "2026-04-26T09:05:04.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-25T08:11:06.347Z",
      "x_nadsec_last_seen": "2026-03-25T08:12:24.611Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-25T09:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--a6e40527-8541-4ab8-b86b-2066b57bf643",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.97.26.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:05:21.000Z",
      "valid_until": "2026-04-26T09:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T08:07:48.733Z",
      "x_nadsec_last_seen": "2026-03-25T08:07:48.733Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-25T09:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--c5cd7111-fa91-4bf2-80c0-71c49aa8931f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.10.135.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:05:21.000Z",
      "valid_until": "2026-04-26T09:05:04.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-25T08:18:20.374Z",
      "x_nadsec_last_seen": "2026-03-25T09:15:11.680Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-03-25T09:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--37a9e7d9-8c47-4386-a8e0-d6c674bff0a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:05:21.000Z",
      "valid_until": "2026-04-26T09:05:04.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-25T08:59:38.948Z",
      "x_nadsec_last_seen": "2026-03-25T08:59:39.595Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-25T09:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--120a2b53-3849-4645-8945-f9272b91e848",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.91.45.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:05:21.000Z",
      "valid_until": "2026-04-26T09:05:04.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-25T08:11:10.872Z",
      "x_nadsec_last_seen": "2026-03-25T09:22:52.480Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-25T09:05:21.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=KR; asn=4766; asn_org=Korea Telecom",
      "id": "indicator--9acf0621-787a-4d38-963d-2e770fc39f86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T09:05:21.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.83.215.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T09:05:21.000Z",
      "valid_until": "2026-04-26T09:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T08:27:51.016Z",
      "x_nadsec_last_seen": "2026-03-25T08:27:51.016Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "KR"
      ],
      "x_nadsec_asns": [
        "4766"
      ],
      "x_nadsec_orgs": [
        "Korea Telecom"
      ]
    },
    {
      "created": "2026-03-25T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=45773; asn_org=PERN AS Content Servie Provider, Islamabad, Pakistan",
      "id": "indicator--b2a0ad21-69b9-4e36-8309-79196c73a947",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.68.103.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:05:12.000Z",
      "valid_until": "2026-04-26T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T09:07:39.472Z",
      "x_nadsec_last_seen": "2026-03-25T09:09:45.777Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "45773"
      ],
      "x_nadsec_orgs": [
        "PERN AS Content Servie Provider, Islamabad, Pakistan"
      ]
    },
    {
      "created": "2026-03-25T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PE; asn=21575; asn_org=ENTEL PERU S.A.",
      "id": "indicator--7afd4a07-3bf0-4a68-bf29-6c58d6b230cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '132.251.199.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:05:12.000Z",
      "valid_until": "2026-04-26T10:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-25T09:45:51.690Z",
      "x_nadsec_last_seen": "2026-03-25T09:52:41.909Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "21575"
      ],
      "x_nadsec_orgs": [
        "ENTEL PERU S.A."
      ]
    },
    {
      "created": "2026-03-25T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--758f8b14-2650-4131-8e33-1d14d3f221ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.98.152.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:05:12.000Z",
      "valid_until": "2026-04-26T10:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-25T09:36:26.613Z",
      "x_nadsec_last_seen": "2026-03-25T09:36:36.785Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-25T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17665; asn_org=ONEOTT INTERTAINMENT LIMITED",
      "id": "indicator--9b2d164d-caca-4bbc-af81-b85903a50970",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.192.227.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:05:12.000Z",
      "valid_until": "2026-04-26T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T09:33:45.946Z",
      "x_nadsec_last_seen": "2026-03-25T09:35:50.853Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17665"
      ],
      "x_nadsec_orgs": [
        "ONEOTT INTERTAINMENT LIMITED"
      ]
    },
    {
      "created": "2026-03-25T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--6fea9e9d-19a7-4869-bc60-8cac28132de9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.252.12.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:05:12.000Z",
      "valid_until": "2026-04-26T10:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-25T09:20:36.075Z",
      "x_nadsec_last_seen": "2026-03-25T09:27:41.436Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-25T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--7529c801-4aef-4c3c-b42c-dc64d1eec10e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.205.178.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:05:12.000Z",
      "valid_until": "2026-04-26T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T09:36:05.323Z",
      "x_nadsec_last_seen": "2026-03-25T09:38:09.868Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-25T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--f966f8e4-4141-43d0-9ba7-4dca435da7d2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.205.96.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:05:12.000Z",
      "valid_until": "2026-04-26T10:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-25T09:26:40.190Z",
      "x_nadsec_last_seen": "2026-03-25T09:32:56.341Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-25T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9b6f6355-c381-4621-a7f5-e5c2e6f1d017",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:05:12.000Z",
      "valid_until": "2026-04-26T10:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T09:33:08.315Z",
      "x_nadsec_last_seen": "2026-03-25T09:33:08.315Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-25T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IT; asn=3269; asn_org=TIM",
      "id": "indicator--f400af7f-72aa-4946-a704-e8443a9a80eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.7.192.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:05:12.000Z",
      "valid_until": "2026-04-26T10:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-25T09:14:25.506Z",
      "x_nadsec_last_seen": "2026-03-25T09:14:25.617Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "3269"
      ],
      "x_nadsec_orgs": [
        "TIM"
      ]
    },
    {
      "created": "2026-03-25T10:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--a250062a-b8f0-44e9-9c6e-3237ee5b3be7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T10:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.149.19.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:05:12.000Z",
      "valid_until": "2026-04-26T10:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T09:39:20.017Z",
      "x_nadsec_last_seen": "2026-03-25T09:41:26.999Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-25T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=36873; asn_org=Celtel Nigeria Limited t.a ZAIN",
      "id": "indicator--616a9cd7-2b74-4a37-afc0-5c704fdcbce3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.112.208.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T11:05:07.000Z",
      "valid_until": "2026-04-26T11:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T10:34:17.492Z",
      "x_nadsec_last_seen": "2026-03-25T10:36:25.526Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "36873"
      ],
      "x_nadsec_orgs": [
        "Celtel Nigeria Limited t.a ZAIN"
      ]
    },
    {
      "created": "2026-03-25T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--061e7652-6eb6-4e2f-ad80-71297eccf6fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.155.249.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T11:05:07.000Z",
      "valid_until": "2026-04-26T11:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T10:34:09.815Z",
      "x_nadsec_last_seen": "2026-03-25T10:34:15.787Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-25T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=16143; asn_org=OOO NIIR-RadioNet",
      "id": "indicator--f342f73a-f217-4bf0-b841-d69ad407b78b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.76.44.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T11:05:07.000Z",
      "valid_until": "2026-04-26T11:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-25T10:06:58.085Z",
      "x_nadsec_last_seen": "2026-03-25T10:06:58.183Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "16143"
      ],
      "x_nadsec_orgs": [
        "OOO NIIR-RadioNet"
      ]
    },
    {
      "created": "2026-03-25T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--78e11f5b-fcf1-47f6-9148-3e32a8175819",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.45.68.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T11:05:07.000Z",
      "valid_until": "2026-04-26T11:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-25T10:19:39.014Z",
      "x_nadsec_last_seen": "2026-03-25T10:26:37.395Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-25T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TW; asn=3462; asn_org=Data Communication Business Group; user(top)=**",
      "id": "indicator--29cf73a4-b3cf-4936-b5e1-a1e068a31328",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.221.207.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T11:05:07.000Z",
      "valid_until": "2026-04-26T11:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T11:03:45.511Z",
      "x_nadsec_last_seen": "2026-03-25T11:03:45.511Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-25T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--213bb2d8-8c08-47d7-8ec2-8c323dc58436",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T11:05:07.000Z",
      "valid_until": "2026-04-26T11:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T10:09:41.095Z",
      "x_nadsec_last_seen": "2026-03-25T10:09:41.095Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-25T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=35032; asn_org=LLC Sip nis",
      "id": "indicator--b72e163e-47b7-452b-a95d-bac0dae4e816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.236.179.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T11:05:07.000Z",
      "valid_until": "2026-04-26T11:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T10:29:33.579Z",
      "x_nadsec_last_seen": "2026-03-25T10:35:14.464Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "35032"
      ],
      "x_nadsec_orgs": [
        "LLC Sip nis"
      ]
    },
    {
      "created": "2026-03-25T11:05:07.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AM; asn=47623; asn_org=Institute for Informatics and Automation Problems of National Academy of Sciences of the Rep",
      "id": "indicator--81d1b6e4-c80c-4407-8766-384a433bcdf3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T11:05:07.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.187.163.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T11:05:07.000Z",
      "valid_until": "2026-04-26T11:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T11:01:19.782Z",
      "x_nadsec_last_seen": "2026-03-25T11:03:27.488Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "47623"
      ],
      "x_nadsec_orgs": [
        "Institute for Informatics and Automation Problems of National Academy of Sciences of the Rep"
      ]
    },
    {
      "created": "2026-03-25T16:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=ID; asn=55699; asn_org=PT. Cemerlang Multimedia",
      "id": "indicator--85b48f09-2185-484d-b332-9f99756b1dbf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.147.9.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:05:23.000Z",
      "valid_until": "2026-04-26T16:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-25T14:54:40.305Z",
      "x_nadsec_last_seen": "2026-03-25T15:14:56.494Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "55699"
      ],
      "x_nadsec_orgs": [
        "PT. Cemerlang Multimedia"
      ]
    },
    {
      "created": "2026-03-25T16:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3122564e-bc6c-45b1-b89d-22183accbf3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:05:23.000Z",
      "valid_until": "2026-04-26T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T15:46:28.930Z",
      "x_nadsec_last_seen": "2026-03-25T15:46:28.930Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-25T16:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--d365dbb7-610c-4c87-90db-3cdc164c9a96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.88.248.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:05:23.000Z",
      "valid_until": "2026-04-26T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T15:40:38.651Z",
      "x_nadsec_last_seen": "2026-03-25T15:42:45.358Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-25T16:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7b658355-6d92-4ec3-80d5-273f72381969",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:05:23.000Z",
      "valid_until": "2026-04-26T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T15:43:48.396Z",
      "x_nadsec_last_seen": "2026-03-25T15:43:48.396Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-25T16:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=3741; asn_org=NTT-DATA-Inc",
      "id": "indicator--fdd85d94-7e3c-426c-add8-5376f216722d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.97.154.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:05:23.000Z",
      "valid_until": "2026-04-26T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-25T15:49:47.190Z",
      "x_nadsec_last_seen": "2026-03-25T15:57:22.685Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "3741"
      ],
      "x_nadsec_orgs": [
        "NTT-DATA-Inc"
      ]
    },
    {
      "created": "2026-03-25T16:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--cd4db4c5-cded-4c33-9eb6-b7dfa2674841",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:05:23.000Z",
      "valid_until": "2026-04-26T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T15:45:20.741Z",
      "x_nadsec_last_seen": "2026-03-25T15:45:20.741Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-25T16:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bd421caa-f48a-4e06-94a9-91e19015cef3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.221.56.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:05:23.000Z",
      "valid_until": "2026-04-26T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T15:54:45.831Z",
      "x_nadsec_last_seen": "2026-03-25T15:54:45.831Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-25T16:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=15830; asn_org=Equinix (EMEA) Acquisition Enterprises B.V.",
      "id": "indicator--7bff46d8-27a9-4d78-806d-4cf80ea7695f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.20.27.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:05:23.000Z",
      "valid_until": "2026-04-26T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T15:33:36.098Z",
      "x_nadsec_last_seen": "2026-03-25T15:35:43.451Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "15830"
      ],
      "x_nadsec_orgs": [
        "Equinix (EMEA) Acquisition Enterprises B.V."
      ]
    },
    {
      "created": "2026-03-25T16:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--1b4378b5-66e8-4c97-a578-fdbacc82618c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.118.0.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:05:23.000Z",
      "valid_until": "2026-04-26T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T15:18:51.749Z",
      "x_nadsec_last_seen": "2026-03-25T15:21:08.834Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-25T16:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--f2e0d695-1efb-4872-9903-6dc590872055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.250.80.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:05:23.000Z",
      "valid_until": "2026-04-26T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-25T15:32:21.891Z",
      "x_nadsec_last_seen": "2026-03-25T15:32:21.891Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-25T16:05:23.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--7d7eb444-26f7-44f2-9212-ca11b12cd54d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-25T16:05:23.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.207.183.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:05:23.000Z",
      "valid_until": "2026-04-26T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-25T15:00:28.646Z",
      "x_nadsec_last_seen": "2026-03-25T15:08:53.623Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-03-26T01:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=63199; asn_org=CDS Global Cloud Co., Ltd",
      "id": "indicator--02885978-a19c-4db6-98a1-0f157b114e37",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.153.56.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:05:15.000Z",
      "valid_until": "2026-04-27T01:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T00:32:24.357Z",
      "x_nadsec_last_seen": "2026-03-26T00:32:24.357Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63199"
      ],
      "x_nadsec_orgs": [
        "CDS Global Cloud Co., Ltd"
      ]
    },
    {
      "created": "2026-03-26T01:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=FR; asn=12876; asn_org=Scaleway SAS",
      "id": "indicator--95407864-e789-4ad0-8a28-c2503bc1a807",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '163.172.104.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:05:15.000Z",
      "valid_until": "2026-04-27T01:05:00.000Z",
      "x_nadsec_event_count": 109,
      "x_nadsec_first_seen": "2026-03-26T01:03:00.229Z",
      "x_nadsec_last_seen": "2026-03-28T16:38:46.268Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "12876"
      ],
      "x_nadsec_orgs": [
        "Scaleway SAS"
      ]
    },
    {
      "created": "2026-03-26T01:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--34cd82a5-cbd4-4e10-ab09-059a08b6ec70",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.80.104.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:05:15.000Z",
      "valid_until": "2026-04-27T01:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T00:47:04.468Z",
      "x_nadsec_last_seen": "2026-03-26T00:47:14.640Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-26T01:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--2bde93f5-4714-464e-9722-76fd178018da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.147.177.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:05:15.000Z",
      "valid_until": "2026-04-27T01:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T00:55:15.713Z",
      "x_nadsec_last_seen": "2026-03-26T00:55:15.713Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-26T01:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--8e511bfb-989f-4beb-a541-4a0e9a298315",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:05:15.000Z",
      "valid_until": "2026-04-27T01:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T00:21:30.044Z",
      "x_nadsec_last_seen": "2026-03-26T00:21:30.044Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-26T01:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--8db61f6e-a370-42ea-a79b-e250bdcbf4fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.247.36.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:05:15.000Z",
      "valid_until": "2026-04-27T01:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T00:54:03.673Z",
      "x_nadsec_last_seen": "2026-03-26T00:56:10.470Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-26T01:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--fbd2accb-3f1f-4ac2-97a8-d57ed26464f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T01:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.189.48.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T01:05:15.000Z",
      "valid_until": "2026-04-27T01:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T00:27:11.098Z",
      "x_nadsec_last_seen": "2026-03-26T00:29:18.548Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-26T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e7fb201b-8b16-4aea-ab3b-ff37b3fb2ea2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.252.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T02:05:11.000Z",
      "valid_until": "2026-04-27T02:05:08.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-26T01:21:28.713Z",
      "x_nadsec_last_seen": "2026-03-26T02:29:24.916Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-26T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--969cd2e5-02e6-4d76-a751-0be1308e1f06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.54.68.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T02:05:11.000Z",
      "valid_until": "2026-04-27T02:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T01:42:54.118Z",
      "x_nadsec_last_seen": "2026-03-26T01:42:57.765Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-26T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VE; asn=8053; asn_org=IFX Networks Venezuela C.A.",
      "id": "indicator--c71345cf-c6c6-4515-920f-07778643fabb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.94.250.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T02:05:11.000Z",
      "valid_until": "2026-04-27T02:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-26T02:03:22.631Z",
      "x_nadsec_last_seen": "2026-03-26T02:10:34.909Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8053"
      ],
      "x_nadsec_orgs": [
        "IFX Networks Venezuela C.A."
      ]
    },
    {
      "created": "2026-03-26T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e866a615-a212-4b50-9366-62ecfb06df53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T02:05:11.000Z",
      "valid_until": "2026-04-27T02:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T01:16:57.088Z",
      "x_nadsec_last_seen": "2026-03-26T01:16:57.088Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-26T02:05:11.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4538; asn_org=China Education and Research Network Center",
      "id": "indicator--960063cf-1cd5-49ee-a0bb-2c098dc3813d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T02:05:11.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.200.242.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T02:05:11.000Z",
      "valid_until": "2026-04-27T02:05:08.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-26T01:54:27.562Z",
      "x_nadsec_last_seen": "2026-03-26T01:56:32.526Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4538"
      ],
      "x_nadsec_orgs": [
        "China Education and Research Network Center"
      ]
    },
    {
      "created": "2026-03-26T04:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--7a6535fc-5488-4288-837e-e7d60c64b336",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T04:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.163.158.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T04:05:27.000Z",
      "valid_until": "2026-04-27T04:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-26T03:33:16.120Z",
      "x_nadsec_last_seen": "2026-03-26T03:40:48.246Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-26T04:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--73dbed65-1937-4cbe-98de-b237dc96ea04",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T04:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.160.49.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T04:05:27.000Z",
      "valid_until": "2026-04-27T04:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T03:13:15.775Z",
      "x_nadsec_last_seen": "2026-03-26T03:15:21.436Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-26T04:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=265263; asn_org=MULTI TELECOM E COMERCIO DE INFORMATICA EIRELI ME",
      "id": "indicator--1044156f-95b4-4660-ac57-d92384c378b8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T04:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '168.90.34.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T04:05:27.000Z",
      "valid_until": "2026-04-27T04:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T03:49:26.359Z",
      "x_nadsec_last_seen": "2026-03-26T03:51:33.991Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "265263"
      ],
      "x_nadsec_orgs": [
        "MULTI TELECOM E COMERCIO DE INFORMATICA EIRELI ME"
      ]
    },
    {
      "created": "2026-03-26T04:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--181372c3-7040-434e-b0a6-b6f4453d962a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T04:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.178.80.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T04:05:27.000Z",
      "valid_until": "2026-04-27T04:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T03:11:19.999Z",
      "x_nadsec_last_seen": "2026-03-26T03:13:24.524Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-26T04:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31208; asn_org=PJSC MegaFon",
      "id": "indicator--8855f29c-44c9-4bde-b0ca-2a87fd457c6a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T04:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.28.184.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T04:05:27.000Z",
      "valid_until": "2026-04-27T04:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T03:22:55.527Z",
      "x_nadsec_last_seen": "2026-03-26T03:23:02.183Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31208"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-26T04:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--8614dc55-98db-4876-885a-7402ad6558a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T04:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.205.201.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T04:05:27.000Z",
      "valid_until": "2026-04-27T04:05:10.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-26T03:28:52.213Z",
      "x_nadsec_last_seen": "2026-03-26T04:57:31.070Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-03-26T04:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NP; asn=23752; asn_org=Nepal Telecommunications Corporation, Internet Services",
      "id": "indicator--d4a40752-eb63-49fa-ae5a-d869efbb68c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T04:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.244.116.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T04:05:27.000Z",
      "valid_until": "2026-04-27T04:05:10.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-26T03:29:19.929Z",
      "x_nadsec_last_seen": "2026-03-26T03:36:14.032Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "23752"
      ],
      "x_nadsec_orgs": [
        "Nepal Telecommunications Corporation, Internet Services"
      ]
    },
    {
      "created": "2026-03-26T04:05:27.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GR; asn=6799; asn_org=OTEnet S.A.",
      "id": "indicator--5e8438bf-075a-4f62-a419-c14e2c055c34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T04:05:27.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.70.159.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T04:05:27.000Z",
      "valid_until": "2026-04-27T04:05:10.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T03:22:08.295Z",
      "x_nadsec_last_seen": "2026-03-26T03:24:14.927Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GR"
      ],
      "x_nadsec_asns": [
        "6799"
      ],
      "x_nadsec_orgs": [
        "OTEnet S.A."
      ]
    },
    {
      "created": "2026-03-26T05:05:41.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b33add81-207a-46f6-92f7-21a9b4676226",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:05:41.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.162.84.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:05:41.000Z",
      "valid_until": "2026-04-27T05:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-26T04:41:33.251Z",
      "x_nadsec_last_seen": "2026-03-26T04:42:01.437Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-26T05:05:41.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services; user(top)=**",
      "id": "indicator--ab142a1f-7145-4b0c-ae95-dd9e38c62489",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:05:41.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.167.184.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:05:41.000Z",
      "valid_until": "2026-04-27T05:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T04:59:05.529Z",
      "x_nadsec_last_seen": "2026-03-26T04:59:05.529Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-26T05:05:41.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--b766f486-71f1-43b8-86cc-c5642409d334",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:05:41.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.195.201.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:05:41.000Z",
      "valid_until": "2026-04-27T05:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T04:57:36.571Z",
      "x_nadsec_last_seen": "2026-03-26T04:57:36.616Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-26T05:05:41.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--7ebc6322-452a-410c-ae99-a6cd506eb5bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:05:41.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:05:41.000Z",
      "valid_until": "2026-04-27T05:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T04:11:10.698Z",
      "x_nadsec_last_seen": "2026-03-26T04:11:10.698Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-26T05:05:41.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--485cff79-30c6-4952-84eb-27a0a4785105",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:05:41.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:05:41.000Z",
      "valid_until": "2026-04-27T05:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T04:11:10.245Z",
      "x_nadsec_last_seen": "2026-03-31T21:00:15.528Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-26T05:05:41.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=24835; asn_org=RAYA Telecom - Egypt",
      "id": "indicator--fa7bf9a0-136e-4a4a-b671-894b05844784",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:05:41.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.221.208.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:05:41.000Z",
      "valid_until": "2026-04-27T05:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T04:45:02.034Z",
      "x_nadsec_last_seen": "2026-03-26T04:47:08.696Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "24835"
      ],
      "x_nadsec_orgs": [
        "RAYA Telecom - Egypt"
      ]
    },
    {
      "created": "2026-03-26T05:05:41.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e7669f59-b43f-47ee-bb88-7d45f9832ef4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:05:41.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.168.8.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:05:41.000Z",
      "valid_until": "2026-04-27T05:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-26T04:51:15.932Z",
      "x_nadsec_last_seen": "2026-03-29T17:46:35.928Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-26T05:05:41.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--d97ebeb8-e914-461c-be76-4f00b30719aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:05:41.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.48.137.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:05:41.000Z",
      "valid_until": "2026-04-27T05:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T04:05:52.597Z",
      "x_nadsec_last_seen": "2026-03-26T04:07:57.085Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-26T05:05:41.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--f5f6d043-2a62-486f-a235-95fdc9487cdf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:05:41.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.48.199.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:05:41.000Z",
      "valid_until": "2026-04-27T05:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-26T04:32:32.411Z",
      "x_nadsec_last_seen": "2026-03-26T04:38:46.550Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-26T05:05:41.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--c9505ccd-2729-468c-b079-3e997ed5a662",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:05:41.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:05:41.000Z",
      "valid_until": "2026-04-27T05:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T04:15:10.994Z",
      "x_nadsec_last_seen": "2026-03-26T04:15:10.994Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-26T05:05:41.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--20377878-bc65-4184-9d14-b9a1578fa742",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:05:41.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:05:41.000Z",
      "valid_until": "2026-04-27T05:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T04:26:21.555Z",
      "x_nadsec_last_seen": "2026-03-26T04:26:21.555Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-26T05:05:41.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=59793; asn_org=Corporate Internet Service Provider LLC",
      "id": "indicator--a5c943ca-c13e-4a25-8fad-38d293738cce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:05:41.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.133.115.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:05:41.000Z",
      "valid_until": "2026-04-27T05:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T04:54:30.086Z",
      "x_nadsec_last_seen": "2026-03-26T04:56:37.087Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "59793"
      ],
      "x_nadsec_orgs": [
        "Corporate Internet Service Provider LLC"
      ]
    },
    {
      "created": "2026-03-26T05:05:41.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--201b1b96-020a-4910-831c-cf8f145796f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T05:05:41.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.249.63.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T05:05:41.000Z",
      "valid_until": "2026-04-27T05:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T04:27:38.141Z",
      "x_nadsec_last_seen": "2026-03-26T04:29:45.202Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-26T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--b703f211-3618-49e3-ad07-d83355f6ce45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.251.233.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:05:14.000Z",
      "valid_until": "2026-04-27T08:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T07:43:30.370Z",
      "x_nadsec_last_seen": "2026-03-26T07:45:35.163Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-26T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--56602ff3-6054-46a4-b9c7-7d3e0dfc9e39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.63.251.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:05:14.000Z",
      "valid_until": "2026-04-27T08:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T07:46:25.162Z",
      "x_nadsec_last_seen": "2026-03-26T07:48:32.311Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-26T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ea496ba9-5681-49cc-8b9a-a66caea6130c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.101.234.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:05:14.000Z",
      "valid_until": "2026-04-27T08:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T08:03:48.971Z",
      "x_nadsec_last_seen": "2026-03-26T08:03:48.971Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-26T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--48badde7-7e31-4d0c-b047-f2516fd432bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.162.209.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:05:14.000Z",
      "valid_until": "2026-04-27T08:05:05.000Z",
      "x_nadsec_event_count": 21,
      "x_nadsec_first_seen": "2026-03-13T17:35:21.437Z",
      "x_nadsec_last_seen": "2026-03-29T12:28:04.912Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-03-26T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--4bc2f410-824a-4734-aa39-c6ff63ac496d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:05:14.000Z",
      "valid_until": "2026-04-27T08:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-25T12:16:43.701Z",
      "x_nadsec_last_seen": "2026-03-26T07:38:12.665Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-26T08:05:14.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=34797; asn_org=System Net Ltd",
      "id": "indicator--15e01aa9-ea1f-4e0b-b7ad-c6ac82499f4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T08:05:14.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.137.204.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:05:14.000Z",
      "valid_until": "2026-04-27T08:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T07:22:50.862Z",
      "x_nadsec_last_seen": "2026-03-26T07:24:57.364Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "34797"
      ],
      "x_nadsec_orgs": [
        "System Net Ltd"
      ]
    },
    {
      "created": "2026-03-26T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--95be4e32-ffd0-48e4-9a19-9a5c7a7c6055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.18.20.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T12:05:15.000Z",
      "valid_until": "2026-04-27T12:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T11:22:47.007Z",
      "x_nadsec_last_seen": "2026-03-26T11:24:53.675Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "9541"
      ],
      "x_nadsec_orgs": [
        "Cyber Internet Services Pvt Ltd."
      ]
    },
    {
      "created": "2026-03-26T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=10; services=pptpd; ports=1723; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--8affc0ed-f9de-4f59-bbfe-a93757c915ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.199.98.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T12:05:15.000Z",
      "valid_until": "2026-04-27T12:05:04.000Z",
      "x_nadsec_event_count": 126,
      "x_nadsec_first_seen": "2026-03-26T02:51:07.183Z",
      "x_nadsec_last_seen": "2026-03-28T14:35:32.213Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-03-26T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--60b2bc53-ca8b-4f74-9c43-a2e3ecb34f79",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.248.52.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T12:05:15.000Z",
      "valid_until": "2026-04-27T12:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T11:42:02.214Z",
      "x_nadsec_last_seen": "2026-03-26T11:44:10.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-03-26T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--97e70874-6076-4627-844b-4f214a7d0e58",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.33.38.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T12:05:15.000Z",
      "valid_until": "2026-04-27T12:05:04.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T11:19:09.209Z",
      "x_nadsec_last_seen": "2026-03-26T11:19:09.209Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-26T12:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--8bb3732b-822c-45c2-8f24-64fc4bd71509",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T12:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T12:05:15.000Z",
      "valid_until": "2026-04-27T12:05:04.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T11:08:14.412Z",
      "x_nadsec_last_seen": "2026-03-31T11:19:20.124Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-26T13:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--9c4956d4-6724-4f8e-8d4d-86bbfd1af58e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T13:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.173.24.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T13:05:56.000Z",
      "valid_until": "2026-04-27T13:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T12:35:15.638Z",
      "x_nadsec_last_seen": "2026-03-26T12:37:20.593Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-26T13:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--4c6d1150-050f-4c21-a29f-29979327d32c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T13:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.209.122.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T13:05:56.000Z",
      "valid_until": "2026-04-27T13:05:05.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-26T13:01:46.446Z",
      "x_nadsec_last_seen": "2026-03-26T13:08:49.001Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-26T13:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=263432; asn_org=CORPORATIVA TELECOMUNICACOES EIRELI ME",
      "id": "indicator--99428503-b124-44da-91be-f61c089a3a18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T13:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.22.124.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T13:05:56.000Z",
      "valid_until": "2026-04-27T13:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-26T12:59:17.883Z",
      "x_nadsec_last_seen": "2026-03-26T13:00:13.941Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263432"
      ],
      "x_nadsec_orgs": [
        "CORPORATIVA TELECOMUNICACOES EIRELI ME"
      ]
    },
    {
      "created": "2026-03-26T13:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--31b81483-2128-4314-ae71-65ca834cca8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T13:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.62.193.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T13:05:56.000Z",
      "valid_until": "2026-04-27T13:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T12:43:12.230Z",
      "x_nadsec_last_seen": "2026-03-26T12:43:15.550Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-26T13:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=13999; asn_org=Mega Cable, S.A. de C.V.",
      "id": "indicator--c343e197-c3b8-45fe-8e53-ea3be6be1abf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T13:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.243.78.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T13:05:56.000Z",
      "valid_until": "2026-04-27T13:05:05.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T12:48:24.177Z",
      "x_nadsec_last_seen": "2026-03-26T12:48:24.223Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "13999"
      ],
      "x_nadsec_orgs": [
        "Mega Cable, S.A. de C.V."
      ]
    },
    {
      "created": "2026-03-26T13:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=2561; asn_org=EUN",
      "id": "indicator--3cadadcb-19af-4d34-8c40-b3fbcdc3c947",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T13:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.227.62.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T13:05:56.000Z",
      "valid_until": "2026-04-27T13:05:05.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-26T12:07:11.970Z",
      "x_nadsec_last_seen": "2026-03-26T12:08:02.050Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "2561"
      ],
      "x_nadsec_orgs": [
        "EUN"
      ]
    },
    {
      "created": "2026-03-26T13:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--520382f7-8d3f-40cd-800c-0470bb02fb6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T13:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '209.38.18.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T13:05:56.000Z",
      "valid_until": "2026-04-27T13:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T12:52:16.343Z",
      "x_nadsec_last_seen": "2026-03-26T12:52:16.343Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-26T13:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--6dfecc37-c91f-4c7a-b8ba-57ab139542ec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T13:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '221.199.73.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T13:05:56.000Z",
      "valid_until": "2026-04-27T13:05:05.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T12:35:28.534Z",
      "x_nadsec_last_seen": "2026-03-26T12:35:28.534Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-26T13:05:56.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--16876d5a-4180-437d-b737-b0753aa0c562",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T13:05:56.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.247.139.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T13:05:56.000Z",
      "valid_until": "2026-04-27T13:05:05.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T12:48:39.756Z",
      "x_nadsec_last_seen": "2026-03-26T12:48:46.645Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-26T15:06:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=SZ; asn=329095; asn_org=AFRIMETRO-AS",
      "id": "indicator--f8126f9b-dc50-4b2a-ad96-e5aa891ac5e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T15:06:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.215.99.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T15:06:33.000Z",
      "valid_until": "2026-04-27T15:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-26T14:20:09.996Z",
      "x_nadsec_last_seen": "2026-03-26T14:27:32.815Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SZ"
      ],
      "x_nadsec_asns": [
        "329095"
      ],
      "x_nadsec_orgs": [
        "AFRIMETRO-AS"
      ]
    },
    {
      "created": "2026-03-26T15:06:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=131090; asn_org=National Telecom Public Company Limited",
      "id": "indicator--7e8cc4f7-521e-486e-9786-f88c41417ba2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T15:06:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.42.86.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T15:06:33.000Z",
      "valid_until": "2026-04-27T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T15:02:12.979Z",
      "x_nadsec_last_seen": "2026-03-26T15:04:18.046Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131090"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-26T15:06:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--58a1cee7-e7c0-489d-b353-cd2ebe756aec",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T15:06:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.250.196.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T15:06:33.000Z",
      "valid_until": "2026-04-27T15:05:08.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T14:26:39.459Z",
      "x_nadsec_last_seen": "2026-03-26T14:26:39.667Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-26T15:06:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--0a076f6c-c7c1-49ac-91a6-1b16c21ef992",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T15:06:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.57.195.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T15:06:33.000Z",
      "valid_until": "2026-04-27T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T14:07:26.039Z",
      "x_nadsec_last_seen": "2026-03-26T14:09:32.390Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-03-26T15:06:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23693; asn_org=PT. Telekomunikasi Selular",
      "id": "indicator--17fab2c0-c0e8-42fd-8f67-c56e76a2449f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T15:06:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.9.35.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T15:06:33.000Z",
      "valid_until": "2026-04-27T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T14:27:54.007Z",
      "x_nadsec_last_seen": "2026-03-26T14:29:58.508Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23693"
      ],
      "x_nadsec_orgs": [
        "PT. Telekomunikasi Selular"
      ]
    },
    {
      "created": "2026-03-26T15:06:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=8048; asn_org=CANTV Servicios, Venezuela",
      "id": "indicator--32e53904-b6ce-4e3b-bb02-6435ec13bc9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T15:06:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.202.149.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T15:06:33.000Z",
      "valid_until": "2026-04-27T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T14:25:49.911Z",
      "x_nadsec_last_seen": "2026-03-26T14:27:55.913Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "8048"
      ],
      "x_nadsec_orgs": [
        "CANTV Servicios, Venezuela"
      ]
    },
    {
      "created": "2026-03-26T15:06:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bff4c7ab-8f61-4122-ae3c-6837dce53e5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T15:06:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.168.121.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T15:06:33.000Z",
      "valid_until": "2026-04-27T15:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T14:42:11.317Z",
      "x_nadsec_last_seen": "2026-03-26T14:42:11.317Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-26T15:06:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--2e71e016-3a57-421c-8129-7739a9e3d31e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T15:06:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.137.52.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T15:06:33.000Z",
      "valid_until": "2026-04-27T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T14:53:21.232Z",
      "x_nadsec_last_seen": "2026-03-26T14:55:26.208Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-03-26T15:06:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--f38d7fe0-f202-4339-abbf-5c8f96bd04ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T15:06:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.38.70.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T15:06:33.000Z",
      "valid_until": "2026-04-27T15:05:08.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-26T14:08:28.196Z",
      "x_nadsec_last_seen": "2026-03-26T14:15:28.025Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-26T15:06:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=16223; asn_org=Maxnet Telecom, Ltd",
      "id": "indicator--8c75bd43-73df-45b1-a14b-4bcd37800d36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T15:06:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.58.17.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T15:06:33.000Z",
      "valid_until": "2026-04-27T15:05:08.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T14:42:27.724Z",
      "x_nadsec_last_seen": "2026-03-26T14:42:33.977Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "16223"
      ],
      "x_nadsec_orgs": [
        "Maxnet Telecom, Ltd"
      ]
    },
    {
      "created": "2026-03-26T15:06:33.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=401626; asn_org=Netiface America, Inc.; user(top)=r**t",
      "id": "indicator--495e4692-5043-4b44-a343-2eabc6f48026",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T15:06:33.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.89.163.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T15:06:33.000Z",
      "valid_until": "2026-04-27T15:05:08.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T14:16:12.801Z",
      "x_nadsec_last_seen": "2026-03-26T14:16:12.801Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "401626"
      ],
      "x_nadsec_orgs": [
        "Netiface America, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-26T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--53ce8a51-b71d-4411-a28e-0fa1c25a858f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:05:03.000Z",
      "valid_until": "2026-04-27T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T16:01:54.000Z",
      "x_nadsec_last_seen": "2026-03-26T16:01:54.000Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-26T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=23106; asn_org=AMERICAN TOWER DO BRASIL-COMUNICACAO MULTIMIDIA LT",
      "id": "indicator--e5bfa6c5-d81e-4f7c-91d3-7eb9b86e0f4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.248.197.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:05:03.000Z",
      "valid_until": "2026-04-27T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T15:07:51.484Z",
      "x_nadsec_last_seen": "2026-03-26T15:09:58.595Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "23106"
      ],
      "x_nadsec_orgs": [
        "AMERICAN TOWER DO BRASIL-COMUNICACAO MULTIMIDIA LT"
      ]
    },
    {
      "created": "2026-03-26T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--bf6766f0-4d9d-4558-be62-06231f0e3e45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.188.104.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:05:03.000Z",
      "valid_until": "2026-04-27T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T15:10:55.020Z",
      "x_nadsec_last_seen": "2026-03-26T15:13:01.815Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-26T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c8ce7a9e-11d2-4642-9a4e-98d93c39112d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:05:03.000Z",
      "valid_until": "2026-04-27T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T15:42:57.695Z",
      "x_nadsec_last_seen": "2026-03-29T11:00:44.310Z",
      "x_nadsec_ports": [
        "81",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-26T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--8e2cfd3e-1117-49ee-b326-635fe7201d2e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.130.195.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:05:03.000Z",
      "valid_until": "2026-04-27T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-26T15:33:45.562Z",
      "x_nadsec_last_seen": "2026-03-26T15:40:43.354Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-26T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=ID; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f89f61d1-3222-4314-9dce-643cd598b89a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.150.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:05:02.000Z",
      "valid_until": "2026-04-27T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T17:59:02.809Z",
      "x_nadsec_last_seen": "2026-03-26T17:59:31.948Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-26T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=GE; asn=201174; asn_org=Tbilisi City Hall",
      "id": "indicator--4077f294-2b00-432c-9d30-ed0acb56b856",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.83.37.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:05:02.000Z",
      "valid_until": "2026-04-27T18:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-26T17:01:43.877Z",
      "x_nadsec_last_seen": "2026-03-30T17:52:57.611Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "201174"
      ],
      "x_nadsec_orgs": [
        "Tbilisi City Hall"
      ]
    },
    {
      "created": "2026-03-26T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EC; asn=27947; asn_org=Telconet S.A",
      "id": "indicator--8f6f3fcf-8b10-4da8-a40f-bdb9273240bf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.4.167.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:05:02.000Z",
      "valid_until": "2026-04-27T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T17:32:15.467Z",
      "x_nadsec_last_seen": "2026-03-26T17:32:15.614Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "27947"
      ],
      "x_nadsec_orgs": [
        "Telconet S.A"
      ]
    },
    {
      "created": "2026-03-26T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--3a7aa0a2-5f86-4e2a-864e-32d193954e01",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.188.116.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:05:02.000Z",
      "valid_until": "2026-04-27T18:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-26T17:07:49.801Z",
      "x_nadsec_last_seen": "2026-03-26T17:09:54.060Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-26T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--4487d9c8-da06-4066-a8ce-bc9b90c93bd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.203.201.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:05:02.000Z",
      "valid_until": "2026-04-27T18:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T17:03:13.089Z",
      "x_nadsec_last_seen": "2026-03-26T17:09:55.174Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-26T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--86e892f1-3380-40f2-baa3-70d7cb83a292",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:05:02.000Z",
      "valid_until": "2026-04-27T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T17:53:09.291Z",
      "x_nadsec_last_seen": "2026-03-26T17:53:09.291Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-26T18:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--e395f3c8-2007-493f-838d-24d66bf4b019",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T18:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:05:02.000Z",
      "valid_until": "2026-04-27T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T17:53:19.737Z",
      "x_nadsec_last_seen": "2026-03-26T17:53:19.737Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-26T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f77331a4-1317-44bf-a471-b9269c8f7f3d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.200.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:05:03.000Z",
      "valid_until": "2026-04-27T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T19:00:45.015Z",
      "x_nadsec_last_seen": "2026-03-26T19:01:05.680Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-26T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--673d0431-3522-4d2c-95db-417ddf34bc12",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.138.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:05:03.000Z",
      "valid_until": "2026-04-27T19:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-26T18:14:01.415Z",
      "x_nadsec_last_seen": "2026-03-31T21:56:18.179Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-26T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--2addf4d7-8a01-4726-a08a-0dba8bb04504",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.210.9.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:05:03.000Z",
      "valid_until": "2026-04-27T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T18:10:31.995Z",
      "x_nadsec_last_seen": "2026-03-26T18:10:42.186Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-26T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--585de1fd-bdf2-4f51-a722-6d2fa72157c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.128.235.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:05:03.000Z",
      "valid_until": "2026-04-27T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T19:04:09.650Z",
      "x_nadsec_last_seen": "2026-03-26T19:04:09.650Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-26T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=OM; asn=206350; asn_org=Oman Research and education Network (OMREN)",
      "id": "indicator--c3fc4835-4417-4089-9fd9-ef8647d513d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.186.207.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:05:03.000Z",
      "valid_until": "2026-04-27T19:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-26T19:04:39.286Z",
      "x_nadsec_last_seen": "2026-03-26T19:05:59.749Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "OM"
      ],
      "x_nadsec_asns": [
        "206350"
      ],
      "x_nadsec_orgs": [
        "Oman Research and education Network (OMREN)"
      ]
    },
    {
      "created": "2026-03-26T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--1e2d4eed-c22d-4eeb-aff7-b6998ec9f49a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.20.7.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:05:03.000Z",
      "valid_until": "2026-04-27T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T18:57:03.674Z",
      "x_nadsec_last_seen": "2026-03-26T18:59:09.775Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-26T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--2c286635-4ac9-4ef1-89a1-7c921cf1fa73",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.36.103.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:05:03.000Z",
      "valid_until": "2026-04-27T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T19:01:05.810Z",
      "x_nadsec_last_seen": "2026-03-26T19:03:12.092Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-03-26T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=17; services=ftpd; ports=21; cc=RU; asn=28890; asn_org=INSYS LLC",
      "id": "indicator--fecefb12-a96e-4a51-8f65-66185673e353",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.151.196.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:05:03.000Z",
      "valid_until": "2026-04-27T19:05:01.000Z",
      "x_nadsec_event_count": 17,
      "x_nadsec_first_seen": "2026-03-26T18:20:53.843Z",
      "x_nadsec_last_seen": "2026-03-26T18:29:43.702Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28890"
      ],
      "x_nadsec_orgs": [
        "INSYS LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        "***",
        "1****3",
        "1****6",
        "a***n",
        "a*******s"
      ]
    },
    {
      "created": "2026-03-26T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=15377; asn_org=Traditional LLC",
      "id": "indicator--45ab3b90-033f-450a-b0d3-4cd2600d275b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.218.181.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:05:03.000Z",
      "valid_until": "2026-04-27T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T18:05:53.359Z",
      "x_nadsec_last_seen": "2026-03-26T18:07:59.363Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "15377"
      ],
      "x_nadsec_orgs": [
        "Traditional LLC"
      ]
    },
    {
      "created": "2026-03-26T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7876cd51-7f7a-4b07-adb3-dc328aa3b523",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.110.150.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:05:02.000Z",
      "valid_until": "2026-04-27T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T19:38:46.032Z",
      "x_nadsec_last_seen": "2026-03-26T19:38:46.032Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-26T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=269771; asn_org=PRINTER-NET-SERVICE, C.A.",
      "id": "indicator--fdb51c51-6884-4945-a242-a80b680cac89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.62.127.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:05:02.000Z",
      "valid_until": "2026-04-27T20:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T19:27:08.304Z",
      "x_nadsec_last_seen": "2026-03-26T19:29:14.370Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "269771"
      ],
      "x_nadsec_orgs": [
        "PRINTER-NET-SERVICE, C.A."
      ]
    },
    {
      "created": "2026-03-26T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BE; asn=6848; asn_org=Telenet BV",
      "id": "indicator--d9a400c9-f679-429e-a8a1-f51e520a683c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.116.132.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:05:02.000Z",
      "valid_until": "2026-04-27T20:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T19:57:36.596Z",
      "x_nadsec_last_seen": "2026-03-26T19:59:43.158Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "6848"
      ],
      "x_nadsec_orgs": [
        "Telenet BV"
      ]
    },
    {
      "created": "2026-03-26T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=PT; asn=21859; asn_org=Zenlayer Inc",
      "id": "indicator--f46d730b-99c1-42f8-82f4-5ec2d2ba9c1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:05:02.000Z",
      "valid_until": "2026-04-27T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T20:00:41.988Z",
      "x_nadsec_last_seen": "2026-03-26T20:00:41.988Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "PT"
      ],
      "x_nadsec_asns": [
        "21859"
      ],
      "x_nadsec_orgs": [
        "Zenlayer Inc"
      ]
    },
    {
      "created": "2026-03-26T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--900a1b90-c38f-41b9-bb28-a0eef43e905b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:05:02.000Z",
      "valid_until": "2026-04-27T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T19:23:51.085Z",
      "x_nadsec_last_seen": "2026-03-26T19:23:51.085Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-26T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5ae7d2c1-3f4d-41df-87a1-3dc605f40aeb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:05:02.000Z",
      "valid_until": "2026-04-27T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T19:23:40.741Z",
      "x_nadsec_last_seen": "2026-03-26T19:23:40.741Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-26T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--e64b603f-e851-4603-aca2-20ce870b09f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.188.100.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:05:02.000Z",
      "valid_until": "2026-04-27T20:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-26T19:50:53.718Z",
      "x_nadsec_last_seen": "2026-03-26T19:52:59.013Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-26T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--bcda6eda-cba1-4347-ac1b-cf184eadfed7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:05:02.000Z",
      "valid_until": "2026-04-27T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T19:43:34.168Z",
      "x_nadsec_last_seen": "2026-03-26T19:43:34.168Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-26T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--74d4d780-60e9-4989-9ef2-2a11f5895e1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.89.192.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:05:02.000Z",
      "valid_until": "2026-04-27T20:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T19:05:03.255Z",
      "x_nadsec_last_seen": "2026-03-26T19:05:03.388Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "45102"
      ],
      "x_nadsec_orgs": [
        "Alibaba US Technology Co., Ltd."
      ]
    },
    {
      "created": "2026-03-26T20:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--73f7a24e-d960-43e5-80e0-210c1ab6ce35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T20:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.26.233.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T20:05:02.000Z",
      "valid_until": "2026-04-27T20:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-26T19:27:24.456Z",
      "x_nadsec_last_seen": "2026-03-26T19:31:35.377Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-26T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45582; asn_org=VAINAVI INDUSTIES LTD, INTERNET SERVICE PROVIDER, INDIA",
      "id": "indicator--bb178bda-c25c-413b-b641-fd73b3fb13b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.235.52.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T21:05:04.000Z",
      "valid_until": "2026-04-27T21:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T20:16:15.951Z",
      "x_nadsec_last_seen": "2026-03-26T20:18:20.525Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45582"
      ],
      "x_nadsec_orgs": [
        "VAINAVI INDUSTIES LTD, INTERNET SERVICE PROVIDER, INDIA"
      ]
    },
    {
      "created": "2026-03-26T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC; user(top)=a*******s; pass(top)=a*******s",
      "id": "indicator--b8794f97-2071-4c95-b50f-0b9785175733",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.223.189.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T21:05:04.000Z",
      "valid_until": "2026-04-27T21:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-26T20:09:17.372Z",
      "x_nadsec_last_seen": "2026-03-26T20:09:17.372Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a*******s"
      ]
    },
    {
      "created": "2026-03-26T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=GE; asn=35805; asn_org=JSC Silknet",
      "id": "indicator--496289d2-79f5-4904-961e-d3e03b5549d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.134.24.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T21:05:04.000Z",
      "valid_until": "2026-04-27T21:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-26T21:03:28.376Z",
      "x_nadsec_last_seen": "2026-03-26T21:04:33.877Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "35805"
      ],
      "x_nadsec_orgs": [
        "JSC Silknet"
      ]
    },
    {
      "created": "2026-03-26T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--9776beb6-7b91-43e0-b5f7-aac0ae4b162a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.191.249.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T21:05:04.000Z",
      "valid_until": "2026-04-27T21:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T20:30:07.563Z",
      "x_nadsec_last_seen": "2026-03-26T20:32:16.280Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-26T21:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=ftpd; ports=21; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--37223960-29a8-41d2-a0de-3d50f5fdefbc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T21:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.175.211.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T21:05:04.000Z",
      "valid_until": "2026-04-27T21:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-26T20:09:27.147Z",
      "x_nadsec_last_seen": "2026-03-26T20:09:30.941Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-26T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=24173; asn_org=Netnam Company",
      "id": "indicator--29a9c63f-0d7b-46ad-8ba4-a9adf2f6097f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.53.36.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T22:05:02.000Z",
      "valid_until": "2026-04-27T22:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-26T21:05:37.264Z",
      "x_nadsec_last_seen": "2026-03-26T21:12:11.243Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "24173"
      ],
      "x_nadsec_orgs": [
        "Netnam Company"
      ]
    },
    {
      "created": "2026-03-26T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--5ed391d6-686a-49ec-b900-de578c232106",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.81.169.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T22:05:02.000Z",
      "valid_until": "2026-04-27T22:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-26T21:09:00.128Z",
      "x_nadsec_last_seen": "2026-03-30T20:13:17.964Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "445",
        "1723",
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "httpd",
        "mqttd",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-03-26T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--4b0444f0-4858-43de-a53f-4cd1e8f0b136",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.250.244.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T22:05:02.000Z",
      "valid_until": "2026-04-27T22:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-26T22:02:30.881Z",
      "x_nadsec_last_seen": "2026-03-26T22:09:36.623Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-26T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--e517a848-c5f5-4c34-a915-10d941bb0de9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.181.24.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:05:03.000Z",
      "valid_until": "2026-04-27T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T22:48:38.166Z",
      "x_nadsec_last_seen": "2026-03-26T22:50:42.861Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-26T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--74181c4b-3826-4b90-9f62-dc037a0c0fb8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.176.218.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:05:03.000Z",
      "valid_until": "2026-04-27T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T22:38:46.607Z",
      "x_nadsec_last_seen": "2026-03-26T22:40:51.464Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-26T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b287e798-0363-4eea-a389-a0de67314c95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.86.116.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:05:03.000Z",
      "valid_until": "2026-04-27T23:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T22:48:19.996Z",
      "x_nadsec_last_seen": "2026-03-26T22:48:30.346Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-26T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=2609; asn_org=TN-BB-AS Tunisia BackBone AS",
      "id": "indicator--3a7c8631-a04d-4b6f-bead-23f21a724ea9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.203.228.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:05:03.000Z",
      "valid_until": "2026-04-27T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T22:46:20.251Z",
      "x_nadsec_last_seen": "2026-03-26T22:48:26.851Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "2609"
      ],
      "x_nadsec_orgs": [
        "TN-BB-AS Tunisia BackBone AS"
      ]
    },
    {
      "created": "2026-03-26T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--59ad9476-4aa1-42b4-88cc-b349bab83244",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-26T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.63.203.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T23:05:03.000Z",
      "valid_until": "2026-04-27T23:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-26T22:39:37.014Z",
      "x_nadsec_last_seen": "2026-03-26T22:40:03.511Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-27T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--f7a2d96d-04dc-4da5-8dfc-03029bc8e794",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.172.170.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:05:04.000Z",
      "valid_until": "2026-04-28T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T23:40:52.351Z",
      "x_nadsec_last_seen": "2026-03-26T23:42:57.132Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-27T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--e7d99d17-2809-4aa4-b36f-6964e18e3bd7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.226.51.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:05:04.000Z",
      "valid_until": "2026-04-28T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T23:05:51.128Z",
      "x_nadsec_last_seen": "2026-03-26T23:05:51.207Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-27T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--c3713c0f-6a6d-4429-b360-6784fc07d96c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.142.159.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:05:04.000Z",
      "valid_until": "2026-04-28T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T00:00:06.034Z",
      "x_nadsec_last_seen": "2026-03-31T18:38:03.172Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ],
      "x_nadsec_usernames_attempted": [
        "c**n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-27T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3f72eb9b-f12b-44b5-9139-69450bcbbda0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.39.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:05:04.000Z",
      "valid_until": "2026-04-28T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T23:27:24.149Z",
      "x_nadsec_last_seen": "2026-03-26T23:27:34.292Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-27T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--71a33d9a-ea64-4c76-94f0-c7f09a27c746",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:05:04.000Z",
      "valid_until": "2026-04-28T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T23:51:38.471Z",
      "x_nadsec_last_seen": "2026-03-31T15:29:09.208Z",
      "x_nadsec_ports": [
        "21",
        "1433"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-27T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--d1043822-6afd-484d-9873-d7c48108682b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.69.160.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:05:04.000Z",
      "valid_until": "2026-04-28T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-26T23:22:03.963Z",
      "x_nadsec_last_seen": "2026-03-26T23:24:08.699Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-27T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--e3893a71-8c21-4b8f-946d-c420fad96a86",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T00:05:04.000Z",
      "valid_until": "2026-04-28T00:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-26T23:11:59.438Z",
      "x_nadsec_last_seen": "2026-03-30T23:33:39.461Z",
      "x_nadsec_ports": [
        "81",
        "1433"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-27T01:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--2f9cd963-1ca1-4aee-87fc-e6b1a25b1551",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.70.74.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:05:06.000Z",
      "valid_until": "2026-04-28T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T00:32:59.126Z",
      "x_nadsec_last_seen": "2026-03-27T00:35:04.260Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-27T01:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=26599; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--f9339b89-773d-4823-bed8-ed832d937dc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.214.186.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:05:06.000Z",
      "valid_until": "2026-04-28T01:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T00:57:02.780Z",
      "x_nadsec_last_seen": "2026-03-27T01:03:55.385Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26599"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-27T01:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--ce810f57-9c9e-4e1f-9c14-df69c1906a18",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.155.54.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:05:06.000Z",
      "valid_until": "2026-04-28T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T00:12:13.763Z",
      "x_nadsec_last_seen": "2026-03-27T00:14:19.561Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-27T01:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=12735; asn_org=TurkNet Iletisim Hizmetleri A.S.",
      "id": "indicator--8b69c0e3-52f8-4664-be44-9521a768150f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.125.22.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:05:06.000Z",
      "valid_until": "2026-04-28T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T00:48:23.178Z",
      "x_nadsec_last_seen": "2026-03-27T00:50:29.341Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "12735"
      ],
      "x_nadsec_orgs": [
        "TurkNet Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-27T01:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--35a1abc8-454a-4cf2-83c7-16d755efa18b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '221.199.73.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:05:06.000Z",
      "valid_until": "2026-04-28T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T00:12:48.889Z",
      "x_nadsec_last_seen": "2026-03-27T00:12:48.889Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-27T01:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--41915bac-7ca4-4f77-a7db-b1577738798a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.226.186.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:05:06.000Z",
      "valid_until": "2026-04-28T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T00:56:48.689Z",
      "x_nadsec_last_seen": "2026-03-27T00:56:48.689Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-27T01:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--87ca6ef3-59d1-4432-bb8d-4065e5a8935e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:05:06.000Z",
      "valid_until": "2026-04-28T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T00:33:39.877Z",
      "x_nadsec_last_seen": "2026-03-27T00:33:39.877Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-27T01:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--34a40395-f1c2-4540-866b-6ddacdaa5cc4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:05:06.000Z",
      "valid_until": "2026-04-28T01:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-27T00:38:06.966Z",
      "x_nadsec_last_seen": "2026-03-27T14:34:23.188Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-27T01:05:06.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--86afdaf8-2fb2-4316-82ff-7ace04dd6b81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T01:05:06.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:05:06.000Z",
      "valid_until": "2026-04-28T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T01:01:25.195Z",
      "x_nadsec_last_seen": "2026-03-27T01:01:25.195Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-27T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--4072bef7-9900-4fec-9671-5f667f7b029a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.162.84.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T02:05:03.000Z",
      "valid_until": "2026-04-28T02:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T01:36:14.533Z",
      "x_nadsec_last_seen": "2026-03-27T01:43:20.544Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-27T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=4800; asn_org=PT Aplikanusa Lintasarta",
      "id": "indicator--e4fe58ec-d6e7-44d5-9baf-901e7c62b1eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.231.189.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T02:05:03.000Z",
      "valid_until": "2026-04-28T02:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T01:58:04.151Z",
      "x_nadsec_last_seen": "2026-03-27T02:03:47.066Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4800"
      ],
      "x_nadsec_orgs": [
        "PT Aplikanusa Lintasarta"
      ]
    },
    {
      "created": "2026-03-27T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--eb9a35a4-209d-4688-bc03-92105c073af5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T02:05:03.000Z",
      "valid_until": "2026-04-28T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T01:33:39.512Z",
      "x_nadsec_last_seen": "2026-03-27T01:33:39.512Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-27T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--de599150-ddb9-4e4e-9028-67b1bafe6d5a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.171.26.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T02:05:03.000Z",
      "valid_until": "2026-04-28T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T01:23:40.143Z",
      "x_nadsec_last_seen": "2026-03-27T01:23:40.143Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-27T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--f009e501-5d49-4932-85dc-ed620b490a88",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.84.144.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T02:05:03.000Z",
      "valid_until": "2026-04-28T02:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T01:43:00.852Z",
      "x_nadsec_last_seen": "2026-03-27T01:43:00.852Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-27T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--f40042e4-3a6f-4bd8-a7e3-fd7fdb4c6c36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.165.109.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T02:05:03.000Z",
      "valid_until": "2026-04-28T02:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T01:56:55.008Z",
      "x_nadsec_last_seen": "2026-03-27T01:59:01.151Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-03-27T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5b16f8a9-fc9f-4d22-9d72-12d680d78b98",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.190.242.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T03:05:02.000Z",
      "valid_until": "2026-04-28T03:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T02:17:23.136Z",
      "x_nadsec_last_seen": "2026-03-27T02:19:27.940Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-27T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e4253d39-5664-41af-8a5b-1f0aaeeab9f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.215.145.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T03:05:02.000Z",
      "valid_until": "2026-04-28T03:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T02:06:01.540Z",
      "x_nadsec_last_seen": "2026-03-27T02:06:01.540Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-27T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--627a9897-3e98-4193-a431-a5a459263607",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.73.176.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T03:05:02.000Z",
      "valid_until": "2026-04-28T03:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-27T02:56:39.166Z",
      "x_nadsec_last_seen": "2026-03-27T02:58:42.959Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-27T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--4fd07eb7-d4fa-4903-90f9-c4ddcd1a0f28",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.82.212.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T03:05:02.000Z",
      "valid_until": "2026-04-28T03:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T02:11:03.717Z",
      "x_nadsec_last_seen": "2026-03-27T02:17:39.024Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-03-27T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=ES; asn=41608; asn_org=NextGenWebs, S.L.",
      "id": "indicator--cf9957bf-c06e-466b-9d56-e786af86f2b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.213.175.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T03:05:02.000Z",
      "valid_until": "2026-04-28T03:05:00.000Z",
      "x_nadsec_event_count": 134,
      "x_nadsec_first_seen": "2026-03-27T02:49:45.989Z",
      "x_nadsec_last_seen": "2026-03-27T03:30:53.199Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "41608"
      ],
      "x_nadsec_orgs": [
        "NextGenWebs, S.L."
      ]
    },
    {
      "created": "2026-03-27T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--028ab0f4-a750-4b1c-b980-ca10116219aa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.171.8.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T03:05:02.000Z",
      "valid_until": "2026-04-28T03:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T02:59:48.048Z",
      "x_nadsec_last_seen": "2026-03-27T02:59:48.398Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-27T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--45eb9958-29f0-4cd5-9885-ee201f49a9a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '218.1.116.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T03:05:02.000Z",
      "valid_until": "2026-04-28T03:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T02:48:45.834Z",
      "x_nadsec_last_seen": "2026-03-27T02:48:45.834Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-27T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--fc733ad0-906a-4e2a-9a90-70e2190d57c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.205.64.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T03:05:02.000Z",
      "valid_until": "2026-04-28T03:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T02:58:37.489Z",
      "x_nadsec_last_seen": "2026-03-27T02:58:37.535Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-27T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T03:05:02.000Z",
      "valid_until": "2026-04-28T03:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T02:49:11.347Z",
      "x_nadsec_last_seen": "2026-03-31T09:52:12.627Z",
      "x_nadsec_ports": [
        "445",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-27T03:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--70af2251-9d2b-4721-97a5-d86fcda4eaee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T03:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T03:05:02.000Z",
      "valid_until": "2026-04-28T03:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T03:04:01.450Z",
      "x_nadsec_last_seen": "2026-03-27T03:04:01.450Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-27T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BD; asn=135353; asn_org=MD SHIRAJUL HAIDER TA Cue Club Technology; user(top)=**",
      "id": "indicator--4c1378f5-e430-494b-b40a-86e0e9e5463a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.214.219.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T04:05:04.000Z",
      "valid_until": "2026-04-28T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T03:30:04.249Z",
      "x_nadsec_last_seen": "2026-03-27T03:30:04.249Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "135353"
      ],
      "x_nadsec_orgs": [
        "MD SHIRAJUL HAIDER TA Cue Club Technology"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-27T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.",
      "id": "indicator--331692a7-07f9-4d57-b65c-9ae79eec2918",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.102.137.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T04:05:04.000Z",
      "valid_until": "2026-04-28T04:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-27T03:39:03.564Z",
      "x_nadsec_last_seen": "2026-03-27T03:39:43.384Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ]
    },
    {
      "created": "2026-03-27T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=50219; asn_org=Valence Technology Co.",
      "id": "indicator--f862750a-1364-4ac3-8d4a-d0cb0fca9f7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T04:05:04.000Z",
      "valid_until": "2026-04-28T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T03:33:40.240Z",
      "x_nadsec_last_seen": "2026-03-27T03:33:40.240Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "50219"
      ],
      "x_nadsec_orgs": [
        "Valence Technology Co."
      ]
    },
    {
      "created": "2026-03-27T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3a5c4bff-63fa-4134-8d3e-0731f1ba8a1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T04:05:04.000Z",
      "valid_until": "2026-04-28T04:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T03:12:11.028Z",
      "x_nadsec_last_seen": "2026-03-29T00:39:53.373Z",
      "x_nadsec_ports": [
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-27T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=UA; asn=3236; asn_org=Server.ua LLC; user(top)=**",
      "id": "indicator--08c6497e-0dea-4bb8-b268-a93fcfc634a9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.232.29.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T04:05:04.000Z",
      "valid_until": "2026-04-28T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T04:02:54.864Z",
      "x_nadsec_last_seen": "2026-03-27T04:02:54.864Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "3236"
      ],
      "x_nadsec_orgs": [
        "Server.ua LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-27T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--9b50d258-edf8-4ee6-bac0-8d0d895fa033",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T05:05:03.000Z",
      "valid_until": "2026-04-28T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T05:03:23.216Z",
      "x_nadsec_last_seen": "2026-03-27T05:03:23.216Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-27T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--b31aa61e-a702-4aa5-ab4d-de4f4535c2ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T05:05:03.000Z",
      "valid_until": "2026-04-28T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T05:03:23.461Z",
      "x_nadsec_last_seen": "2026-03-27T05:03:23.461Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-27T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=45609; asn_org=Bharti Airtel Ltd. AS for GPRS Service",
      "id": "indicator--16759fcb-5786-4a98-9eec-ef2781531012",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.60.132.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T05:05:03.000Z",
      "valid_until": "2026-04-28T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T04:58:44.513Z",
      "x_nadsec_last_seen": "2026-03-27T05:00:50.576Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45609"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd. AS for GPRS Service"
      ]
    },
    {
      "created": "2026-03-27T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--51133b72-ae9b-49e9-a894-4893e40a069c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T05:05:03.000Z",
      "valid_until": "2026-04-28T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T04:31:11.413Z",
      "x_nadsec_last_seen": "2026-03-27T04:31:11.413Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-27T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--b52430fd-ff91-435c-ad8b-0791ea446816",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.104.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T06:05:02.000Z",
      "valid_until": "2026-04-28T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T06:01:01.280Z",
      "x_nadsec_last_seen": "2026-03-27T06:03:06.079Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-27T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--59b569f6-8aea-4273-b078-ca35699bbc35",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.8.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T06:05:02.000Z",
      "valid_until": "2026-04-28T06:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-27T05:46:57.287Z",
      "x_nadsec_last_seen": "2026-03-27T06:39:51.316Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-27T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7faab1fa-8822-4d41-82ce-6547ad8e6aa8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.14.73.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T06:05:02.000Z",
      "valid_until": "2026-04-28T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T05:23:54.401Z",
      "x_nadsec_last_seen": "2026-03-29T13:44:33.602Z",
      "x_nadsec_ports": [
        "1723",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-27T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--28be8f39-fbe7-49b9-986b-13a7c6a5bff9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.254.176.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T06:05:02.000Z",
      "valid_until": "2026-04-28T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T05:07:19.283Z",
      "x_nadsec_last_seen": "2026-03-27T05:09:26.005Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-27T06:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=47789; asn_org=Regionalniye Seti Ltd.",
      "id": "indicator--28bcfac4-4f03-4912-a80b-82641d82a08b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T06:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.205.53.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T06:05:02.000Z",
      "valid_until": "2026-04-28T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T05:06:34.927Z",
      "x_nadsec_last_seen": "2026-03-27T05:06:34.927Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "47789"
      ],
      "x_nadsec_orgs": [
        "Regionalniye Seti Ltd."
      ]
    },
    {
      "created": "2026-03-27T07:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3d3252e4-26e8-4999-a79c-8eeae2d7e5d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.81.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:05:15.000Z",
      "valid_until": "2026-04-28T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-27T06:09:43.472Z",
      "x_nadsec_last_seen": "2026-03-27T06:10:10.187Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-27T07:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--52560c72-a07f-4e21-bcfd-b0da6a81a7e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.6.97.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:05:15.000Z",
      "valid_until": "2026-04-28T07:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-27T06:26:06.776Z",
      "x_nadsec_last_seen": "2026-03-27T06:43:35.057Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-27T07:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=12; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--56a09db2-bcb2-4926-9403-bc627cdeb01d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.176.233.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:05:15.000Z",
      "valid_until": "2026-04-28T07:05:01.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-27T06:27:53.310Z",
      "x_nadsec_last_seen": "2026-03-27T06:28:04.816Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!**$"
      ]
    },
    {
      "created": "2026-03-27T07:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--2bd45788-a204-40fc-8333-8582f6d91314",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.17.22.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:05:15.000Z",
      "valid_until": "2026-04-28T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T06:50:22.046Z",
      "x_nadsec_last_seen": "2026-03-27T06:52:26.804Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-27T07:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4107480d-6c65-4246-83b6-b69afe399b53",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.224.142.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:05:15.000Z",
      "valid_until": "2026-04-28T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T06:56:37.893Z",
      "x_nadsec_last_seen": "2026-03-27T07:03:14.836Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-27T07:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=36926; asn_org=CKL1-ASN",
      "id": "indicator--560d6c2b-3943-49e9-8f6e-7123986b3078",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.159.237.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:05:15.000Z",
      "valid_until": "2026-04-28T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T06:16:29.677Z",
      "x_nadsec_last_seen": "2026-03-27T06:18:37.788Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "36926"
      ],
      "x_nadsec_orgs": [
        "CKL1-ASN"
      ]
    },
    {
      "created": "2026-03-27T07:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--d2b2b82d-975c-4223-83cb-d2466d555d6f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.189.233.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:05:15.000Z",
      "valid_until": "2026-04-28T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T06:42:38.801Z",
      "x_nadsec_last_seen": "2026-03-27T06:50:44.570Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-27T07:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c119702c-2f0f-45f3-a635-2f3a618375b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:05:15.000Z",
      "valid_until": "2026-04-28T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T06:27:03.904Z",
      "x_nadsec_last_seen": "2026-03-27T06:27:03.904Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-27T07:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--964f8e6b-a4e8-42e2-921b-70af00cbe8d8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:05:15.000Z",
      "valid_until": "2026-04-28T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-27T06:07:00.051Z",
      "x_nadsec_last_seen": "2026-03-27T06:07:01.079Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-27T07:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fed758bd-83c2-47bd-b7f0-5c8e92e8791c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:05:15.000Z",
      "valid_until": "2026-04-28T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T06:10:34.903Z",
      "x_nadsec_last_seen": "2026-03-27T06:10:34.903Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-27T07:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=57587; asn_org=integrated Communication Networks LLC",
      "id": "indicator--1a05bd00-fa1b-4855-a16e-ccd8c27eb39e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T07:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.233.43.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:05:15.000Z",
      "valid_until": "2026-04-28T07:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T06:10:50.764Z",
      "x_nadsec_last_seen": "2026-03-27T06:20:04.711Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57587"
      ],
      "x_nadsec_orgs": [
        "integrated Communication Networks LLC"
      ]
    },
    {
      "created": "2026-03-27T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d31f1b3f-9489-4dc2-a5a0-f4bb2e28fa55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.224.210.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:05:03.000Z",
      "valid_until": "2026-04-28T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T07:56:10.400Z",
      "x_nadsec_last_seen": "2026-03-27T07:58:15.122Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-27T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--4bbe1f8f-e066-4c59-9d01-447e001d14fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.63.203.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:05:03.000Z",
      "valid_until": "2026-04-28T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T07:08:50.301Z",
      "x_nadsec_last_seen": "2026-03-27T07:08:50.652Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-27T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--36d64297-2bc6-478a-ae34-b56629ae488c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:05:03.000Z",
      "valid_until": "2026-04-28T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T07:42:41.138Z",
      "x_nadsec_last_seen": "2026-03-27T07:42:41.138Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-27T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--8945da1e-ec06-492d-891c-0caf72c5e4e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.160.164.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T09:05:03.000Z",
      "valid_until": "2026-04-28T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T08:37:00.183Z",
      "x_nadsec_last_seen": "2026-03-27T08:37:00.342Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-27T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--ae8f8890-dd62-4e35-b954-ffab9c7631a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.5.146.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T09:05:03.000Z",
      "valid_until": "2026-04-28T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T08:51:59.539Z",
      "x_nadsec_last_seen": "2026-03-27T08:54:05.416Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-27T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--1d232ca8-16da-42ef-a66d-da6f38e7b655",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.41.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T09:05:03.000Z",
      "valid_until": "2026-04-28T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T08:39:04.191Z",
      "x_nadsec_last_seen": "2026-03-27T08:39:04.987Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-27T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=AM; asn=197834; asn_org=Ucom CJSC",
      "id": "indicator--2c9dde4a-5ba1-4b84-bae7-3a5d0d44e170",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.32.193.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T09:05:03.000Z",
      "valid_until": "2026-04-28T09:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-27T08:44:08.327Z",
      "x_nadsec_last_seen": "2026-03-30T20:04:02.572Z",
      "x_nadsec_ports": [
        "21",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "197834"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-03-27T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=ID; asn=4800; asn_org=PT Aplikanusa Lintasarta",
      "id": "indicator--a4d7eb29-14ea-4a84-b059-e52785d0575b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.23.54.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T09:05:03.000Z",
      "valid_until": "2026-04-28T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T09:02:12.638Z",
      "x_nadsec_last_seen": "2026-03-27T09:02:13.087Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4800"
      ],
      "x_nadsec_orgs": [
        "PT Aplikanusa Lintasarta"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-27T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--4c312572-2a16-405d-af3b-35b6b6813037",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.119.43.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T09:05:03.000Z",
      "valid_until": "2026-04-28T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-25T12:21:32.683Z",
      "x_nadsec_last_seen": "2026-03-27T08:10:27.240Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-27T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=11172; asn_org=Alestra, S. de R.L. de C.V.",
      "id": "indicator--5831a180-2afa-4668-a6fa-5705fc2440d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.151.224.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T09:05:03.000Z",
      "valid_until": "2026-04-28T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T08:22:12.768Z",
      "x_nadsec_last_seen": "2026-03-27T08:22:12.830Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "11172"
      ],
      "x_nadsec_orgs": [
        "Alestra, S. de R.L. de C.V."
      ]
    },
    {
      "created": "2026-03-27T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=9931; asn_org=National Telecom Public Company Limited",
      "id": "indicator--eb0dc6be-ddcf-4c1f-97f3-132846a95056",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.19.208.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T09:05:03.000Z",
      "valid_until": "2026-04-28T09:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-27T08:11:12.077Z",
      "x_nadsec_last_seen": "2026-03-27T08:11:45.243Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "9931"
      ],
      "x_nadsec_orgs": [
        "National Telecom Public Company Limited"
      ]
    },
    {
      "created": "2026-03-27T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--833c2cfb-d125-4cc0-b939-49c78df478bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T09:05:03.000Z",
      "valid_until": "2026-04-28T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-25T05:40:02.302Z",
      "x_nadsec_last_seen": "2026-03-27T08:56:59.438Z",
      "x_nadsec_ports": [
        "21",
        "27017"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-27T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45916; asn_org=Gujarat Telelink Pvt Ltd",
      "id": "indicator--33bd6af4-924c-4ca1-9916-f921bd2759d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.251.19.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T10:05:04.000Z",
      "valid_until": "2026-04-28T10:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T09:34:46.604Z",
      "x_nadsec_last_seen": "2026-03-27T09:36:52.066Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45916"
      ],
      "x_nadsec_orgs": [
        "Gujarat Telelink Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-27T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--129cf914-e1b3-4a25-ac48-8feefeae8f81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.191.164.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T10:05:04.000Z",
      "valid_until": "2026-04-28T10:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T09:22:35.421Z",
      "x_nadsec_last_seen": "2026-03-27T09:24:40.357Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-27T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--eb7275d4-2761-46df-9543-97ade062d365",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.207.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T10:05:04.000Z",
      "valid_until": "2026-04-28T10:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T09:38:33.160Z",
      "x_nadsec_last_seen": "2026-03-27T09:38:33.160Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-27T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--897fe569-f9d1-400b-b0ae-2e35791bf228",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T10:05:04.000Z",
      "valid_until": "2026-04-28T10:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T09:59:32.893Z",
      "x_nadsec_last_seen": "2026-03-27T09:59:32.893Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-27T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--2e378204-6fde-4271-b5ef-51d3d33242ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.206.74.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T10:05:04.000Z",
      "valid_until": "2026-04-28T10:05:02.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-27T09:05:11.771Z",
      "x_nadsec_last_seen": "2026-03-27T09:09:24.494Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-27T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--31a0ab3e-13ab-4450-860e-4d403ca48a8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.70.153.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T10:05:04.000Z",
      "valid_until": "2026-04-28T10:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T09:38:54.037Z",
      "x_nadsec_last_seen": "2026-03-27T09:40:59.376Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-27T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--7364d9ce-f4ef-4b8a-b570-6b01fe682cc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.92.51.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T10:05:04.000Z",
      "valid_until": "2026-04-28T10:05:02.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-27T09:35:21.927Z",
      "x_nadsec_last_seen": "2026-03-31T13:50:22.883Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-27T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=8595; asn_org=OOO WestCall Ltd.",
      "id": "indicator--1db4f2c7-16db-4ba1-bc7e-2011c1f4f2b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.74.129.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:05:02.000Z",
      "valid_until": "2026-04-28T11:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-27T10:26:36.426Z",
      "x_nadsec_last_seen": "2026-03-27T10:27:43.984Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8595"
      ],
      "x_nadsec_orgs": [
        "OOO WestCall Ltd."
      ]
    },
    {
      "created": "2026-03-27T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited",
      "id": "indicator--a94432fe-add7-4b52-9c9e-e8c8fe447d78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.211.113.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:05:02.000Z",
      "valid_until": "2026-04-28T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T10:08:06.101Z",
      "x_nadsec_last_seen": "2026-03-27T10:16:08.560Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "24547"
      ],
      "x_nadsec_orgs": [
        "Hebei Mobile Communication Company Limited"
      ]
    },
    {
      "created": "2026-03-27T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--fcd39a87-d1e2-4924-bfd9-05ae1fcf616d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.253.14.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:05:02.000Z",
      "valid_until": "2026-04-28T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T11:01:16.630Z",
      "x_nadsec_last_seen": "2026-03-27T11:03:20.981Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-03-27T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=50852; asn_org=INTERRA Ltd.",
      "id": "indicator--378434d0-c1cd-4d24-8f21-fde2dcdbf805",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.247.23.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:05:02.000Z",
      "valid_until": "2026-04-28T11:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-27T10:08:16.799Z",
      "x_nadsec_last_seen": "2026-03-27T10:09:32.937Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50852"
      ],
      "x_nadsec_orgs": [
        "INTERRA Ltd."
      ]
    },
    {
      "created": "2026-03-27T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--5323ca11-2fe6-4e7a-adb4-7524e057d3d0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.210.54.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:05:02.000Z",
      "valid_until": "2026-04-28T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T10:22:29.089Z",
      "x_nadsec_last_seen": "2026-03-27T10:24:36.568Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-27T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--fc2f47ea-db0e-4f12-8882-62aaba300053",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:05:02.000Z",
      "valid_until": "2026-04-28T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T10:25:57.667Z",
      "x_nadsec_last_seen": "2026-03-27T10:25:57.667Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-27T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--227b22b5-9221-4cd5-8720-2577f62696b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.64.214.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:05:02.000Z",
      "valid_until": "2026-04-28T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T10:26:41.742Z",
      "x_nadsec_last_seen": "2026-03-27T10:28:46.088Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-27T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TN; asn=37705; asn_org=TOPNET",
      "id": "indicator--afbc3863-70be-47b2-8e93-178f5a0a970a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.230.86.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:05:02.000Z",
      "valid_until": "2026-04-28T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T10:35:36.616Z",
      "x_nadsec_last_seen": "2026-03-27T10:37:42.802Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "37705"
      ],
      "x_nadsec_orgs": [
        "TOPNET"
      ]
    },
    {
      "created": "2026-03-27T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--3eed06f3-2fa4-41a5-89b3-fb65ed50f475",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.96.154.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:05:03.000Z",
      "valid_until": "2026-04-28T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T12:23:54.004Z",
      "x_nadsec_last_seen": "2026-03-27T12:30:20.013Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-27T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7d377912-d211-4ed5-991e-eb1270b01c8a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.7.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:05:03.000Z",
      "valid_until": "2026-04-28T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T12:19:05.969Z",
      "x_nadsec_last_seen": "2026-03-27T12:19:05.969Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-27T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=SC; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--8008d310-191d-4ad6-ac1d-9623bd0fa539",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:05:03.000Z",
      "valid_until": "2026-04-28T13:05:01.000Z",
      "x_nadsec_event_count": 33,
      "x_nadsec_first_seen": "2026-03-27T11:41:01.204Z",
      "x_nadsec_last_seen": "2026-03-29T07:26:12.427Z",
      "x_nadsec_ports": [
        "81",
        "1433",
        "135",
        "1723",
        "1883",
        "27017",
        "21",
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "httpd",
        "mssqld",
        "epmapper",
        "pptpd",
        "mongod",
        "mqttd",
        "ftpd",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-03-27T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e4dc064e-0c84-4744-9fb9-98914006340d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.208.49.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:05:03.000Z",
      "valid_until": "2026-04-28T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T13:04:47.526Z",
      "x_nadsec_last_seen": "2026-03-27T13:04:47.526Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-27T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--33a262c0-73c6-4d4d-8fca-0c8a15f1d822",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.214.247.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:05:03.000Z",
      "valid_until": "2026-04-28T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T12:33:58.841Z",
      "x_nadsec_last_seen": "2026-03-27T12:35:40.799Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-03-27T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CL; asn=23140; asn_org=Universidad de Chile",
      "id": "indicator--60a96be1-8bc3-49ec-9e30-8241f7247dfa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.89.69.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:05:03.000Z",
      "valid_until": "2026-04-28T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T12:01:42.812Z",
      "x_nadsec_last_seen": "2026-03-27T12:08:41.085Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "23140"
      ],
      "x_nadsec_orgs": [
        "Universidad de Chile"
      ]
    },
    {
      "created": "2026-03-27T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=47; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--66479083-91c5-4452-9f17-67ffbd000f45",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '221.120.201.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:05:03.000Z",
      "valid_until": "2026-04-28T13:05:01.000Z",
      "x_nadsec_event_count": 47,
      "x_nadsec_first_seen": "2026-03-27T12:43:38.912Z",
      "x_nadsec_last_seen": "2026-03-27T12:46:52.986Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-27T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--4a16580f-1cd8-4b29-ac2c-c385f827e070",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.195.138.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:05:03.000Z",
      "valid_until": "2026-04-28T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T12:18:10.280Z",
      "x_nadsec_last_seen": "2026-03-29T08:00:08.872Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-27T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--70930973-e77c-4966-9dc1-680a07104b4b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:05:03.000Z",
      "valid_until": "2026-04-28T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T12:35:51.344Z",
      "x_nadsec_last_seen": "2026-03-27T12:35:51.344Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-27T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--60bfa7e3-8ebd-4188-bc02-ae055eafee3b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:05:03.000Z",
      "valid_until": "2026-04-28T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T12:24:06.868Z",
      "x_nadsec_last_seen": "2026-03-27T12:24:06.868Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-27T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrord; ports=42; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--d76abae8-cba0-47b2-beb8-28fa18183250",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:05:03.000Z",
      "valid_until": "2026-04-28T13:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T12:17:55.896Z",
      "x_nadsec_last_seen": "2026-03-27T12:17:55.899Z",
      "x_nadsec_ports": [
        "42",
        "40129"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-27T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--9751d611-45f6-468e-b8d7-6af3b36b2484",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.89.47.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T14:05:03.000Z",
      "valid_until": "2026-04-28T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T13:16:33.845Z",
      "x_nadsec_last_seen": "2026-03-27T13:24:39.870Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-27T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--78a39a2d-903d-4db7-b557-aa56d2e3d254",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.250.158.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T14:05:03.000Z",
      "valid_until": "2026-04-28T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T13:47:25.578Z",
      "x_nadsec_last_seen": "2026-03-27T13:49:30.707Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-27T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--a8661e6f-167c-475e-9e2b-ac76b81e5b54",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.228.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T14:05:03.000Z",
      "valid_until": "2026-04-28T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T13:21:43.321Z",
      "x_nadsec_last_seen": "2026-03-27T13:21:43.595Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-27T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=18209; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--2b114142-0c42-4a9e-9cae-019580230676",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.82.119.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T14:05:03.000Z",
      "valid_until": "2026-04-28T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T13:50:21.841Z",
      "x_nadsec_last_seen": "2026-03-27T13:52:26.782Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "18209"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-27T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=28006; asn_org=CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP",
      "id": "indicator--3815644c-6f31-4907-bf58-601ce56940f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.47.80.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T14:05:03.000Z",
      "valid_until": "2026-04-28T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T13:39:59.575Z",
      "x_nadsec_last_seen": "2026-03-27T13:42:06.312Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "28006"
      ],
      "x_nadsec_orgs": [
        "CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP"
      ]
    },
    {
      "created": "2026-03-27T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5356ac4b-8208-4b40-b2a1-b031ab2066f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.252.15.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T14:05:03.000Z",
      "valid_until": "2026-04-28T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T14:00:39.136Z",
      "x_nadsec_last_seen": "2026-03-27T14:07:28.895Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-27T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--8c4cb910-9a56-4f6d-a25b-0c8cfeed0f31",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.53.175.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T14:05:03.000Z",
      "valid_until": "2026-04-28T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T13:15:07.891Z",
      "x_nadsec_last_seen": "2026-03-30T22:36:43.682Z",
      "x_nadsec_ports": [
        "21",
        "3306"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-27T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--f41364bb-ad08-4672-a3ce-db472a94b7a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T14:05:03.000Z",
      "valid_until": "2026-04-28T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T13:09:19.460Z",
      "x_nadsec_last_seen": "2026-03-27T13:09:19.460Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-27T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--dd67f146-9fab-4b29-b178-3f9d94ac550f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T14:05:03.000Z",
      "valid_until": "2026-04-28T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T13:37:31.462Z",
      "x_nadsec_last_seen": "2026-03-27T13:37:31.462Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-27T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=FR; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--1e8979c2-5808-4f18-9abc-0a89caf84de2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T14:05:03.000Z",
      "valid_until": "2026-04-28T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T13:31:01.012Z",
      "x_nadsec_last_seen": "2026-03-27T13:31:01.012Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-27T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--5b3bf0c3-91cf-4cf5-bf81-a08a11be79db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T14:05:03.000Z",
      "valid_until": "2026-04-28T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T13:20:12.234Z",
      "x_nadsec_last_seen": "2026-03-27T13:20:12.234Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-27T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3145; services=smbd; ports=445; cc=BG; asn=44309; asn_org=ET Satelit TM - Anton Simeonov",
      "id": "indicator--c794f9b1-188f-4c36-8c38-ffdddf38c9d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.201.174.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T14:05:03.000Z",
      "valid_until": "2026-04-28T14:05:01.000Z",
      "x_nadsec_event_count": 3145,
      "x_nadsec_first_seen": "2026-03-27T13:05:06.186Z",
      "x_nadsec_last_seen": "2026-03-27T13:50:31.972Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BG"
      ],
      "x_nadsec_asns": [
        "44309"
      ],
      "x_nadsec_orgs": [
        "ET Satelit TM - Anton Simeonov"
      ]
    },
    {
      "created": "2026-03-27T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--c4f260b9-2c5f-4efa-922c-7a782538c0da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.222.215.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T15:05:02.000Z",
      "valid_until": "2026-04-28T15:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T14:23:02.448Z",
      "x_nadsec_last_seen": "2026-03-27T14:25:07.343Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-27T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BO; asn=26210; asn_org=AXS Bolivia S. A.",
      "id": "indicator--99d791ca-d767-42e0-8328-310559b3f317",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.121.235.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T15:05:02.000Z",
      "valid_until": "2026-04-28T15:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T15:02:37.057Z",
      "x_nadsec_last_seen": "2026-03-27T15:04:44.044Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BO"
      ],
      "x_nadsec_asns": [
        "26210"
      ],
      "x_nadsec_orgs": [
        "AXS Bolivia S. A."
      ]
    },
    {
      "created": "2026-03-27T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ca601999-ecc5-4cbd-9d13-50aaa8665547",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.168.122.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T15:05:02.000Z",
      "valid_until": "2026-04-28T15:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T14:31:30.099Z",
      "x_nadsec_last_seen": "2026-03-27T14:31:40.414Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-27T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=39; services=smbd; ports=445; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--446ccf76-fe21-4bc8-a471-52e3c266b06d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.33.54.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T15:05:02.000Z",
      "valid_until": "2026-04-28T15:05:00.000Z",
      "x_nadsec_event_count": 39,
      "x_nadsec_first_seen": "2026-03-27T14:26:05.676Z",
      "x_nadsec_last_seen": "2026-03-27T14:26:59.909Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-27T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=15723; asn_org=azeronline Ltd Joint Enterprise",
      "id": "indicator--2a636acf-5514-4b14-9091-f83d77085cdc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.217.157.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T15:05:02.000Z",
      "valid_until": "2026-04-28T15:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T14:46:33.835Z",
      "x_nadsec_last_seen": "2026-03-27T14:48:41.656Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "15723"
      ],
      "x_nadsec_orgs": [
        "azeronline Ltd Joint Enterprise"
      ]
    },
    {
      "created": "2026-03-27T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6b84815c-28d2-41d0-b297-88812757222f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.225.120.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T15:05:02.000Z",
      "valid_until": "2026-04-28T15:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-27T14:14:38.525Z",
      "x_nadsec_last_seen": "2026-03-27T14:14:40.028Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-27T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--73aa9c21-9399-4d8e-afb4-9b4ed1c67d6c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.119.16.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T16:05:02.000Z",
      "valid_until": "2026-04-28T16:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-27T15:42:50.969Z",
      "x_nadsec_last_seen": "2026-03-27T15:42:51.672Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-27T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27967; asn_org=Gobernacion de la Provincia de Buenos Aires",
      "id": "indicator--38453f77-9097-4aad-a13f-77a21c90d2ab",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.155.12.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T16:05:02.000Z",
      "valid_until": "2026-04-28T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T15:34:18.474Z",
      "x_nadsec_last_seen": "2026-03-27T15:36:25.829Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27967"
      ],
      "x_nadsec_orgs": [
        "Gobernacion de la Provincia de Buenos Aires"
      ]
    },
    {
      "created": "2026-03-27T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--940613ac-f6b0-4b36-bdac-b73178d827ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.120.156.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T16:05:02.000Z",
      "valid_until": "2026-04-28T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T15:37:59.644Z",
      "x_nadsec_last_seen": "2026-03-27T15:37:59.644Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-27T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--2ea6b2d9-f65a-41c4-b148-588f4ce0b6a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.119.225.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T16:05:02.000Z",
      "valid_until": "2026-04-28T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T15:38:07.026Z",
      "x_nadsec_last_seen": "2026-03-27T15:38:07.026Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-27T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--0b72d7b1-d807-4668-a76a-9a33b4f0d957",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.47.43.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T16:05:02.000Z",
      "valid_until": "2026-04-28T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T15:52:25.196Z",
      "x_nadsec_last_seen": "2026-03-27T15:54:32.491Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-27T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=JM; asn=40786; asn_org=Digicel Jamaica",
      "id": "indicator--d3c53a3b-c95d-417d-820c-bc6ed85d8839",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '69.160.104.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T16:05:02.000Z",
      "valid_until": "2026-04-28T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T15:24:47.345Z",
      "x_nadsec_last_seen": "2026-03-27T15:24:47.394Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JM"
      ],
      "x_nadsec_asns": [
        "40786"
      ],
      "x_nadsec_orgs": [
        "Digicel Jamaica"
      ]
    },
    {
      "created": "2026-03-27T16:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--0566bbe9-da0a-4c85-95f8-d224f83debbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T16:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.253.7.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T16:05:02.000Z",
      "valid_until": "2026-04-28T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T15:28:03.464Z",
      "x_nadsec_last_seen": "2026-03-27T15:35:12.603Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-27T17:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--e56c6abd-bfb1-4b11-9e55-b9400fecbca0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T17:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.91.93.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T17:05:08.000Z",
      "valid_until": "2026-04-28T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T16:24:46.882Z",
      "x_nadsec_last_seen": "2026-03-27T16:24:46.882Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-27T17:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=23969; asn_org=TOT Public Company Limited",
      "id": "indicator--88cbd794-02a3-4f00-9d85-5cd2e36e2228",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T17:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.53.62.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T17:05:08.000Z",
      "valid_until": "2026-04-28T17:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-27T16:50:14.794Z",
      "x_nadsec_last_seen": "2026-03-27T16:50:27.556Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "23969"
      ],
      "x_nadsec_orgs": [
        "TOT Public Company Limited"
      ]
    },
    {
      "created": "2026-03-27T17:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=61621; asn_org=Norte.Net Telecomunicacoes Ltda; user(top)=**",
      "id": "indicator--0aa6888a-0674-4664-94a0-a3414c1d6bcc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T17:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.231.208.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T17:05:08.000Z",
      "valid_until": "2026-04-28T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T16:49:25.065Z",
      "x_nadsec_last_seen": "2026-03-27T16:49:25.065Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "61621"
      ],
      "x_nadsec_orgs": [
        "Norte.Net Telecomunicacoes Ltda"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-27T17:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TT; asn=5639; asn_org=Telecommunication Services of Trinidad and Tobago",
      "id": "indicator--1d9a5340-4b2f-47c9-8660-94021a4fe837",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T17:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.58.160.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T17:05:08.000Z",
      "valid_until": "2026-04-28T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T16:31:15.324Z",
      "x_nadsec_last_seen": "2026-03-27T16:33:21.499Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TT"
      ],
      "x_nadsec_asns": [
        "5639"
      ],
      "x_nadsec_orgs": [
        "Telecommunication Services of Trinidad and Tobago"
      ]
    },
    {
      "created": "2026-03-27T17:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e882458e-b812-4802-bd3d-f847611050c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T17:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.98.166.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T17:05:08.000Z",
      "valid_until": "2026-04-28T17:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T16:09:06.125Z",
      "x_nadsec_last_seen": "2026-03-27T16:09:06.505Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-27T17:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--355b72bf-26be-48c3-a722-5b0c0349ff89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T17:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T17:05:08.000Z",
      "valid_until": "2026-04-28T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T16:19:38.575Z",
      "x_nadsec_last_seen": "2026-03-27T16:19:38.575Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-27T17:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=28840; asn_org=Pjsc tattelecom",
      "id": "indicator--ac82624e-f0e2-4abd-8822-cfaeff7be655",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T17:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.118.177.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T17:05:08.000Z",
      "valid_until": "2026-04-28T17:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-27T16:13:52.467Z",
      "x_nadsec_last_seen": "2026-03-30T07:44:00.089Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28840"
      ],
      "x_nadsec_orgs": [
        "Pjsc tattelecom"
      ]
    },
    {
      "created": "2026-03-27T17:05:08.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=EG; asn=36992; asn_org=Etisalat Misr; user(top)=**",
      "id": "indicator--f981f679-7d7e-444f-96cb-ca2add7fed3a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T17:05:08.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.54.70.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T17:05:08.000Z",
      "valid_until": "2026-04-28T17:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T16:13:40.429Z",
      "x_nadsec_last_seen": "2026-03-31T03:22:55.684Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "36992"
      ],
      "x_nadsec_orgs": [
        "Etisalat Misr"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-27T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a31b6d67-ef2d-4fcf-8e4f-e6deb065abf7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.90.249.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T18:05:03.000Z",
      "valid_until": "2026-04-28T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T17:07:20.794Z",
      "x_nadsec_last_seen": "2026-03-27T17:07:20.794Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-27T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=QA; asn=8781; asn_org=Ooredoo Q.S.C.; user(top)=**",
      "id": "indicator--f6f6a105-2860-46d8-8c7b-c21e76afd043",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.100.163.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T18:05:03.000Z",
      "valid_until": "2026-04-28T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T17:43:23.646Z",
      "x_nadsec_last_seen": "2026-03-27T17:43:23.646Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "QA"
      ],
      "x_nadsec_asns": [
        "8781"
      ],
      "x_nadsec_orgs": [
        "Ooredoo Q.S.C."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-27T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--d1ecc734-6e5d-45c7-af21-4c9ef521712e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T18:05:03.000Z",
      "valid_until": "2026-04-28T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T17:59:36.859Z",
      "x_nadsec_last_seen": "2026-03-27T17:59:36.859Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-27T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--2654d5f2-1c5c-40e0-af47-7cba998fd0ad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T18:05:03.000Z",
      "valid_until": "2026-04-28T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T17:59:37.207Z",
      "x_nadsec_last_seen": "2026-03-27T17:59:37.207Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-27T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--a4d2fa03-2b68-4f75-bb8a-3f7640dc9373",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.174.46.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T19:05:03.000Z",
      "valid_until": "2026-04-28T19:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T18:08:39.079Z",
      "x_nadsec_last_seen": "2026-03-27T18:15:38.298Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-27T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=4755; asn_org=TATA Communications formerly VSNL is Leading ISP",
      "id": "indicator--61f99a6e-60a6-473e-9001-2794dd19d509",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.140.243.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T19:05:03.000Z",
      "valid_until": "2026-04-28T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T18:50:42.062Z",
      "x_nadsec_last_seen": "2026-03-27T18:52:48.129Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "4755"
      ],
      "x_nadsec_orgs": [
        "TATA Communications formerly VSNL is Leading ISP"
      ]
    },
    {
      "created": "2026-03-27T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=ftpd; ports=21; cc=AU; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.105.177.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T19:05:03.000Z",
      "valid_until": "2026-04-28T19:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-27T18:36:16.144Z",
      "x_nadsec_last_seen": "2026-03-27T18:36:47.980Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1723",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "pptpd",
        "smbd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-27T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=15895; asn_org=Kyivstar PJSC",
      "id": "indicator--8dc5bd1d-74a4-475b-9bb6-e4e5cd85c1c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.163.84.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T19:05:03.000Z",
      "valid_until": "2026-04-28T19:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-27T18:56:12.590Z",
      "x_nadsec_last_seen": "2026-03-27T19:03:23.070Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "15895"
      ],
      "x_nadsec_orgs": [
        "Kyivstar PJSC"
      ]
    },
    {
      "created": "2026-03-27T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a936ceca-9813-4121-ac03-af1614205c62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '129.212.190.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T20:05:03.000Z",
      "valid_until": "2026-04-28T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T19:29:11.424Z",
      "x_nadsec_last_seen": "2026-03-27T19:29:11.424Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-27T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SG; asn=26496; asn_org=GoDaddy.com, LLC",
      "id": "indicator--3b1d14de-7eec-4205-afd7-cc9120453e62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '208.109.11.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T20:05:03.000Z",
      "valid_until": "2026-04-28T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T19:15:53.912Z",
      "x_nadsec_last_seen": "2026-03-27T19:15:53.912Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "26496"
      ],
      "x_nadsec_orgs": [
        "GoDaddy.com, LLC"
      ]
    },
    {
      "created": "2026-03-27T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=UA; asn=47702; asn_org=Teleradiocompany Discovery Ltd.",
      "id": "indicator--0e9f34b2-da10-4853-abe5-b3e0b39c3829",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.109.232.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T20:05:03.000Z",
      "valid_until": "2026-04-28T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T19:20:26.573Z",
      "x_nadsec_last_seen": "2026-03-27T19:20:26.620Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "47702"
      ],
      "x_nadsec_orgs": [
        "Teleradiocompany Discovery Ltd."
      ]
    },
    {
      "created": "2026-03-27T21:05:57.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=PE; asn=12252; asn_org=America Movil Peru S.A.C.",
      "id": "indicator--1e5fb95e-a4a5-48a6-8ac0-3567964dbe77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T21:05:57.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.6.56.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T21:05:57.000Z",
      "valid_until": "2026-04-28T21:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T20:56:46.844Z",
      "x_nadsec_last_seen": "2026-03-27T20:58:56.623Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "12252"
      ],
      "x_nadsec_orgs": [
        "America Movil Peru S.A.C."
      ]
    },
    {
      "created": "2026-03-27T21:05:57.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=43023; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--d5f66a89-aae9-46c2-9ee8-b2606a72431a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T21:05:57.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.186.13.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T21:05:57.000Z",
      "valid_until": "2026-04-28T21:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T20:30:24.436Z",
      "x_nadsec_last_seen": "2026-03-27T20:30:24.441Z",
      "x_nadsec_ports": [
        "42",
        "43023"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-27T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133661; asn_org=Netplus Broadband Services Private Limited",
      "id": "indicator--00121278-9a11-4ceb-9f47-3a4470f83ae1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.178.64.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T22:05:02.000Z",
      "valid_until": "2026-04-28T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T21:55:47.741Z",
      "x_nadsec_last_seen": "2026-03-27T21:57:52.828Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133661"
      ],
      "x_nadsec_orgs": [
        "Netplus Broadband Services Private Limited"
      ]
    },
    {
      "created": "2026-03-27T22:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--54977b74-c8dd-42c9-a4a7-99200e40c324",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T22:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T22:05:02.000Z",
      "valid_until": "2026-04-28T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-27T21:57:29.025Z",
      "x_nadsec_last_seen": "2026-03-27T21:57:29.025Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-27T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--df9b3e2d-7d8b-472e-b74b-b52f674a8ee8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.227.37.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T23:05:03.000Z",
      "valid_until": "2026-04-28T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T22:38:45.093Z",
      "x_nadsec_last_seen": "2026-03-27T22:40:49.863Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-27T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PE; asn=270068; asn_org=DESARROLLO DE INFRAESTRUCTURA DE TELECOMUNICACIONES PERU S.A.C. INFRATEL",
      "id": "indicator--a869a5e0-8ee6-4e39-a1f8-6cdc2f7bc111",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-27T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.250.146.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T23:05:03.000Z",
      "valid_until": "2026-04-28T23:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-27T22:30:26.416Z",
      "x_nadsec_last_seen": "2026-03-30T15:36:16.759Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "270068"
      ],
      "x_nadsec_orgs": [
        "DESARROLLO DE INFRAESTRUCTURA DE TELECOMUNICACIONES PERU S.A.C. INFRATEL"
      ]
    },
    {
      "created": "2026-03-28T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mirrorc; ports=44151; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--ea0dc298-b1c3-48cd-8bc0-02b0f436bdf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T00:05:04.000Z",
      "valid_until": "2026-04-29T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T23:47:29.244Z",
      "x_nadsec_last_seen": "2026-03-27T23:47:29.247Z",
      "x_nadsec_ports": [
        "42",
        "44151"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-28T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--b944679a-9848-4865-9e69-504803914620",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.147.239.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T00:05:04.000Z",
      "valid_until": "2026-04-29T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-27T23:06:01.370Z",
      "x_nadsec_last_seen": "2026-03-27T23:06:01.450Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-28T00:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UZ; asn=12365; asn_org=JC LLC Sarkor-Telecom",
      "id": "indicator--6ddfe3e2-638c-436e-a070-ba31e3dee516",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T00:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.95.226.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T00:05:04.000Z",
      "valid_until": "2026-04-29T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-27T23:24:21.045Z",
      "x_nadsec_last_seen": "2026-03-27T23:26:26.448Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UZ"
      ],
      "x_nadsec_asns": [
        "12365"
      ],
      "x_nadsec_orgs": [
        "JC LLC Sarkor-Telecom"
      ]
    },
    {
      "created": "2026-03-28T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--a44ba225-3e52-4357-9d75-f5dcd6045e4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.100.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:05:03.000Z",
      "valid_until": "2026-04-29T01:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-28T00:36:30.941Z",
      "x_nadsec_last_seen": "2026-03-28T01:37:20.635Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-28T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fc9fae7c-bfdd-4839-988a-34e1b546c5c0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.89.124.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:05:03.000Z",
      "valid_until": "2026-04-29T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T00:21:18.863Z",
      "x_nadsec_last_seen": "2026-03-28T00:21:29.041Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-28T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IN; asn=135752; asn_org=Evoke Digital Solutions",
      "id": "indicator--1937c082-f160-4301-9200-7cd564736055",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.73.189.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:05:03.000Z",
      "valid_until": "2026-04-29T03:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T02:47:46.276Z",
      "x_nadsec_last_seen": "2026-03-28T02:47:46.354Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135752"
      ],
      "x_nadsec_orgs": [
        "Evoke Digital Solutions"
      ]
    },
    {
      "created": "2026-03-28T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2176; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--5cf04554-302d-4154-97a4-863cda5f28c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.199.148.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:05:03.000Z",
      "valid_until": "2026-04-29T03:05:01.000Z",
      "x_nadsec_event_count": 3152,
      "x_nadsec_first_seen": "2026-03-28T01:24:24.962Z",
      "x_nadsec_last_seen": "2026-03-28T02:41:17.910Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-28T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=31224; asn_org=PJSC MegaFon",
      "id": "indicator--d1f7f89b-6e3f-445b-8839-0b4d3db62f75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.178.93.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:05:03.000Z",
      "valid_until": "2026-04-29T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T02:04:50.648Z",
      "x_nadsec_last_seen": "2026-03-28T02:06:58.880Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31224"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-28T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--03f75d29-f9bf-47f9-80ce-5e973df350f3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.238.89.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:05:03.000Z",
      "valid_until": "2026-04-29T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T02:37:48.154Z",
      "x_nadsec_last_seen": "2026-03-28T02:37:52.985Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-28T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--7d68caaa-c6df-4beb-be83-178bd38832fa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:05:03.000Z",
      "valid_until": "2026-04-29T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T02:36:53.243Z",
      "x_nadsec_last_seen": "2026-03-28T02:36:53.243Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-28T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bb1a1ebd-7b65-4b82-a44b-83d0452499a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:05:03.000Z",
      "valid_until": "2026-04-29T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T02:06:38.395Z",
      "x_nadsec_last_seen": "2026-03-28T02:06:38.395Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-28T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--54f6595f-b10c-4c98-95fb-b9479eb14bf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.110.145.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:05:03.000Z",
      "valid_until": "2026-04-29T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T02:04:11.763Z",
      "x_nadsec_last_seen": "2026-03-28T02:06:18.031Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "5384"
      ],
      "x_nadsec_orgs": [
        "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
      ]
    },
    {
      "created": "2026-03-28T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2728; services=smbd; ports=445; cc=KW; asn=196921; asn_org=Wireless Mobile Data Company KSCC",
      "id": "indicator--e8cfb470-8823-43c0-bc89-cb068afa9063",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.187.172.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:05:03.000Z",
      "valid_until": "2026-04-29T03:05:01.000Z",
      "x_nadsec_event_count": 3147,
      "x_nadsec_first_seen": "2026-03-25T19:35:35.360Z",
      "x_nadsec_last_seen": "2026-03-28T03:12:31.528Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KW"
      ],
      "x_nadsec_asns": [
        "196921"
      ],
      "x_nadsec_orgs": [
        "Wireless Mobile Data Company KSCC"
      ]
    },
    {
      "created": "2026-03-28T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--dfb7b648-32bd-4dfa-80cf-ca98480f5822",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '100.28.191.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T04:05:02.000Z",
      "valid_until": "2026-04-29T04:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T03:35:28.930Z",
      "x_nadsec_last_seen": "2026-03-28T03:35:28.930Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-28T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--ab432192-90f4-4470-98a3-be601834c84b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.7.157.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T04:05:02.000Z",
      "valid_until": "2026-04-29T04:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-28T03:55:42.133Z",
      "x_nadsec_last_seen": "2026-03-28T04:00:10.854Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-28T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d1a10d69-ac42-4e8e-a4c1-13442e067802",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.33.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T04:05:02.000Z",
      "valid_until": "2026-04-29T04:05:00.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-28T03:38:02.964Z",
      "x_nadsec_last_seen": "2026-03-31T00:59:47.045Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-28T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9f598fb9-5522-4f2d-a914-a95abd6f04d3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.49.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T04:05:02.000Z",
      "valid_until": "2026-04-29T04:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T03:13:36.077Z",
      "x_nadsec_last_seen": "2026-03-28T03:13:36.077Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-28T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--99d8773e-c1ef-49ae-9f17-992a6e20bb06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.101.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T04:05:02.000Z",
      "valid_until": "2026-04-29T04:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T03:12:14.449Z",
      "x_nadsec_last_seen": "2026-03-28T03:12:14.449Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-28T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=AZ; asn=207251; asn_org=CASPEL LLC; user(top)=**",
      "id": "indicator--61a40e57-20cd-46a5-b550-c45c66a13fe4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.132.42.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T04:05:02.000Z",
      "valid_until": "2026-04-29T04:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T14:46:04.741Z",
      "x_nadsec_last_seen": "2026-03-28T03:07:10.656Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "207251"
      ],
      "x_nadsec_orgs": [
        "CASPEL LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-28T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b0fed5ea-9d3e-4d16-a32f-b1faabcb592c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.14.90.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T05:05:03.000Z",
      "valid_until": "2026-04-29T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T04:16:30.124Z",
      "x_nadsec_last_seen": "2026-03-28T04:16:40.429Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-28T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--b9e6416b-7984-4389-baca-d0b564e5bdd5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.85.110.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T05:05:03.000Z",
      "valid_until": "2026-04-29T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T04:40:44.192Z",
      "x_nadsec_last_seen": "2026-03-28T04:41:08.628Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-28T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC; user(top)=**",
      "id": "indicator--7ff3f7ff-b831-429e-be90-1f08cd5fde2b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.171.103.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T05:05:03.000Z",
      "valid_until": "2026-04-29T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T04:11:25.668Z",
      "x_nadsec_last_seen": "2026-03-28T04:11:25.668Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-28T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--33f8c1e6-ce59-4dc5-8bf9-ca5d4eec9548",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.136.178.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T05:05:03.000Z",
      "valid_until": "2026-04-29T05:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-28T04:51:51.284Z",
      "x_nadsec_last_seen": "2026-03-28T05:18:17.198Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-03-28T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--618a0144-d5d5-4538-b42b-cf3b8353a16d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.156.30.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T06:05:03.000Z",
      "valid_until": "2026-04-29T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-28T05:51:10.299Z",
      "x_nadsec_last_seen": "2026-03-28T05:58:02.558Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-28T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--103d22d4-78c0-418c-9093-e427d8bbf901",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.165.0.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T06:05:03.000Z",
      "valid_until": "2026-04-29T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-28T05:15:33.731Z",
      "x_nadsec_last_seen": "2026-03-28T05:22:50.049Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-28T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=LA; asn=131267; asn_org=Star Telecom",
      "id": "indicator--f79cd7a2-2cda-4252-b476-a733bc6a8451",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.182.99.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T06:05:03.000Z",
      "valid_until": "2026-04-29T06:05:01.000Z",
      "x_nadsec_event_count": 3154,
      "x_nadsec_first_seen": "2026-03-28T05:35:25.815Z",
      "x_nadsec_last_seen": "2026-03-28T07:00:03.917Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LA"
      ],
      "x_nadsec_asns": [
        "131267"
      ],
      "x_nadsec_orgs": [
        "Star Telecom"
      ]
    },
    {
      "created": "2026-03-28T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--6075b5ca-762d-40ac-b862-3045d87e08c1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T06:05:03.000Z",
      "valid_until": "2026-04-29T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T05:37:38.236Z",
      "x_nadsec_last_seen": "2026-03-28T05:37:38.236Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-28T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--fa3a2920-2d85-4fd0-8788-03eb3602cc0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.37.184.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T06:05:03.000Z",
      "valid_until": "2026-04-29T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T05:51:03.554Z",
      "x_nadsec_last_seen": "2026-03-28T05:53:09.889Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-28T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AE; asn=15802; asn_org=Emirates Integrated Telecommunications Company PJSC",
      "id": "indicator--d230005a-d76e-4cc8-8f93-74081079eddf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.74.78.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T06:05:03.000Z",
      "valid_until": "2026-04-29T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T05:48:15.681Z",
      "x_nadsec_last_seen": "2026-03-28T05:50:22.695Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AE"
      ],
      "x_nadsec_asns": [
        "15802"
      ],
      "x_nadsec_orgs": [
        "Emirates Integrated Telecommunications Company PJSC"
      ]
    },
    {
      "created": "2026-03-28T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=49531; asn_org=NetCom-R LLC",
      "id": "indicator--1d6f6776-7b87-4b90-9f56-977ff79332e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.159.78.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T06:05:03.000Z",
      "valid_until": "2026-04-29T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T05:56:29.950Z",
      "x_nadsec_last_seen": "2026-03-28T05:58:36.074Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "49531"
      ],
      "x_nadsec_orgs": [
        "NetCom-R LLC"
      ]
    },
    {
      "created": "2026-03-28T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8e40d7b2-206c-46e0-9c18-6cc2c52475ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.86.104.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T07:05:03.000Z",
      "valid_until": "2026-04-29T07:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T06:29:29.746Z",
      "x_nadsec_last_seen": "2026-03-28T06:29:39.919Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-28T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--7508e8f5-990e-4868-ab18-07096e99fee3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T07:05:03.000Z",
      "valid_until": "2026-04-29T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T06:38:16.088Z",
      "x_nadsec_last_seen": "2026-03-28T06:38:16.088Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-28T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BR; asn=4230; asn_org=CLARO S.A.",
      "id": "indicator--0adc0819-8280-4c42-bb3c-f09e817d824d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.52.139.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T07:05:03.000Z",
      "valid_until": "2026-04-29T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T06:32:53.932Z",
      "x_nadsec_last_seen": "2026-03-28T06:32:53.932Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "4230"
      ],
      "x_nadsec_orgs": [
        "CLARO S.A."
      ]
    },
    {
      "created": "2026-03-28T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=265792; asn_org=Usina Popular Cooperativa",
      "id": "indicator--d5c4705c-c0c6-47b3-9669-6290bf4888e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.141.180.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T07:05:03.000Z",
      "valid_until": "2026-04-29T07:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T06:10:59.939Z",
      "x_nadsec_last_seen": "2026-03-28T06:13:07.640Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "265792"
      ],
      "x_nadsec_orgs": [
        "Usina Popular Cooperativa"
      ]
    },
    {
      "created": "2026-03-28T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--ffbc4f27-88ca-4ada-a070-69105441b2af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.39.159.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T07:05:03.000Z",
      "valid_until": "2026-04-29T07:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T06:29:12.530Z",
      "x_nadsec_last_seen": "2026-03-28T06:31:19.742Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-28T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=httpd; ports=81; cc=DE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--838ab9d6-891a-4006-98e3-128cd8eededb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.193.59.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T08:05:03.000Z",
      "valid_until": "2026-04-29T08:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-28T07:48:31.013Z",
      "x_nadsec_last_seen": "2026-03-28T07:49:16.807Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-28T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--80f736a1-6157-4602-8750-678449006c6d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.194.250.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T08:05:03.000Z",
      "valid_until": "2026-04-29T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T07:49:58.039Z",
      "x_nadsec_last_seen": "2026-03-28T07:49:58.039Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-28T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=VN; asn=38731; asn_org=CHT Compamy Ltd; user(top)=**",
      "id": "indicator--75dff00f-72c4-44d7-9887-7228de34b441",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.212.198.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T08:05:03.000Z",
      "valid_until": "2026-04-29T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T07:21:44.201Z",
      "x_nadsec_last_seen": "2026-03-28T07:21:45.103Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "38731"
      ],
      "x_nadsec_orgs": [
        "CHT Compamy Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-28T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--1badad10-6d46-43b9-8cc9-c6054907ff25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T08:05:03.000Z",
      "valid_until": "2026-04-29T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T07:41:53.694Z",
      "x_nadsec_last_seen": "2026-03-28T07:41:53.694Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-28T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--02cb716d-9f53-4192-89f2-d1dc6eef00f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T08:05:03.000Z",
      "valid_until": "2026-04-29T08:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-28T08:01:28.763Z",
      "x_nadsec_last_seen": "2026-03-28T08:01:29.559Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-28T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--aa6ad04f-efae-4382-ba7b-4da0d44646a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.14.248.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T08:05:03.000Z",
      "valid_until": "2026-04-29T08:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-28T07:15:34.217Z",
      "x_nadsec_last_seen": "2026-03-28T07:58:24.016Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-03-28T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--ddd49b1a-926d-4d41-a3da-da26b6e976c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.102.189.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T08:05:03.000Z",
      "valid_until": "2026-04-29T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T07:31:35.178Z",
      "x_nadsec_last_seen": "2026-03-28T07:33:41.979Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-28T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=149234; asn_org=Dps Networks Private Limited",
      "id": "indicator--740a5e4d-07af-407f-bbd6-2be8d0a5d756",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.181.166.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:05:03.000Z",
      "valid_until": "2026-04-29T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T08:20:41.346Z",
      "x_nadsec_last_seen": "2026-03-28T08:22:47.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "149234"
      ],
      "x_nadsec_orgs": [
        "Dps Networks Private Limited"
      ]
    },
    {
      "created": "2026-03-28T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--0e62dd35-61a9-4824-ba8c-5b1c756a125f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.5.147.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:05:03.000Z",
      "valid_until": "2026-04-29T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T08:13:47.437Z",
      "x_nadsec_last_seen": "2026-03-28T08:13:52.185Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-28T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--38971095-3b51-4c99-bf05-5036f1c7160e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:05:03.000Z",
      "valid_until": "2026-04-29T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T08:32:13.978Z",
      "x_nadsec_last_seen": "2026-03-28T08:32:13.978Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-28T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=60042; asn_org=OnTelecom LLC",
      "id": "indicator--04bd3901-330e-4693-8ffe-beab8a76c1d4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.118.217.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:05:03.000Z",
      "valid_until": "2026-04-29T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T08:06:38.905Z",
      "x_nadsec_last_seen": "2026-03-28T08:08:45.406Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "60042"
      ],
      "x_nadsec_orgs": [
        "OnTelecom LLC"
      ]
    },
    {
      "created": "2026-03-28T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=3216; asn_org=PVimpelCom",
      "id": "indicator--da42b936-880c-4b46-a4b3-0979246c3d22",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.67.62.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:05:03.000Z",
      "valid_until": "2026-04-29T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T08:59:51.273Z",
      "x_nadsec_last_seen": "2026-03-28T09:01:58.018Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "3216"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-03-28T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--726ef3c2-49c3-48e3-b2cc-c7d0dbfbbbcd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.168.0.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:05:03.000Z",
      "valid_until": "2026-04-29T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T08:21:58.987Z",
      "x_nadsec_last_seen": "2026-03-28T08:21:58.987Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-28T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--06889dc6-e5ff-4bef-ad1a-0cd122891109",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.98.128.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:05:03.000Z",
      "valid_until": "2026-04-29T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T08:37:33.557Z",
      "x_nadsec_last_seen": "2026-03-28T08:37:33.909Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-28T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--3cdab93a-a535-49f6-8e33-e6d104324680",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.174.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:05:03.000Z",
      "valid_until": "2026-04-29T09:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T08:29:19.868Z",
      "x_nadsec_last_seen": "2026-03-28T08:29:20.505Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-28T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=pptpd; ports=1723; cc=FR; asn=51167; asn_org=Contabo GmbH",
      "id": "indicator--91dd2e82-abc0-4bcc-a2bf-1cc7c324695b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.8.132.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:05:03.000Z",
      "valid_until": "2026-04-29T09:05:01.000Z",
      "x_nadsec_event_count": 18,
      "x_nadsec_first_seen": "2026-03-28T09:00:24.264Z",
      "x_nadsec_last_seen": "2026-03-28T09:12:15.615Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "51167"
      ],
      "x_nadsec_orgs": [
        "Contabo GmbH"
      ]
    },
    {
      "created": "2026-03-28T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--94a7dd90-10e5-49d3-ae27-9773d94376f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:05:03.000Z",
      "valid_until": "2026-04-29T09:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T08:40:28.354Z",
      "x_nadsec_last_seen": "2026-03-28T08:40:28.354Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-28T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RS; asn=9125; asn_org=Drustvo za telekomunikacije Orion telekom doo Beograd-Zemun",
      "id": "indicator--84d28b5a-f1f2-4f20-8b9b-ccccbc051048",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.105.2.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:05:03.000Z",
      "valid_until": "2026-04-29T09:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T08:41:35.339Z",
      "x_nadsec_last_seen": "2026-03-28T08:43:41.923Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RS"
      ],
      "x_nadsec_asns": [
        "9125"
      ],
      "x_nadsec_orgs": [
        "Drustvo za telekomunikacije Orion telekom doo Beograd-Zemun"
      ]
    },
    {
      "created": "2026-03-28T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8402; asn_org=PVimpelCom",
      "id": "indicator--ac019416-600f-4085-8baf-baa45c2f782c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.26.71.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T09:05:03.000Z",
      "valid_until": "2026-04-29T09:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-28T08:47:40.148Z",
      "x_nadsec_last_seen": "2026-03-28T09:19:32.086Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8402"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-03-28T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=138754; asn_org=Kerala Vision Broad Band Private Limited",
      "id": "indicator--faacee42-a7ae-446c-b773-e3e44df021ca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.149.159.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:05:02.000Z",
      "valid_until": "2026-04-29T10:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-28T09:52:53.051Z",
      "x_nadsec_last_seen": "2026-03-28T09:59:27.389Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "138754"
      ],
      "x_nadsec_orgs": [
        "Kerala Vision Broad Band Private Limited"
      ]
    },
    {
      "created": "2026-03-28T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--2fabc3f9-1f3d-463f-8de1-16d6251c6f1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.222.224.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:05:02.000Z",
      "valid_until": "2026-04-29T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T09:58:02.661Z",
      "x_nadsec_last_seen": "2026-03-28T10:00:07.771Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-28T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--a68e3c4e-e20b-4fd1-9fc8-b4e4797c6611",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.51.88.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:05:02.000Z",
      "valid_until": "2026-04-29T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T09:43:15.222Z",
      "x_nadsec_last_seen": "2026-03-28T09:45:20.827Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-03-28T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--5fc1307a-fec1-49e9-b6d9-6accec05049c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.135.168.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:05:02.000Z",
      "valid_until": "2026-04-29T10:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-28T09:33:23.544Z",
      "x_nadsec_last_seen": "2026-03-28T09:47:56.821Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-03-28T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--92c1ebb7-43b7-42de-89ca-c917542dfc9d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.55.59.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:05:02.000Z",
      "valid_until": "2026-04-29T10:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T09:55:41.637Z",
      "x_nadsec_last_seen": "2026-03-28T09:55:41.684Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-03-28T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--101fb7d8-7726-41b3-b694-45f6d7039b2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:05:02.000Z",
      "valid_until": "2026-04-29T10:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T09:08:06.236Z",
      "x_nadsec_last_seen": "2026-03-30T18:22:36.076Z",
      "x_nadsec_ports": [
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-28T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e4c9187a-d97f-4a16-a3c7-43142d47c545",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:05:02.000Z",
      "valid_until": "2026-04-29T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T09:50:06.354Z",
      "x_nadsec_last_seen": "2026-03-28T09:50:06.354Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-28T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mongod; ports=27017; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--df776ede-e287-4408-ad8c-6a064c63244e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:05:02.000Z",
      "valid_until": "2026-04-29T10:05:00.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-28T09:23:22.872Z",
      "x_nadsec_last_seen": "2026-03-28T09:23:42.808Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-03-28T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d0e2f365-cef7-4804-b01f-c0892d684a06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:05:02.000Z",
      "valid_until": "2026-04-29T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T09:31:00.517Z",
      "x_nadsec_last_seen": "2026-03-28T09:31:00.517Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-28T10:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--a27d0e8f-bb93-4c4a-b43e-d8763ea58027",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T10:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.39.97.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:05:02.000Z",
      "valid_until": "2026-04-29T10:05:00.000Z",
      "x_nadsec_event_count": 12,
      "x_nadsec_first_seen": "2026-03-05T23:38:29.364Z",
      "x_nadsec_last_seen": "2026-03-28T09:26:10.143Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-03-28T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ea0a4f7e-90ea-4bfd-a802-0549eb2b040d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.163.194.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T11:05:02.000Z",
      "valid_until": "2026-04-29T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T11:04:11.392Z",
      "x_nadsec_last_seen": "2026-03-28T11:06:16.166Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-28T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45820; asn_org=Tata Teleservices ISP AS",
      "id": "indicator--06af4496-5008-4ecc-92eb-47a15f5c7740",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.194.22.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T11:05:02.000Z",
      "valid_until": "2026-04-29T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T10:39:26.353Z",
      "x_nadsec_last_seen": "2026-03-28T10:41:31.912Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45820"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices ISP AS"
      ]
    },
    {
      "created": "2026-03-28T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--2469d6c7-8e68-4c87-a330-9fe0698d96ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.49.5.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T11:05:02.000Z",
      "valid_until": "2026-04-29T11:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T10:50:57.763Z",
      "x_nadsec_last_seen": "2026-03-28T10:50:57.932Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-28T11:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--3561d52e-fe4a-46d6-9806-3bb06f997135",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T11:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.79.7.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T11:05:02.000Z",
      "valid_until": "2026-04-29T11:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T10:41:06.919Z",
      "x_nadsec_last_seen": "2026-03-28T10:42:38.050Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-03-28T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--c65c31e2-a033-4b29-96f0-2d67a4304158",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.88.108.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T12:05:02.000Z",
      "valid_until": "2026-04-29T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T12:01:02.464Z",
      "x_nadsec_last_seen": "2026-03-28T12:03:10.005Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-28T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--993fb19b-b458-4071-a280-efe98b61b964",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.235.246.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T12:05:02.000Z",
      "valid_until": "2026-04-29T12:05:00.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-03-28T11:15:46.777Z",
      "x_nadsec_last_seen": "2026-03-28T11:20:03.988Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-28T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=16010; asn_org=Magticom Ltd.",
      "id": "indicator--4bde9cb0-44dc-495a-85c3-d9fcd913b946",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.115.6.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T12:05:02.000Z",
      "valid_until": "2026-04-29T12:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T11:29:32.534Z",
      "x_nadsec_last_seen": "2026-03-28T11:31:45.495Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "16010"
      ],
      "x_nadsec_orgs": [
        "Magticom Ltd."
      ]
    },
    {
      "created": "2026-03-28T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--9ba9737f-816b-4dbd-84ad-b88e03a357b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T12:05:02.000Z",
      "valid_until": "2026-04-29T12:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T11:15:43.085Z",
      "x_nadsec_last_seen": "2026-03-28T11:15:43.085Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-28T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--e8f818d4-d7ed-4fd5-b703-5e32971da862",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.48.38.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T12:05:02.000Z",
      "valid_until": "2026-04-29T12:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T11:25:47.325Z",
      "x_nadsec_last_seen": "2026-03-28T11:25:47.325Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-28T12:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PS; asn=12975; asn_org=Palestine Telecommunications Company (PALTEL)",
      "id": "indicator--e3b5d309-c4a8-4333-90a8-53fb1ec1baf3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T12:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.205.80.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T12:05:02.000Z",
      "valid_until": "2026-04-29T12:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T11:08:59.776Z",
      "x_nadsec_last_seen": "2026-03-28T11:09:00.174Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PS"
      ],
      "x_nadsec_asns": [
        "12975"
      ],
      "x_nadsec_orgs": [
        "Palestine Telecommunications Company (PALTEL)"
      ]
    },
    {
      "created": "2026-03-28T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5ae53706-44dc-49d6-9e35-548981f5bfad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.160.100.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:05:03.000Z",
      "valid_until": "2026-04-29T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T12:08:03.700Z",
      "x_nadsec_last_seen": "2026-03-28T12:10:08.494Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-28T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17762; asn_org=Tata Teleservices Maharashtra Ltd",
      "id": "indicator--fc33409c-63fb-4019-8000-c30cc5e8aece",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.143.208.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:05:03.000Z",
      "valid_until": "2026-04-29T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T12:05:46.807Z",
      "x_nadsec_last_seen": "2026-03-28T12:07:52.592Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17762"
      ],
      "x_nadsec_orgs": [
        "Tata Teleservices Maharashtra Ltd"
      ]
    },
    {
      "created": "2026-03-28T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=MY; asn=9534; asn_org=Binariang Berhad; user(top)=***; pass(top)=w*****s",
      "id": "indicator--a576b5d6-435e-40ff-b182-2296995bfb95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.122.119.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:05:03.000Z",
      "valid_until": "2026-04-29T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T12:22:58.283Z",
      "x_nadsec_last_seen": "2026-03-28T12:22:58.283Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "9534"
      ],
      "x_nadsec_orgs": [
        "Binariang Berhad"
      ],
      "x_nadsec_usernames_attempted": [
        "***"
      ],
      "x_nadsec_passwords_attempted": [
        "w*****s"
      ]
    },
    {
      "created": "2026-03-28T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--5e8460a3-c77a-4390-a3b7-b02d5b8846a7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.213.154.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:05:03.000Z",
      "valid_until": "2026-04-29T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-28T12:41:00.867Z",
      "x_nadsec_last_seen": "2026-03-28T12:48:00.647Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-28T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=270715; asn_org=TELECOM SERVICOS DE INTERNET LTDA",
      "id": "indicator--fac6e0f3-5c9f-492c-8b83-8148f95e01a2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.127.180.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:05:03.000Z",
      "valid_until": "2026-04-29T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T12:52:01.364Z",
      "x_nadsec_last_seen": "2026-03-28T12:54:07.666Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "270715"
      ],
      "x_nadsec_orgs": [
        "TELECOM SERVICOS DE INTERNET LTDA"
      ]
    },
    {
      "created": "2026-03-28T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=GR; asn=6799; asn_org=OTEnet S.A.",
      "id": "indicator--2167f337-296c-4efd-a52a-310b9d994f16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.167.48.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:05:03.000Z",
      "valid_until": "2026-04-29T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-28T12:13:32.603Z",
      "x_nadsec_last_seen": "2026-03-28T12:20:33.204Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GR"
      ],
      "x_nadsec_asns": [
        "6799"
      ],
      "x_nadsec_orgs": [
        "OTEnet S.A."
      ]
    },
    {
      "created": "2026-03-28T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134341; asn_org=jdm broadband services pvt ltd",
      "id": "indicator--f3135852-7ad2-4dab-89ae-f501a23a8133",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.160.135.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:05:03.000Z",
      "valid_until": "2026-04-29T13:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-28T12:44:09.892Z",
      "x_nadsec_last_seen": "2026-03-28T13:10:17.346Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134341"
      ],
      "x_nadsec_orgs": [
        "jdm broadband services pvt ltd"
      ]
    },
    {
      "created": "2026-03-28T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--5f430470-e844-4823-bd8a-85f00462ac5b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.3.81.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T14:05:02.000Z",
      "valid_until": "2026-04-29T14:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T14:03:30.309Z",
      "x_nadsec_last_seen": "2026-03-28T14:03:30.386Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-28T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c0b1475e-3dc1-4f76-ab3f-9b1aa7f19300",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.174.244.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T14:05:02.000Z",
      "valid_until": "2026-04-29T14:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T13:38:12.898Z",
      "x_nadsec_last_seen": "2026-03-28T13:38:23.284Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-28T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--28c5a086-71d1-4240-ac47-76937e821297",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.79.93.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T14:05:02.000Z",
      "valid_until": "2026-04-29T14:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T13:10:06.451Z",
      "x_nadsec_last_seen": "2026-03-28T13:12:11.393Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-28T14:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet; user(top)=**",
      "id": "indicator--b1bebe09-ba39-45b7-9394-6e456148cfbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T14:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.247.235.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T14:05:02.000Z",
      "valid_until": "2026-04-29T14:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T13:28:17.787Z",
      "x_nadsec_last_seen": "2026-03-28T13:28:17.787Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-28T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--dbd9aa87-3993-4562-912f-78d8e86d130e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.183.6.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T15:05:04.000Z",
      "valid_until": "2026-04-29T15:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T14:58:41.908Z",
      "x_nadsec_last_seen": "2026-03-28T15:00:48.408Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-28T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=4800; asn_org=PT Aplikanusa Lintasarta",
      "id": "indicator--27aa797d-91e1-4343-b2ac-ae290b3c715b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.23.83.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T15:05:04.000Z",
      "valid_until": "2026-04-29T15:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-28T15:01:49.246Z",
      "x_nadsec_last_seen": "2026-03-28T15:08:15.867Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4800"
      ],
      "x_nadsec_orgs": [
        "PT Aplikanusa Lintasarta"
      ]
    },
    {
      "created": "2026-03-28T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--d87ef18d-68ed-432f-8384-6a28ed0a5073",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.198.6.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T15:05:04.000Z",
      "valid_until": "2026-04-29T15:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T14:45:08.870Z",
      "x_nadsec_last_seen": "2026-03-28T14:45:08.870Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-28T15:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=httpd; ports=81; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--4030ac0e-49b4-4854-9981-a48c7878c084",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T15:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T15:05:04.000Z",
      "valid_until": "2026-04-29T15:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-28T14:44:15.585Z",
      "x_nadsec_last_seen": "2026-03-28T14:44:46.578Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-28T16:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BR; asn=262847; asn_org=DBUG TELECOM LTDA",
      "id": "indicator--ef1735f0-49cb-4dc7-a344-d169cf45a6d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T16:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.137.87.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T16:05:12.000Z",
      "valid_until": "2026-04-29T16:05:09.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-28T15:25:57.593Z",
      "x_nadsec_last_seen": "2026-03-28T15:33:02.932Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262847"
      ],
      "x_nadsec_orgs": [
        "DBUG TELECOM LTDA"
      ]
    },
    {
      "created": "2026-03-28T16:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=57847; asn_org=CHAIKOF Ltd.",
      "id": "indicator--cf01ef7f-97ec-40a1-b1d1-fa16ad9dd286",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T16:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.109.15.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T16:05:12.000Z",
      "valid_until": "2026-04-29T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T15:44:05.404Z",
      "x_nadsec_last_seen": "2026-03-28T15:46:12.296Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "57847"
      ],
      "x_nadsec_orgs": [
        "CHAIKOF Ltd."
      ]
    },
    {
      "created": "2026-03-28T16:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--881aace8-2c43-4812-b44e-6fe1747d6215",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T16:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T16:05:12.000Z",
      "valid_until": "2026-04-29T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T15:40:09.371Z",
      "x_nadsec_last_seen": "2026-03-28T15:40:09.371Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "51396"
      ],
      "x_nadsec_orgs": [
        "Pfcloud UG (haftungsbeschrankt)"
      ]
    },
    {
      "created": "2026-03-28T16:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=NL; asn=207728; asn_org=EUROHOSTER Ltd.; user(top)=c**n",
      "id": "indicator--f1543d17-f754-4d20-9ca4-f6645b6d02f4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T16:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.162.9.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T16:05:12.000Z",
      "valid_until": "2026-04-29T16:05:09.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T15:07:39.147Z",
      "x_nadsec_last_seen": "2026-03-28T15:07:39.147Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "207728"
      ],
      "x_nadsec_orgs": [
        "EUROHOSTER Ltd."
      ],
      "x_nadsec_usernames_attempted": [
        "c**n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-28T16:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=57529; asn_org=ZAO GTNT",
      "id": "indicator--6bb36654-f424-4617-90de-ff9d4f63a5f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T16:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.19.49.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T16:05:12.000Z",
      "valid_until": "2026-04-29T16:05:09.000Z",
      "x_nadsec_event_count": 3092,
      "x_nadsec_first_seen": "2026-03-28T15:41:08.984Z",
      "x_nadsec_last_seen": "2026-03-29T23:03:35.986Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57529"
      ],
      "x_nadsec_orgs": [
        "ZAO GTNT"
      ]
    },
    {
      "created": "2026-03-28T16:05:12.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--482dd06d-1e15-4c94-aa44-f287547d49b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T16:05:12.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.98.244.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T16:05:12.000Z",
      "valid_until": "2026-04-29T16:05:09.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T15:23:11.701Z",
      "x_nadsec_last_seen": "2026-03-28T15:25:18.856Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-28T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MY; asn=23678; asn_org=Enterprise Managed Services Sdn. Bhd.",
      "id": "indicator--ca810941-3e7d-44b8-befb-368bedb0a526",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '150.107.157.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T17:05:03.000Z",
      "valid_until": "2026-04-29T17:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-28T16:47:21.010Z",
      "x_nadsec_last_seen": "2026-03-30T05:53:25.106Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MY"
      ],
      "x_nadsec_asns": [
        "23678"
      ],
      "x_nadsec_orgs": [
        "Enterprise Managed Services Sdn. Bhd."
      ]
    },
    {
      "created": "2026-03-28T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=134756; asn_org=CHINANET Nanjing Jishan IDC network; user(top)=**",
      "id": "indicator--21a1f1aa-8f1a-4186-b5d8-64754807c750",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.110.204.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T17:05:03.000Z",
      "valid_until": "2026-04-29T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T16:07:04.799Z",
      "x_nadsec_last_seen": "2026-03-28T16:07:04.799Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "134756"
      ],
      "x_nadsec_orgs": [
        "CHINANET Nanjing Jishan IDC network"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-28T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--86002e49-e8de-4bf8-af2d-aed4efc58f09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T17:05:03.000Z",
      "valid_until": "2026-04-29T17:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T16:41:02.699Z",
      "x_nadsec_last_seen": "2026-03-30T20:44:10.235Z",
      "x_nadsec_ports": [
        "135",
        "1433"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-28T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--23001317-fcc0-4bb6-b527-fae95d992dc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.110.19.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T17:05:03.000Z",
      "valid_until": "2026-04-29T17:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T16:54:20.585Z",
      "x_nadsec_last_seen": "2026-03-28T16:54:20.735Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-28T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BA; asn=9146; asn_org=BH Telecom d.d. Sarajevo",
      "id": "indicator--83ab7bbb-c093-4812-911a-5939f7b7aa92",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.163.165.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T18:05:03.000Z",
      "valid_until": "2026-04-29T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T17:56:19.563Z",
      "x_nadsec_last_seen": "2026-03-28T17:58:25.646Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BA"
      ],
      "x_nadsec_asns": [
        "9146"
      ],
      "x_nadsec_orgs": [
        "BH Telecom d.d. Sarajevo"
      ]
    },
    {
      "created": "2026-03-28T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=HK; asn=4760; asn_org=HKT Limited",
      "id": "indicator--e2428eab-0542-495a-addd-c3f1cf8c8257",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.120.78.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T18:05:03.000Z",
      "valid_until": "2026-04-29T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T17:31:52.868Z",
      "x_nadsec_last_seen": "2026-03-28T17:33:57.878Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "4760"
      ],
      "x_nadsec_orgs": [
        "HKT Limited"
      ]
    },
    {
      "created": "2026-03-28T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=UA; asn=201776; asn_org=Miranda-Media Ltd; user(top)=**",
      "id": "indicator--8a3a13e9-0c16-4c96-bf54-7c434467b63b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.115.201.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T18:05:03.000Z",
      "valid_until": "2026-04-29T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T17:47:24.899Z",
      "x_nadsec_last_seen": "2026-03-28T17:47:24.899Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "201776"
      ],
      "x_nadsec_orgs": [
        "Miranda-Media Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-28T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c9757b0c-c0a3-4331-be96-d5bc24cde493",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.89.125.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T19:05:03.000Z",
      "valid_until": "2026-04-29T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T18:43:32.216Z",
      "x_nadsec_last_seen": "2026-03-28T18:43:32.216Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-28T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c1583308-06cb-4745-83be-7630f1bcb62d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T19:05:03.000Z",
      "valid_until": "2026-04-29T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-25T22:53:45.578Z",
      "x_nadsec_last_seen": "2026-03-28T18:20:20.942Z",
      "x_nadsec_ports": [
        "135",
        "1723"
      ],
      "x_nadsec_services": [
        "epmapper",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-28T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--c3dd1678-86b1-4216-b1cd-4d3f61b9c6b5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.140.119.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T19:05:03.000Z",
      "valid_until": "2026-04-29T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T05:48:49.475Z",
      "x_nadsec_last_seen": "2026-03-28T18:56:06.742Z",
      "x_nadsec_ports": [
        "445",
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-28T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AZ; asn=199731; asn_org=The Educational Center for Internet and New Technologies of the Nakhchivan Autonomous Repub",
      "id": "indicator--05e89785-9259-4965-a22c-d7c701cc8664",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.132.16.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T19:05:03.000Z",
      "valid_until": "2026-04-29T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T18:37:42.010Z",
      "x_nadsec_last_seen": "2026-03-28T18:39:49.405Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AZ"
      ],
      "x_nadsec_asns": [
        "199731"
      ],
      "x_nadsec_orgs": [
        "The Educational Center for Internet and New Technologies of the Nakhchivan Autonomous Repub"
      ]
    },
    {
      "created": "2026-03-28T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--81aff6da-6d83-404e-82a5-759315ae51f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T19:05:03.000Z",
      "valid_until": "2026-04-29T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T18:20:10.101Z",
      "x_nadsec_last_seen": "2026-03-28T18:20:10.101Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-28T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--0cef2854-3b23-458c-9d1d-9c5b8a9c8273",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T19:05:03.000Z",
      "valid_until": "2026-04-29T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T18:20:10.737Z",
      "x_nadsec_last_seen": "2026-03-28T18:20:10.737Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-28T19:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f04f5c44-9d83-4dc2-8548-e0f2d72827b9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T19:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T19:05:03.000Z",
      "valid_until": "2026-04-29T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T18:19:45.398Z",
      "x_nadsec_last_seen": "2026-03-28T18:19:45.398Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-28T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--11519f3e-2f61-400e-94c7-132226b5c570",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.177.178.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:05:03.000Z",
      "valid_until": "2026-04-29T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T19:42:47.119Z",
      "x_nadsec_last_seen": "2026-03-28T19:42:47.119Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-28T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--cc9a5999-b6b0-4d06-92ea-9db7bbc9b02d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.209.244.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:05:03.000Z",
      "valid_until": "2026-04-29T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T19:52:56.269Z",
      "x_nadsec_last_seen": "2026-03-28T19:52:56.269Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-28T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--4cd1a94b-69a4-4adb-a6ae-9da6b159310e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.98.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:05:03.000Z",
      "valid_until": "2026-04-29T20:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T19:13:46.709Z",
      "x_nadsec_last_seen": "2026-03-28T19:13:58.022Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-28T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BD; asn=9832; asn_org=ISN, Internet Service Provider; user(top)=**",
      "id": "indicator--bf94618a-7774-4c75-90aa-1c5914e34e14",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.92.230.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:05:03.000Z",
      "valid_until": "2026-04-29T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T19:14:13.034Z",
      "x_nadsec_last_seen": "2026-03-28T19:14:13.034Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "9832"
      ],
      "x_nadsec_orgs": [
        "ISN, Internet Service Provider"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-28T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone",
      "id": "indicator--cb084b89-1001-47ea-9d04-d004a697f1e5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.119.231.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:05:03.000Z",
      "valid_until": "2026-04-29T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T19:43:19.070Z",
      "x_nadsec_last_seen": "2026-03-28T19:43:19.070Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ]
    },
    {
      "created": "2026-03-28T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=NO; asn=205090; asn_org=First Server Limited",
      "id": "indicator--ecd3a7b4-e85e-4e0e-828e-88c5c22c365d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.40.4.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:05:03.000Z",
      "valid_until": "2026-04-29T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T19:47:07.509Z",
      "x_nadsec_last_seen": "2026-03-28T19:47:07.509Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NO"
      ],
      "x_nadsec_asns": [
        "205090"
      ],
      "x_nadsec_orgs": [
        "First Server Limited"
      ]
    },
    {
      "created": "2026-03-28T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e3f12d52-cebd-4cc1-9a03-7643cfe833cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '207.154.236.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:05:03.000Z",
      "valid_until": "2026-04-29T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T19:13:59.049Z",
      "x_nadsec_last_seen": "2026-03-28T19:13:59.049Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-28T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--0bee385d-ec88-4879-bdc3-61737e9cefad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.176.201.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:05:03.000Z",
      "valid_until": "2026-04-29T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T19:43:03.130Z",
      "x_nadsec_last_seen": "2026-03-28T19:43:03.130Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-28T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=56045; asn_org=China Mobile communications corporation",
      "id": "indicator--f99373f9-e55c-4e3d-bc27-c7956e517813",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.83.130.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:05:03.000Z",
      "valid_until": "2026-04-29T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T19:43:15.001Z",
      "x_nadsec_last_seen": "2026-03-28T19:43:15.001Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56045"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-03-28T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CN; asn=17622; asn_org=China Unicom Guangzhou network",
      "id": "indicator--c69652e8-ccb3-46bf-b7b8-0ef969d2fc42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.47.25.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:05:03.000Z",
      "valid_until": "2026-04-29T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T19:42:46.468Z",
      "x_nadsec_last_seen": "2026-03-28T19:42:46.468Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "17622"
      ],
      "x_nadsec_orgs": [
        "China Unicom Guangzhou network"
      ]
    },
    {
      "created": "2026-03-28T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9736f0c6-a888-422f-a9c5-1f381e316495",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:05:03.000Z",
      "valid_until": "2026-04-29T20:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T19:07:00.710Z",
      "x_nadsec_last_seen": "2026-03-28T19:07:00.710Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-28T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--b6bbe81c-0827-4bf5-8abf-2a759837d861",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.39.83.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:05:03.000Z",
      "valid_until": "2026-04-29T20:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-28T19:26:34.803Z",
      "x_nadsec_last_seen": "2026-03-28T19:27:48.803Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-03-28T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6325b1c7-a114-4c42-ba1b-bb177cab7084",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.63.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T21:05:03.000Z",
      "valid_until": "2026-04-29T21:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-28T20:23:52.336Z",
      "x_nadsec_last_seen": "2026-03-29T02:48:07.198Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-28T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--289ab197-8ee6-4241-8422-6702cd0e112e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.115.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T21:05:03.000Z",
      "valid_until": "2026-04-29T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T20:23:51.248Z",
      "x_nadsec_last_seen": "2026-03-28T20:23:51.248Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-28T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0736f829-40da-45be-a194-c3e1828a4089",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.231.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T21:05:03.000Z",
      "valid_until": "2026-04-29T21:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-28T20:23:52.317Z",
      "x_nadsec_last_seen": "2026-03-30T04:07:52.713Z",
      "x_nadsec_ports": [
        "1433",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-28T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=265261; asn_org=Tely Banda Larga",
      "id": "indicator--47aa09e6-ebc7-44e2-9503-5283cd5c8edc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '168.0.232.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T21:05:03.000Z",
      "valid_until": "2026-04-29T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T20:47:48.314Z",
      "x_nadsec_last_seen": "2026-03-28T20:49:55.045Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "265261"
      ],
      "x_nadsec_orgs": [
        "Tely Banda Larga"
      ]
    },
    {
      "created": "2026-03-28T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a0a67e5e-a24e-4879-9bfd-75d95ca2bf1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.152.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T21:05:03.000Z",
      "valid_until": "2026-04-29T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T20:41:57.299Z",
      "x_nadsec_last_seen": "2026-03-28T20:42:07.459Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-28T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--d09439b0-ae44-436d-b54e-3076961a672e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.189.205.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T21:05:03.000Z",
      "valid_until": "2026-04-29T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T20:43:08.777Z",
      "x_nadsec_last_seen": "2026-03-28T20:43:19.992Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-28T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd",
      "id": "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T21:05:03.000Z",
      "valid_until": "2026-04-29T21:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-28T20:45:51.160Z",
      "x_nadsec_last_seen": "2026-03-30T19:26:19.901Z",
      "x_nadsec_ports": [
        "21",
        "42",
        "81",
        "135",
        "445",
        "45709"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mirrorc",
        "mirrord",
        "smbd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "206264"
      ],
      "x_nadsec_orgs": [
        "Amarutu Technology Ltd"
      ]
    },
    {
      "created": "2026-03-28T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=US; asn=20477; asn_org=Randolph Telephone Company",
      "id": "indicator--6f78f905-65d0-4084-b436-6607f125bb0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.206.72.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T21:05:03.000Z",
      "valid_until": "2026-04-29T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T20:36:01.999Z",
      "x_nadsec_last_seen": "2026-03-28T20:38:07.323Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "20477"
      ],
      "x_nadsec_orgs": [
        "Randolph Telephone Company"
      ]
    },
    {
      "created": "2026-03-28T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--3bbf89d2-406f-411a-b151-2cad493fc752",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.97.240.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T22:05:03.000Z",
      "valid_until": "2026-04-29T22:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-28T21:49:06.721Z",
      "x_nadsec_last_seen": "2026-03-29T19:25:35.356Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-28T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--a4cb8b01-0110-4d04-ad92-0bfcb1f708f9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.70.179.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T22:05:03.000Z",
      "valid_until": "2026-04-29T22:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-28T21:49:06.871Z",
      "x_nadsec_last_seen": "2026-03-29T19:25:34.586Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-28T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--da553492-e2e2-40ac-a481-9535cbb3b14b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.203.201.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T22:05:03.000Z",
      "valid_until": "2026-04-29T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-28T21:49:25.633Z",
      "x_nadsec_last_seen": "2026-03-28T21:49:25.991Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-28T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--9d4c18fc-d661-4db3-b3e9-fd644076dc1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.216.253.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T22:05:03.000Z",
      "valid_until": "2026-04-29T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T21:40:31.427Z",
      "x_nadsec_last_seen": "2026-03-28T21:40:31.427Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-28T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--5ef70a52-39d0-4097-9295-1bcf3c3c1f82",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.136.79.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T22:05:03.000Z",
      "valid_until": "2026-04-29T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T21:29:49.071Z",
      "x_nadsec_last_seen": "2026-03-28T21:31:53.898Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-28T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--405e8435-d142-44e9-b42b-a2b0b4f1f14e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-28T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T22:05:03.000Z",
      "valid_until": "2026-04-29T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T21:31:06.302Z",
      "x_nadsec_last_seen": "2026-03-28T21:31:06.302Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-29T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45117; asn_org=Ishans Network",
      "id": "indicator--98ed9db0-fe3d-4edf-8740-fb420b703476",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.36.121.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T00:05:03.000Z",
      "valid_until": "2026-04-30T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T23:10:36.471Z",
      "x_nadsec_last_seen": "2026-03-28T23:12:41.388Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45117"
      ],
      "x_nadsec_orgs": [
        "Ishans Network"
      ]
    },
    {
      "created": "2026-03-29T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=37168; asn_org=CELL-C",
      "id": "indicator--f1cd8000-861f-4d8d-afe2-526b559d5ba2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.1.21.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T00:05:03.000Z",
      "valid_until": "2026-04-30T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T23:47:40.867Z",
      "x_nadsec_last_seen": "2026-03-28T23:49:48.507Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37168"
      ],
      "x_nadsec_orgs": [
        "CELL-C"
      ]
    },
    {
      "created": "2026-03-29T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--978f7e33-ed82-4416-ad01-8fde504d1f46",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.33.90.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T00:05:03.000Z",
      "valid_until": "2026-04-30T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T23:34:40.830Z",
      "x_nadsec_last_seen": "2026-03-28T23:36:47.360Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-29T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--e53abcb7-75fe-41df-ad17-7848919b7b8e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.227.210.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T00:05:03.000Z",
      "valid_until": "2026-04-30T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-28T23:15:50.510Z",
      "x_nadsec_last_seen": "2026-03-28T23:17:55.203Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-29T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--f77678c8-a4c2-47c0-854f-d1a4bc53eaaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T00:05:03.000Z",
      "valid_until": "2026-04-30T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T23:17:17.528Z",
      "x_nadsec_last_seen": "2026-03-28T23:17:17.528Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-29T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--bed5c006-4742-407f-a99d-b7e6fc9cc18c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T00:05:03.000Z",
      "valid_until": "2026-04-30T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T23:17:17.279Z",
      "x_nadsec_last_seen": "2026-03-28T23:17:17.279Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-29T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--eade05ca-73e9-4d2a-9923-0d0f3857aa80",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.231.206.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T00:05:03.000Z",
      "valid_until": "2026-04-30T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-28T23:17:44.250Z",
      "x_nadsec_last_seen": "2026-03-28T23:17:44.250Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-29T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--c1745d6e-492d-4319-8c7c-321bd57cd65f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.143.129.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T01:05:02.000Z",
      "valid_until": "2026-04-30T01:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T00:51:40.232Z",
      "x_nadsec_last_seen": "2026-03-29T00:53:45.845Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-29T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--508c86fe-d0d4-429c-aef4-931a6911118e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.235.102.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T01:05:02.000Z",
      "valid_until": "2026-04-30T01:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T00:50:13.329Z",
      "x_nadsec_last_seen": "2026-03-29T00:50:19.639Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-03-29T01:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f0dd478a-74db-4f67-a823-e04f6d4b965f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T01:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T01:05:02.000Z",
      "valid_until": "2026-04-30T01:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-24T16:40:17.647Z",
      "x_nadsec_last_seen": "2026-03-29T00:32:34.456Z",
      "x_nadsec_ports": [
        "1883",
        "3306"
      ],
      "x_nadsec_services": [
        "mqttd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-29T02:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--45b95fb3-bc2f-4b01-87e9-daa5cc92a5c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T02:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '174.138.51.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T02:05:15.000Z",
      "valid_until": "2026-04-30T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T01:31:49.904Z",
      "x_nadsec_last_seen": "2026-03-29T01:31:49.904Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-29T02:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CO; asn=13489; asn_org=UNE EPM TELECOMUNICACIONES S.A.",
      "id": "indicator--36afb7da-5833-4a6a-8edf-b24fbdc03e1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T02:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.71.180.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T02:05:15.000Z",
      "valid_until": "2026-04-30T02:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-29T01:16:45.586Z",
      "x_nadsec_last_seen": "2026-03-29T01:23:43.012Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "13489"
      ],
      "x_nadsec_orgs": [
        "UNE EPM TELECOMUNICACIONES S.A."
      ]
    },
    {
      "created": "2026-03-29T02:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--3f9bb0f1-69af-47ee-9736-6f39161e4fcf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T02:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T02:05:15.000Z",
      "valid_until": "2026-04-30T02:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-29T01:41:21.356Z",
      "x_nadsec_last_seen": "2026-03-29T01:41:22.403Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-29T02:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SC; asn=18233; asn_org=Philippine Telegraph and Telephone Corporation",
      "id": "indicator--2b574a94-0e49-4aa5-9acf-6aa0a9dfccf4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T02:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.199.177.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T02:05:15.000Z",
      "valid_until": "2026-04-30T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T01:44:27.585Z",
      "x_nadsec_last_seen": "2026-03-29T01:46:32.126Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "18233"
      ],
      "x_nadsec_orgs": [
        "Philippine Telegraph and Telephone Corporation"
      ]
    },
    {
      "created": "2026-03-29T02:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--733909ad-e7b8-4f1f-ba12-9c6426b45650",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T02:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.174.222.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T02:05:15.000Z",
      "valid_until": "2026-04-30T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T01:10:11.612Z",
      "x_nadsec_last_seen": "2026-03-29T01:10:11.612Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-29T02:05:15.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--93ff68c0-c378-4373-a486-fee68457e4a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T02:05:15.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.204.95.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T02:05:15.000Z",
      "valid_until": "2026-04-30T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T01:13:49.040Z",
      "x_nadsec_last_seen": "2026-03-29T01:15:58.707Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-29T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--f14b01bb-c6b2-4487-aac1-72b36bcf2938",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '125.19.235.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:05:03.000Z",
      "valid_until": "2026-04-30T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T02:34:50.556Z",
      "x_nadsec_last_seen": "2026-03-29T02:34:55.508Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-29T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=9; services=httpd; ports=81; cc=NG; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--12b3ddb9-0575-4366-abe6-8b02a43f01c3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.142.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:05:03.000Z",
      "valid_until": "2026-04-30T03:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-29T02:27:14.964Z",
      "x_nadsec_last_seen": "2026-03-29T02:28:10.419Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-29T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--81562848-f6ca-4b21-85f7-04bf39ced5a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.88.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:05:03.000Z",
      "valid_until": "2026-04-30T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T02:47:59.328Z",
      "x_nadsec_last_seen": "2026-03-29T02:47:59.328Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-29T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TH; asn=133481; asn_org=AIS Fibre",
      "id": "indicator--24821e57-4519-4cab-b912-4ff1c39d429b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.82.119.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:05:03.000Z",
      "valid_until": "2026-04-30T03:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-29T02:27:02.402Z",
      "x_nadsec_last_seen": "2026-03-29T02:33:19.057Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "133481"
      ],
      "x_nadsec_orgs": [
        "AIS Fibre"
      ]
    },
    {
      "created": "2026-03-29T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--366fcfb2-1aac-4d2a-bf4c-f03f882c942c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:05:03.000Z",
      "valid_until": "2026-04-30T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T02:34:20.289Z",
      "x_nadsec_last_seen": "2026-03-29T02:34:20.289Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-29T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--6ee23d63-dbb5-480e-bef0-8e769b803fc7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.248.16.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T03:05:03.000Z",
      "valid_until": "2026-04-30T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T02:35:39.739Z",
      "x_nadsec_last_seen": "2026-03-29T02:37:46.842Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-29T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mongod; ports=27017; cc=HK; asn=132883; asn_org=TOPWAY GLOBAL LIMITED",
      "id": "indicator--2d38ddbb-02c5-4285-a139-1fc91253bd03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.87.9.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:05:04.000Z",
      "valid_until": "2026-04-30T04:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-29T03:51:26.840Z",
      "x_nadsec_last_seen": "2026-03-30T06:05:50.585Z",
      "x_nadsec_ports": [
        "27017",
        "1433"
      ],
      "x_nadsec_services": [
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "132883"
      ],
      "x_nadsec_orgs": [
        "TOPWAY GLOBAL LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "1****6"
      ]
    },
    {
      "created": "2026-03-29T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--54c90c04-669f-4601-a4f0-2df55d462d42",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.78.13.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:05:04.000Z",
      "valid_until": "2026-04-30T04:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-29T03:40:40.390Z",
      "x_nadsec_last_seen": "2026-03-29T03:47:17.267Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-29T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=6503; asn_org=Axtel, S.A.B. de C.V.",
      "id": "indicator--f289614b-d0b3-4e10-862b-e1d5f7c29a87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.205.57.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:05:04.000Z",
      "valid_until": "2026-04-30T04:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T03:11:43.307Z",
      "x_nadsec_last_seen": "2026-03-29T03:13:49.101Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "6503"
      ],
      "x_nadsec_orgs": [
        "Axtel, S.A.B. de C.V."
      ]
    },
    {
      "created": "2026-03-29T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8815c1db-2b24-45aa-ac71-ac66f8ca8e23",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:05:04.000Z",
      "valid_until": "2026-04-30T04:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T03:27:43.200Z",
      "x_nadsec_last_seen": "2026-03-29T03:27:43.200Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-29T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--80015fb0-d1a2-4728-987a-9d12a1c853e8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.144.129.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:05:04.000Z",
      "valid_until": "2026-04-30T04:05:02.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-29T03:12:10.210Z",
      "x_nadsec_last_seen": "2026-03-29T04:47:02.600Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-03-29T04:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=UG; asn=20294; asn_org=MTN; user(top)=**",
      "id": "indicator--bf38fdc8-ca15-40cc-9cf4-36735dce4cad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T04:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.210.131.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:05:04.000Z",
      "valid_until": "2026-04-30T04:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T03:09:06.809Z",
      "x_nadsec_last_seen": "2026-03-29T03:09:06.809Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UG"
      ],
      "x_nadsec_asns": [
        "20294"
      ],
      "x_nadsec_orgs": [
        "MTN"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-29T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TR; asn=16135; asn_org=Turkcell Iletisim Hizmetleri A.s.",
      "id": "indicator--5776b50d-a525-4bec-8e10-2b61c7498fb2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.237.194.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:05:03.000Z",
      "valid_until": "2026-04-30T05:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-25T18:59:42.375Z",
      "x_nadsec_last_seen": "2026-03-29T05:03:06.645Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "16135"
      ],
      "x_nadsec_orgs": [
        "Turkcell Iletisim Hizmetleri A.s."
      ]
    },
    {
      "created": "2026-03-29T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--f0c1d63c-aa3f-4bca-b37d-e16453a4da87",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:05:03.000Z",
      "valid_until": "2026-04-30T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-13T02:03:59.636Z",
      "x_nadsec_last_seen": "2026-03-29T04:33:37.689Z",
      "x_nadsec_ports": [
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "mongod",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-29T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=httpd; ports=81; cc=NL; asn=49870; asn_org=Alsycon B.V.",
      "id": "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.95.147.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:05:03.000Z",
      "valid_until": "2026-04-30T05:05:01.000Z",
      "x_nadsec_event_count": 58,
      "x_nadsec_first_seen": "2026-03-29T04:18:14.704Z",
      "x_nadsec_last_seen": "2026-03-29T14:41:12.023Z",
      "x_nadsec_ports": [
        "445",
        "81",
        "1433",
        "3306"
      ],
      "x_nadsec_services": [
        "smbd",
        "httpd",
        "mssqld",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "49870"
      ],
      "x_nadsec_orgs": [
        "Alsycon B.V."
      ]
    },
    {
      "created": "2026-03-29T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--1d4d9506-5b80-4513-84fe-9bb65a55280d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:05:03.000Z",
      "valid_until": "2026-04-30T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-29T04:05:33.169Z",
      "x_nadsec_last_seen": "2026-03-29T04:05:33.551Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-29T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--3af0758f-eccc-40b0-b4d2-048430c3b060",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:05:03.000Z",
      "valid_until": "2026-04-30T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T04:32:09.271Z",
      "x_nadsec_last_seen": "2026-03-29T04:32:09.271Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-29T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=8; services=smbd; ports=445; cc=RU; asn=25490; asn_org=Rostelecom",
      "id": "indicator--db15ff1a-d808-43aa-99c4-55a0809dcaa6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.239.82.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:05:03.000Z",
      "valid_until": "2026-04-30T05:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-29T04:27:45.138Z",
      "x_nadsec_last_seen": "2026-03-29T04:53:31.706Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25490"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-29T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KZ; asn=35104; asn_org=Jusan Mobile JSC",
      "id": "indicator--d81624f0-5f4a-486c-8863-b475b2aa1fbe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.185.69.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:05:03.000Z",
      "valid_until": "2026-04-30T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T04:38:59.689Z",
      "x_nadsec_last_seen": "2026-03-29T04:41:06.629Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "35104"
      ],
      "x_nadsec_orgs": [
        "Jusan Mobile JSC"
      ]
    },
    {
      "created": "2026-03-29T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=133982; asn_org=Excitel Broadband Private Limited",
      "id": "indicator--21729182-c601-4e0a-ba02-7bdaf29757f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.110.48.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T06:05:03.000Z",
      "valid_until": "2026-04-30T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-29T05:31:36.434Z",
      "x_nadsec_last_seen": "2026-03-29T05:38:29.656Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133982"
      ],
      "x_nadsec_orgs": [
        "Excitel Broadband Private Limited"
      ]
    },
    {
      "created": "2026-03-29T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--01652781-f791-46b2-a1b8-6b57df3dfb52",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.107.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T06:05:03.000Z",
      "valid_until": "2026-04-30T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T05:12:11.483Z",
      "x_nadsec_last_seen": "2026-03-29T05:12:11.483Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-29T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1379; services=smbd; ports=445; cc=RU; asn=8905; asn_org=Digit One LLC",
      "id": "indicator--e5e5052d-0315-4903-b94f-5ec61348d147",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.188.171.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T06:05:03.000Z",
      "valid_until": "2026-04-30T06:05:01.000Z",
      "x_nadsec_event_count": 3109,
      "x_nadsec_first_seen": "2026-03-29T05:31:50.214Z",
      "x_nadsec_last_seen": "2026-03-29T06:54:31.551Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8905"
      ],
      "x_nadsec_orgs": [
        "Digit One LLC"
      ]
    },
    {
      "created": "2026-03-29T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12958; asn_org=T2 Mobile LLC",
      "id": "indicator--7a8bca9e-496c-4bd7-a506-ff4d4d188ed2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.36.18.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T06:05:03.000Z",
      "valid_until": "2026-04-30T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-29T05:29:00.187Z",
      "x_nadsec_last_seen": "2026-03-29T05:29:00.559Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12958"
      ],
      "x_nadsec_orgs": [
        "T2 Mobile LLC"
      ]
    },
    {
      "created": "2026-03-29T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9829; asn_org=National Internet Backbone",
      "id": "indicator--2f70001c-d492-4eb1-b8ef-c39e39bdc2e4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.200.58.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T07:05:02.000Z",
      "valid_until": "2026-04-30T07:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T06:36:41.924Z",
      "x_nadsec_last_seen": "2026-03-29T06:38:46.532Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9829"
      ],
      "x_nadsec_orgs": [
        "National Internet Backbone"
      ]
    },
    {
      "created": "2026-03-29T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--32e95d2a-13a6-456d-94b9-1586826f518e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T07:05:02.000Z",
      "valid_until": "2026-04-30T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T06:34:17.943Z",
      "x_nadsec_last_seen": "2026-03-29T06:34:17.943Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-29T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--3e9c3e17-e322-4b18-8d47-25723e044447",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T07:05:02.000Z",
      "valid_until": "2026-04-30T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T06:34:07.535Z",
      "x_nadsec_last_seen": "2026-03-29T06:34:07.535Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-29T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--99d4358d-1325-4028-8858-f67c6f4d2e1f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.55.3.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T07:05:02.000Z",
      "valid_until": "2026-04-30T07:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-29T06:54:38.675Z",
      "x_nadsec_last_seen": "2026-03-29T06:54:48.872Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-29T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=15974; asn_org=Joint Stock Company TransTeleCom",
      "id": "indicator--bb041d3b-cc8d-432c-bff0-309071c26eb5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.80.225.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T07:05:02.000Z",
      "valid_until": "2026-04-30T07:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T06:48:29.983Z",
      "x_nadsec_last_seen": "2026-03-29T06:50:37.125Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "15974"
      ],
      "x_nadsec_orgs": [
        "Joint Stock Company TransTeleCom"
      ]
    },
    {
      "created": "2026-03-29T07:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--7f6d7fe2-4a71-476e-ab55-65bdfb58b266",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T07:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T07:05:02.000Z",
      "valid_until": "2026-04-30T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T06:51:24.339Z",
      "x_nadsec_last_seen": "2026-03-29T06:51:24.339Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-03-29T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0f188af2-6634-44c7-99d6-853611309c91",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.190.222.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T08:05:03.000Z",
      "valid_until": "2026-04-30T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-29T07:07:51.877Z",
      "x_nadsec_last_seen": "2026-03-29T07:07:53.690Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-29T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=42610; asn_org=Rostelecom",
      "id": "indicator--1255fbba-f5f8-4511-bdd6-18c6ee39f9a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.255.123.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T08:05:03.000Z",
      "valid_until": "2026-04-30T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T07:09:10.572Z",
      "x_nadsec_last_seen": "2026-03-29T07:11:17.283Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "42610"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-29T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=132115; asn_org=INDINET SERVICE PRIVATE LIMITED",
      "id": "indicator--a4911c2d-1bf8-49a5-8983-db9e2f80d674",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.142.81.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T08:05:03.000Z",
      "valid_until": "2026-04-30T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T07:48:00.212Z",
      "x_nadsec_last_seen": "2026-03-29T07:50:05.425Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132115"
      ],
      "x_nadsec_orgs": [
        "INDINET SERVICE PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-29T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--e214f286-71ff-4637-88b2-1991f9c857dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.227.114.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T08:05:03.000Z",
      "valid_until": "2026-04-30T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T07:56:16.939Z",
      "x_nadsec_last_seen": "2026-03-29T07:56:16.939Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-29T08:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--62b59177-89cf-4234-9946-e8ee6be5b412",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T08:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T08:05:03.000Z",
      "valid_until": "2026-04-30T08:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T07:16:07.597Z",
      "x_nadsec_last_seen": "2026-03-29T07:16:07.597Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-29T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=28165; asn_org=Wireless Comm Services LTDA",
      "id": "indicator--a3c503e3-4130-4191-a369-8c93155f0a09",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.184.195.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T10:05:03.000Z",
      "valid_until": "2026-04-30T10:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-29T09:55:12.592Z",
      "x_nadsec_last_seen": "2026-03-29T09:55:12.925Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28165"
      ],
      "x_nadsec_orgs": [
        "Wireless Comm Services LTDA"
      ]
    },
    {
      "created": "2026-03-29T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--d9bb60f7-517c-4ccf-bc16-467f6c66ae5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.16.167.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T10:05:03.000Z",
      "valid_until": "2026-04-30T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T09:20:10.573Z",
      "x_nadsec_last_seen": "2026-03-29T09:22:15.578Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-03-29T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--a1a35f5a-2d1f-4272-83aa-6f2a76909cd0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.210.8.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T10:05:03.000Z",
      "valid_until": "2026-04-30T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-29T09:52:32.277Z",
      "x_nadsec_last_seen": "2026-03-29T10:00:36.924Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-29T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--fc0aca0e-1bf3-407c-addc-249377a97203",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.204.174.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T10:05:03.000Z",
      "valid_until": "2026-04-30T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T09:32:14.781Z",
      "x_nadsec_last_seen": "2026-03-29T09:34:19.257Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-29T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--32e45485-ab47-473d-93f1-c315594f89ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.26.164.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T10:05:03.000Z",
      "valid_until": "2026-04-30T10:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-29T09:21:28.127Z",
      "x_nadsec_last_seen": "2026-03-29T09:29:59.653Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-29T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=23923; asn_org=Agni Systems Limited",
      "id": "indicator--35d543d4-e1e5-4c34-ac92-71982a623775",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.68.198.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T11:05:03.000Z",
      "valid_until": "2026-04-30T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-29T10:32:14.081Z",
      "x_nadsec_last_seen": "2026-03-29T10:38:35.958Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "23923"
      ],
      "x_nadsec_orgs": [
        "Agni Systems Limited"
      ]
    },
    {
      "created": "2026-03-29T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--298f543f-6eb0-448c-8e89-298ac1ed2348",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.189.232.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T11:05:03.000Z",
      "valid_until": "2026-04-30T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-29T10:06:05.563Z",
      "x_nadsec_last_seen": "2026-03-29T10:13:14.777Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-29T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--28ec7662-2b9e-4bea-9d47-eecc6de14ada",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.106.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T11:05:03.000Z",
      "valid_until": "2026-04-30T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T10:59:49.906Z",
      "x_nadsec_last_seen": "2026-03-29T10:59:49.906Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-29T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5ddb96f9-07fe-4a64-90c6-3c66f97ce512",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T11:05:03.000Z",
      "valid_until": "2026-04-30T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T10:31:57.242Z",
      "x_nadsec_last_seen": "2026-03-29T10:31:57.242Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-29T11:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=58219; asn_org=Ekus LLC",
      "id": "indicator--685d94ae-f5a2-4e77-8e05-ec5e8a40d5e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T11:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.239.142.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T11:05:03.000Z",
      "valid_until": "2026-04-30T11:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-29T10:48:41.599Z",
      "x_nadsec_last_seen": "2026-03-29T11:37:32.475Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "58219"
      ],
      "x_nadsec_orgs": [
        "Ekus LLC"
      ]
    },
    {
      "created": "2026-03-29T14:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--f84edf69-ae27-47fd-9013-954a6f53caaa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T14:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.110.155.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T14:05:04.000Z",
      "valid_until": "2026-04-30T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T13:10:01.410Z",
      "x_nadsec_last_seen": "2026-03-29T13:10:01.410Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-29T14:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--0a770863-a4bc-4bcd-8bc0-c437858c7895",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T14:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T14:05:04.000Z",
      "valid_until": "2026-04-30T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T13:12:56.763Z",
      "x_nadsec_last_seen": "2026-03-29T13:12:56.763Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-29T14:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--ce0df446-ca6f-4afe-80b8-99510c8b364d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T14:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.137.137.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T14:05:04.000Z",
      "valid_until": "2026-04-30T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T13:42:27.480Z",
      "x_nadsec_last_seen": "2026-03-29T13:44:33.439Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-29T14:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=134; services=smbd; ports=445; cc=GB; asn=201579; asn_org=Hostgnome Ltd",
      "id": "indicator--afc6b207-6083-49f1-b61b-262f098ff38f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T14:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.237.124.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T14:05:04.000Z",
      "valid_until": "2026-04-30T14:05:01.000Z",
      "x_nadsec_event_count": 134,
      "x_nadsec_first_seen": "2026-03-29T13:12:51.543Z",
      "x_nadsec_last_seen": "2026-03-29T13:53:38.532Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "201579"
      ],
      "x_nadsec_orgs": [
        "Hostgnome Ltd"
      ]
    },
    {
      "created": "2026-03-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45903; asn_org=CMC Telecom Infrastructure Company",
      "id": "indicator--71a665a8-3386-402b-84ce-5e09fab795b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.99.22.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:05:03.000Z",
      "valid_until": "2026-04-30T15:05:01.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-24T16:31:45.606Z",
      "x_nadsec_last_seen": "2026-03-29T14:25:23.185Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45903"
      ],
      "x_nadsec_orgs": [
        "CMC Telecom Infrastructure Company"
      ]
    },
    {
      "created": "2026-03-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=37457; asn_org=Telkom-Internet",
      "id": "indicator--61a51444-cd3a-45d1-8a89-8026dac2340f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.186.213.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:05:03.000Z",
      "valid_until": "2026-04-30T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T14:28:15.149Z",
      "x_nadsec_last_seen": "2026-03-29T14:28:23.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37457"
      ],
      "x_nadsec_orgs": [
        "Telkom-Internet"
      ]
    },
    {
      "created": "2026-03-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--c0eb9284-fba9-453a-9d26-3825a33e8e96",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.190.130.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:05:03.000Z",
      "valid_until": "2026-04-30T15:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-29T14:33:20.047Z",
      "x_nadsec_last_seen": "2026-03-29T14:39:56.883Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--0b3291a1-ea84-40ad-aa8e-777658085622",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.127.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:05:03.000Z",
      "valid_until": "2026-04-30T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T15:04:26.723Z",
      "x_nadsec_last_seen": "2026-03-29T15:04:26.723Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=206092; asn_org=F.n.s. Holdings Limited",
      "id": "indicator--d407c5fc-20c5-407d-a347-070afde72149",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.37.33.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:05:03.000Z",
      "valid_until": "2026-04-30T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-29T14:22:07.692Z",
      "x_nadsec_last_seen": "2026-03-29T14:22:08.047Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "206092"
      ],
      "x_nadsec_orgs": [
        "F.n.s. Holdings Limited"
      ]
    },
    {
      "created": "2026-03-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--c0e0e109-fa01-478d-a2d4-601a955fa114",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.14.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:05:03.000Z",
      "valid_until": "2026-04-30T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T14:17:40.585Z",
      "x_nadsec_last_seen": "2026-03-29T14:17:40.585Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=262847; asn_org=DBUG TELECOM LTDA",
      "id": "indicator--7485b147-372d-4d48-9a70-0bc527f122bd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.225.66.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:05:03.000Z",
      "valid_until": "2026-04-30T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T14:34:23.789Z",
      "x_nadsec_last_seen": "2026-03-29T14:36:30.362Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "262847"
      ],
      "x_nadsec_orgs": [
        "DBUG TELECOM LTDA"
      ]
    },
    {
      "created": "2026-03-29T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=HU; asn=47159; asn_org=Celldomolki Kabeltelevizio Kft.",
      "id": "indicator--f25c684d-326b-45e0-a36f-8f2ee7c113be",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.132.245.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:05:03.000Z",
      "valid_until": "2026-04-30T15:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T14:31:12.518Z",
      "x_nadsec_last_seen": "2026-03-29T14:31:12.518Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "HU"
      ],
      "x_nadsec_asns": [
        "47159"
      ],
      "x_nadsec_orgs": [
        "Celldomolki Kabeltelevizio Kft."
      ]
    },
    {
      "created": "2026-03-29T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--fabacebf-9e69-455c-b78d-2c3673c0e81a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.166.62.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T16:05:03.000Z",
      "valid_until": "2026-04-30T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-29T15:24:29.593Z",
      "x_nadsec_last_seen": "2026-03-29T15:32:12.352Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-29T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=80; services=ftpd; ports=21; cc=CN; asn=4134; asn_org=Chinanet; user(top)=a*******s; pass(top)=a********!",
      "id": "indicator--352f86c4-ff1d-4b61-b70b-23f02691b87e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.40.161.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T16:05:03.000Z",
      "valid_until": "2026-04-30T16:05:01.000Z",
      "x_nadsec_event_count": 877,
      "x_nadsec_first_seen": "2026-03-29T15:15:47.157Z",
      "x_nadsec_last_seen": "2026-03-29T23:46:03.425Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "a***********r",
        "***",
        "u**r",
        "A***n",
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "1****1",
        "***",
        "1****1",
        "1***5",
        "1****6"
      ]
    },
    {
      "created": "2026-03-29T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--b916e990-c267-49a4-998e-8bc443da2938",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.242.186.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T16:05:03.000Z",
      "valid_until": "2026-04-30T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-29T15:09:10.237Z",
      "x_nadsec_last_seen": "2026-03-29T15:16:16.131Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-29T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CL; asn=14117; asn_org=Telefonica del Sur S.A.",
      "id": "indicator--25fb015d-797c-4192-9a99-531d9c514e27",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.121.13.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T16:05:03.000Z",
      "valid_until": "2026-04-30T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-29T15:17:18.310Z",
      "x_nadsec_last_seen": "2026-03-29T15:24:26.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "14117"
      ],
      "x_nadsec_orgs": [
        "Telefonica del Sur S.A."
      ]
    },
    {
      "created": "2026-03-29T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--6ee17b44-f996-4c7c-a4b4-4cb82b21fe03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.52.209.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T16:05:03.000Z",
      "valid_until": "2026-04-30T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T16:00:34.601Z",
      "x_nadsec_last_seen": "2026-03-29T16:00:34.601Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-29T16:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=7; services=mysqld; ports=3306; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited",
      "id": "indicator--3ecf65f4-bf3f-4ae6-b0d3-553273186838",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T16:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.234.90.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T16:05:03.000Z",
      "valid_until": "2026-04-30T16:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-29T15:20:58.762Z",
      "x_nadsec_last_seen": "2026-03-29T15:20:59.233Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "45090"
      ],
      "x_nadsec_orgs": [
        "Shenzhen Tencent Computer Systems Company Limited"
      ]
    },
    {
      "created": "2026-03-29T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--34947a51-ae4e-4362-80ab-f1e0f10e6267",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.89.125.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:05:03.000Z",
      "valid_until": "2026-04-30T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T16:08:32.916Z",
      "x_nadsec_last_seen": "2026-03-29T16:08:32.916Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-29T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones",
      "id": "indicator--321d2d80-3db0-44a1-b032-5412b2237d2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.61.76.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:05:03.000Z",
      "valid_until": "2026-04-30T17:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-29T16:55:15.012Z",
      "x_nadsec_last_seen": "2026-03-29T16:55:15.019Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UY"
      ],
      "x_nadsec_asns": [
        "6057"
      ],
      "x_nadsec_orgs": [
        "Administracion Nacional de Telecomunicaciones"
      ]
    },
    {
      "created": "2026-03-29T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--ee789d8c-e31d-4c39-b530-b7da74dd83b7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.254.109.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:05:03.000Z",
      "valid_until": "2026-04-30T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T16:12:46.856Z",
      "x_nadsec_last_seen": "2026-03-29T16:14:53.803Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-29T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--9ef7e4c1-b31b-41c8-8139-8e4c3ab95c13",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:05:03.000Z",
      "valid_until": "2026-04-30T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T16:09:24.140Z",
      "x_nadsec_last_seen": "2026-03-29T16:09:24.140Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-29T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=53766; asn_org=Arista Networks, Inc.",
      "id": "indicator--068dc4f0-830b-43b1-899c-f5fcca2027ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.221.31.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:05:03.000Z",
      "valid_until": "2026-04-30T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T17:02:46.339Z",
      "x_nadsec_last_seen": "2026-03-29T17:04:52.071Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "53766"
      ],
      "x_nadsec_orgs": [
        "Arista Networks, Inc."
      ]
    },
    {
      "created": "2026-03-29T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--5d9c40d2-5046-45c9-81eb-3ea47d03235d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.220.186.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:05:03.000Z",
      "valid_until": "2026-04-30T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T16:09:48.310Z",
      "x_nadsec_last_seen": "2026-03-29T16:09:48.310Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-29T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12714; asn_org=PJSC MegaFon",
      "id": "indicator--977a9583-a161-42c7-a6ef-76129d024424",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.72.112.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:05:03.000Z",
      "valid_until": "2026-04-30T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T16:36:26.730Z",
      "x_nadsec_last_seen": "2026-03-29T16:36:26.730Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12714"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-29T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=196638; asn_org=JSC Promtelecom",
      "id": "indicator--fcb7e56d-5451-4583-b0a9-0f9e783a1c77",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.182.64.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:05:03.000Z",
      "valid_until": "2026-04-30T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T16:24:56.549Z",
      "x_nadsec_last_seen": "2026-03-29T16:27:02.822Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "196638"
      ],
      "x_nadsec_orgs": [
        "JSC Promtelecom"
      ]
    },
    {
      "created": "2026-03-29T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=AM; asn=44395; asn_org=Ucom CJSC",
      "id": "indicator--61cc588d-7279-4ca5-886c-62b0ea7dd23f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.16.10.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:05:03.000Z",
      "valid_until": "2026-04-30T17:05:01.000Z",
      "x_nadsec_event_count": 45,
      "x_nadsec_first_seen": "2026-03-29T16:43:36.146Z",
      "x_nadsec_last_seen": "2026-03-29T16:46:16.942Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AM"
      ],
      "x_nadsec_asns": [
        "44395"
      ],
      "x_nadsec_orgs": [
        "Ucom CJSC"
      ]
    },
    {
      "created": "2026-03-29T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=28812; asn_org=PJSC Bashinformsvyaz",
      "id": "indicator--1dc8028e-25dd-40ee-ae78-f166ded2da26",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.174.218.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T17:05:03.000Z",
      "valid_until": "2026-04-30T17:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-13T14:16:22.596Z",
      "x_nadsec_last_seen": "2026-03-29T16:43:53.414Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28812"
      ],
      "x_nadsec_orgs": [
        "PJSC Bashinformsvyaz"
      ]
    },
    {
      "created": "2026-03-29T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=39; services=epmapper; ports=135; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bee020cd-fe0d-4e5b-87ac-6dfc34ac5804",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.65.100.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T18:05:04.000Z",
      "valid_until": "2026-04-30T18:05:01.000Z",
      "x_nadsec_event_count": 50,
      "x_nadsec_first_seen": "2026-03-29T17:36:48.757Z",
      "x_nadsec_last_seen": "2026-03-31T15:10:26.413Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-29T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--b5d9d7e9-6dfd-405b-9373-d88235cf6a03",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.222.11.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T18:05:04.000Z",
      "valid_until": "2026-04-30T18:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T17:27:10.870Z",
      "x_nadsec_last_seen": "2026-03-29T17:29:16.345Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-29T18:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2c241a12-956e-455a-810b-134cd0e9fc81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T18:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T18:05:04.000Z",
      "valid_until": "2026-04-30T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T18:04:30.214Z",
      "x_nadsec_last_seen": "2026-03-29T18:04:30.214Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-29T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--f9d1705e-b050-4967-834b-86bfb313a3f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.89.32.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T19:05:04.000Z",
      "valid_until": "2026-04-30T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T18:39:48.538Z",
      "x_nadsec_last_seen": "2026-03-29T18:41:55.827Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-29T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mysqld; ports=3306; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--64dffaf1-4a1a-4c00-be3e-b835d0f95302",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.128.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T19:05:04.000Z",
      "valid_until": "2026-04-30T19:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-12T18:49:50.136Z",
      "x_nadsec_last_seen": "2026-03-29T18:43:24.468Z",
      "x_nadsec_ports": [
        "1723",
        "3306"
      ],
      "x_nadsec_services": [
        "pptpd",
        "mysqld"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-29T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--dd2df1a0-79f7-4a0a-af06-bd9b096e9d25",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.119.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T19:05:04.000Z",
      "valid_until": "2026-04-30T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-29T18:31:46.447Z",
      "x_nadsec_last_seen": "2026-03-29T18:32:16.447Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-29T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=KE; asn=37061; asn_org=Safaricom",
      "id": "indicator--93e1dbbd-2a9d-415c-b664-09329a9e6cdf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.203.215.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T19:05:04.000Z",
      "valid_until": "2026-04-30T19:05:01.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-03-29T18:49:04.297Z",
      "x_nadsec_last_seen": "2026-03-29T18:51:29.963Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "37061"
      ],
      "x_nadsec_orgs": [
        "Safaricom"
      ]
    },
    {
      "created": "2026-03-29T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--2da68240-ffa9-449b-9ebb-eea9c233a87c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T19:05:04.000Z",
      "valid_until": "2026-04-30T19:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-29T18:31:48.065Z",
      "x_nadsec_last_seen": "2026-03-29T18:32:18.064Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-29T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--4b801a0e-f39f-4165-9780-9faf50f25d81",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.4.242.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T20:05:03.000Z",
      "valid_until": "2026-04-30T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-29T19:23:30.648Z",
      "x_nadsec_last_seen": "2026-03-29T19:23:30.807Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-29T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c2ef6f68-7805-4eb3-9675-4cdd32e39d66",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.150.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T20:05:03.000Z",
      "valid_until": "2026-04-30T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T19:18:35.266Z",
      "x_nadsec_last_seen": "2026-03-29T19:18:55.098Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-29T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=UA; asn=48117; asn_org=Citynet LLC",
      "id": "indicator--62e26d2c-7296-46eb-a095-c0da579038a6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.106.27.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T20:05:03.000Z",
      "valid_until": "2026-04-30T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T19:16:48.474Z",
      "x_nadsec_last_seen": "2026-03-29T19:18:54.481Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UA"
      ],
      "x_nadsec_asns": [
        "48117"
      ],
      "x_nadsec_orgs": [
        "Citynet LLC"
      ]
    },
    {
      "created": "2026-03-29T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--719367e2-a0e2-44d9-bc36-eaef04be074a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T20:05:03.000Z",
      "valid_until": "2026-04-30T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T19:41:36.649Z",
      "x_nadsec_last_seen": "2026-03-29T19:41:36.649Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-29T20:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=209788; asn_org=LLC Cifrovie Seti Urala",
      "id": "indicator--78cbf299-d66b-444a-a160-dc7a67c20c06",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T20:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.183.46.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T20:05:03.000Z",
      "valid_until": "2026-04-30T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T19:21:32.901Z",
      "x_nadsec_last_seen": "2026-03-29T19:23:39.604Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "209788"
      ],
      "x_nadsec_orgs": [
        "LLC Cifrovie Seti Urala"
      ]
    },
    {
      "created": "2026-03-29T21:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=DE; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--39daf3e5-1325-4ee6-a828-8df44e70e204",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T21:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.225.101.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T21:05:26.000Z",
      "valid_until": "2026-04-30T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T20:36:51.439Z",
      "x_nadsec_last_seen": "2026-03-29T20:36:51.439Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "DE"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-29T21:05:26.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--1fd57377-fcf8-4faa-9f72-ba5a9c13ac3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T21:05:26.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T21:05:26.000Z",
      "valid_until": "2026-04-30T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T20:14:55.501Z",
      "x_nadsec_last_seen": "2026-03-29T20:14:55.501Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-29T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--140e707a-2ad7-482b-b80f-f13cda41250e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T22:05:03.000Z",
      "valid_until": "2026-04-30T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T21:35:00.191Z",
      "x_nadsec_last_seen": "2026-03-29T21:35:00.191Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-29T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=2561; asn_org=EUN",
      "id": "indicator--01db9e4a-fd0b-445c-afd7-15ebac6dee2d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.227.11.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T22:05:03.000Z",
      "valid_until": "2026-04-30T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T21:08:08.200Z",
      "x_nadsec_last_seen": "2026-03-29T21:10:14.879Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "2561"
      ],
      "x_nadsec_orgs": [
        "EUN"
      ]
    },
    {
      "created": "2026-03-29T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d85f8f93-648e-4f08-80e8-a653d16a567c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T22:05:03.000Z",
      "valid_until": "2026-04-30T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T21:39:47.132Z",
      "x_nadsec_last_seen": "2026-03-29T21:39:47.132Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-29T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--7e131b56-c30c-42f7-844d-9829130bde7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.26.202.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T22:05:03.000Z",
      "valid_until": "2026-04-30T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T21:59:57.934Z",
      "x_nadsec_last_seen": "2026-03-29T22:02:04.656Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-29T22:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--d69a1006-afde-4881-bd71-efd1dfc70e60",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T22:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.44.196.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T22:05:03.000Z",
      "valid_until": "2026-04-30T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T21:13:13.071Z",
      "x_nadsec_last_seen": "2026-03-29T21:15:19.715Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-29T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=11; services=mssqld; ports=1433; cc=JP; asn=2519; asn_org=ARTERIA Networks Corporation; user(top)=**; pass(top)=!******x",
      "id": "indicator--835d82ca-db37-403a-82a9-512a70b6b5cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.222.113.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T23:05:04.000Z",
      "valid_until": "2026-04-30T23:05:02.000Z",
      "x_nadsec_event_count": 11,
      "x_nadsec_first_seen": "2026-03-29T23:00:39.119Z",
      "x_nadsec_last_seen": "2026-03-29T23:00:52.033Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "2519"
      ],
      "x_nadsec_orgs": [
        "ARTERIA Networks Corporation"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        "!******x"
      ]
    },
    {
      "created": "2026-03-29T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--43781f39-7cce-4f2e-80d2-132b48186ad2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.216.150.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T23:05:04.000Z",
      "valid_until": "2026-04-30T23:05:02.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-29T22:25:46.556Z",
      "x_nadsec_last_seen": "2026-03-29T22:25:56.558Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-29T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EC; asn=22724; asn_org=PUNTONET S.A.",
      "id": "indicator--19ae090d-6c93-484e-bcf5-f68a527c7633",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.49.27.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T23:05:04.000Z",
      "valid_until": "2026-04-30T23:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-29T22:57:09.670Z",
      "x_nadsec_last_seen": "2026-03-29T22:59:15.400Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "22724"
      ],
      "x_nadsec_orgs": [
        "PUNTONET S.A."
      ]
    },
    {
      "created": "2026-03-29T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--61b4f97f-0dd4-4358-b138-d76bbe9f83e6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T23:05:04.000Z",
      "valid_until": "2026-04-30T23:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T22:30:25.191Z",
      "x_nadsec_last_seen": "2026-03-29T22:30:25.191Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-29T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=1916; asn_org=Rede Nacional de Ensino e Pesquisa",
      "id": "indicator--ef153c1c-afbb-4d91-a4b1-44327b577ca0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.137.247.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T23:05:04.000Z",
      "valid_until": "2026-04-30T23:05:02.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-29T22:42:14.237Z",
      "x_nadsec_last_seen": "2026-03-31T21:36:02.848Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "1916"
      ],
      "x_nadsec_orgs": [
        "Rede Nacional de Ensino e Pesquisa"
      ]
    },
    {
      "created": "2026-03-29T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=56041; asn_org=China Mobile communications corporation",
      "id": "indicator--6f089220-e160-419f-9154-281c53c214a0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.170.26.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T23:05:04.000Z",
      "valid_until": "2026-04-30T23:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-29T22:26:55.434Z",
      "x_nadsec_last_seen": "2026-03-29T22:33:21.694Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "56041"
      ],
      "x_nadsec_orgs": [
        "China Mobile communications corporation"
      ]
    },
    {
      "created": "2026-03-29T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--917355fe-5f38-4b46-8f63-ddc8e417f93d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-29T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T23:05:04.000Z",
      "valid_until": "2026-04-30T23:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T22:31:20.659Z",
      "x_nadsec_last_seen": "2026-03-29T22:31:20.659Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-30T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--6f782ac9-13af-4e09-bd15-cd135c30bc3f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.227.36.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T00:05:03.000Z",
      "valid_until": "2026-05-01T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-29T23:19:15.972Z",
      "x_nadsec_last_seen": "2026-03-29T23:19:19.168Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-30T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones; user(top)=**",
      "id": "indicator--24c5c7e5-eb0b-4490-8994-bbd89cc79e68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.25.69.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T00:05:03.000Z",
      "valid_until": "2026-05-01T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-29T23:25:29.163Z",
      "x_nadsec_last_seen": "2026-03-29T23:25:29.163Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "UY"
      ],
      "x_nadsec_asns": [
        "6057"
      ],
      "x_nadsec_orgs": [
        "Administracion Nacional de Telecomunicaciones"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-30T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=EC; asn=27947; asn_org=Telconet S.A",
      "id": "indicator--5a367d86-294a-443e-abe6-b872688efb2c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.4.216.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T00:05:03.000Z",
      "valid_until": "2026-05-01T00:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-29T23:14:56.273Z",
      "x_nadsec_last_seen": "2026-03-29T23:14:56.354Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EC"
      ],
      "x_nadsec_asns": [
        "27947"
      ],
      "x_nadsec_orgs": [
        "Telconet S.A"
      ]
    },
    {
      "created": "2026-03-30T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=KZ; asn=57013; asn_org=Eurasia-Star LLP",
      "id": "indicator--0be3703b-6b95-4c5f-8025-3b1de55c703a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.159.86.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T00:05:03.000Z",
      "valid_until": "2026-05-01T00:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-29T23:35:49.164Z",
      "x_nadsec_last_seen": "2026-03-29T23:42:57.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KZ"
      ],
      "x_nadsec_asns": [
        "57013"
      ],
      "x_nadsec_orgs": [
        "Eurasia-Star LLP"
      ]
    },
    {
      "created": "2026-03-30T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=137172; asn_org=ALL CONNECT NETWORK SERVICES PRIVATE LIMITED",
      "id": "indicator--a0ca4e84-5b7b-4a9c-84b9-4772cd5e0c50",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.112.214.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:05:05.000Z",
      "valid_until": "2026-05-01T01:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-30T00:24:46.554Z",
      "x_nadsec_last_seen": "2026-03-31T08:49:19.837Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "137172"
      ],
      "x_nadsec_orgs": [
        "ALL CONNECT NETWORK SERVICES PRIVATE LIMITED"
      ]
    },
    {
      "created": "2026-03-30T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--3ad044a6-0629-4806-ae92-1a2ece6f696b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.108.117.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:05:05.000Z",
      "valid_until": "2026-05-01T01:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-30T00:05:18.878Z",
      "x_nadsec_last_seen": "2026-03-30T00:05:18.949Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-30T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--b899efe0-0ce6-4280-806f-3648cee4ef1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:05:05.000Z",
      "valid_until": "2026-05-01T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T00:32:49.526Z",
      "x_nadsec_last_seen": "2026-03-30T00:32:49.526Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-30T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=57334; asn_org=SPB State Unitary Enterprise ATS Smolnogo",
      "id": "indicator--565d2590-eb63-429f-9b08-f79845f1af40",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.183.29.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:05:05.000Z",
      "valid_until": "2026-05-01T01:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T00:51:27.456Z",
      "x_nadsec_last_seen": "2026-03-30T01:00:40.403Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "57334"
      ],
      "x_nadsec_orgs": [
        "SPB State Unitary Enterprise ATS Smolnogo"
      ]
    },
    {
      "created": "2026-03-30T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--4f74df4f-f50d-4ba2-bfbe-09f4fcf49d6e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.88.94.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:05:05.000Z",
      "valid_until": "2026-05-01T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T00:57:52.850Z",
      "x_nadsec_last_seen": "2026-03-30T00:57:52.850Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-30T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=6939; asn_org=Hurricane Electric LLC",
      "id": "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:05:05.000Z",
      "valid_until": "2026-05-01T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T00:59:52.391Z",
      "x_nadsec_last_seen": "2026-03-30T00:59:52.391Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "6939"
      ],
      "x_nadsec_orgs": [
        "Hurricane Electric LLC"
      ]
    },
    {
      "created": "2026-03-30T01:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=GB; asn=211298; asn_org=Driftnet Ltd",
      "id": "indicator--b82ee419-404e-4abb-baa2-f3312c627278",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T01:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:05:05.000Z",
      "valid_until": "2026-05-01T01:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T00:38:27.503Z",
      "x_nadsec_last_seen": "2026-03-30T00:38:27.503Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "211298"
      ],
      "x_nadsec_orgs": [
        "Driftnet Ltd"
      ]
    },
    {
      "created": "2026-03-30T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=18881; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--d0339af6-18b8-46be-b1a3-2a92a75a7e99",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '177.41.61.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T02:05:03.000Z",
      "valid_until": "2026-05-01T02:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-30T01:06:13.292Z",
      "x_nadsec_last_seen": "2026-03-30T01:11:46.964Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "18881"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-30T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=AR; asn=27964; asn_org=RSO APOLO HIDALGO S.R.L.",
      "id": "indicator--99c29f3b-fcb7-429e-ba40-6a125cd5591d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.4.107.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T02:05:03.000Z",
      "valid_until": "2026-05-01T02:05:00.000Z",
      "x_nadsec_event_count": 10,
      "x_nadsec_first_seen": "2026-03-30T01:12:27.085Z",
      "x_nadsec_last_seen": "2026-03-30T02:47:25.517Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27964"
      ],
      "x_nadsec_orgs": [
        "RSO APOLO HIDALGO S.R.L."
      ]
    },
    {
      "created": "2026-03-30T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--e9d8cec7-0a8d-4551-8d8d-8af360aec934",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.29.23.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T02:05:03.000Z",
      "valid_until": "2026-05-01T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T01:19:33.434Z",
      "x_nadsec_last_seen": "2026-03-30T01:19:33.434Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-30T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--8292c505-0652-495c-9e58-6f56cf87c142",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.239.127.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T02:05:03.000Z",
      "valid_until": "2026-05-01T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T01:42:12.744Z",
      "x_nadsec_last_seen": "2026-03-30T01:44:18.092Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-30T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--21950104-d0e0-49b5-be6e-65cd710f3f2a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T02:05:03.000Z",
      "valid_until": "2026-05-01T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T01:32:56.622Z",
      "x_nadsec_last_seen": "2026-03-30T01:32:56.622Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-30T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=45; services=smbd; ports=445; cc=ID; asn=150532; asn_org=Korpolairud Baharkam Polri",
      "id": "indicator--7736ab49-b026-478d-a487-06710a98d92b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.151.24.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:05:03.000Z",
      "valid_until": "2026-05-01T03:05:01.000Z",
      "x_nadsec_event_count": 3147,
      "x_nadsec_first_seen": "2026-03-30T02:15:12.694Z",
      "x_nadsec_last_seen": "2026-03-30T05:32:16.036Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "150532"
      ],
      "x_nadsec_orgs": [
        "Korpolairud Baharkam Polri"
      ]
    },
    {
      "created": "2026-03-30T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=139554; asn_org=Young Brain India",
      "id": "indicator--265baa2f-960a-4be6-9870-85d3453c57eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.163.59.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:05:03.000Z",
      "valid_until": "2026-05-01T03:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-30T02:49:03.305Z",
      "x_nadsec_last_seen": "2026-03-30T03:08:14.414Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "139554"
      ],
      "x_nadsec_orgs": [
        "Young Brain India"
      ]
    },
    {
      "created": "2026-03-30T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--98ee8471-a8b1-43f1-a553-64e1df1622af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.185.110.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:05:03.000Z",
      "valid_until": "2026-05-01T03:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-30T02:38:41.566Z",
      "x_nadsec_last_seen": "2026-03-30T02:39:09.728Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-30T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--c2bcabb6-41af-4789-b8f7-3ef5228baa95",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.52.248.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:05:03.000Z",
      "valid_until": "2026-05-01T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T02:13:57.480Z",
      "x_nadsec_last_seen": "2026-03-30T02:16:03.893Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-30T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=8443; asn_org=Rostelecom",
      "id": "indicator--ad3fa7f1-9904-49d0-9d02-2a4e8fb812b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.72.228.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:05:03.000Z",
      "valid_until": "2026-05-01T03:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-30T02:12:37.121Z",
      "x_nadsec_last_seen": "2026-03-30T02:14:42.195Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8443"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-30T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=JP; asn=17676; asn_org=SoftBank Corp.",
      "id": "indicator--0dcc83f0-947b-4cc1-b916-c28a5b4edd7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.99.166.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:05:03.000Z",
      "valid_until": "2026-05-01T03:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T02:52:42.244Z",
      "x_nadsec_last_seen": "2026-03-30T02:54:47.573Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "17676"
      ],
      "x_nadsec_orgs": [
        "SoftBank Corp."
      ]
    },
    {
      "created": "2026-03-30T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--c6d3c120-9920-4145-a08d-f9e037dab1ff",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '97.107.132.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:05:03.000Z",
      "valid_until": "2026-05-01T03:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T02:50:36.291Z",
      "x_nadsec_last_seen": "2026-03-30T02:50:36.291Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-30T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MN; asn=17882; asn_org=UNIVISION LLC",
      "id": "indicator--ba231d03-ad27-41ba-b4a8-4189252ca0ea",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.57.94.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:05:03.000Z",
      "valid_until": "2026-05-01T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T03:24:35.010Z",
      "x_nadsec_last_seen": "2026-03-30T03:26:42.322Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MN"
      ],
      "x_nadsec_asns": [
        "17882"
      ],
      "x_nadsec_orgs": [
        "UNIVISION LLC"
      ]
    },
    {
      "created": "2026-03-30T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ZA; asn=37457; asn_org=Telkom-Internet",
      "id": "indicator--0009b5ee-7c38-4316-8184-946a596ad208",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '105.186.214.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:05:03.000Z",
      "valid_until": "2026-05-01T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T03:30:35.260Z",
      "x_nadsec_last_seen": "2026-03-30T03:47:55.055Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "37457"
      ],
      "x_nadsec_orgs": [
        "Telkom-Internet"
      ]
    },
    {
      "created": "2026-03-30T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--f81806f2-aa62-40d8-8949-86e48664e7c8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.134.188.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:05:03.000Z",
      "valid_until": "2026-05-01T04:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T03:14:51.899Z",
      "x_nadsec_last_seen": "2026-03-30T03:21:54.470Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-03-30T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4216f86f-e279-432e-aad1-d68537c0eee4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.161.32.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:05:03.000Z",
      "valid_until": "2026-05-01T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T03:46:45.527Z",
      "x_nadsec_last_seen": "2026-03-30T03:48:50.286Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-30T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--8cd0a9c3-4839-4107-9de1-4c188663a4dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.92.71.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:05:03.000Z",
      "valid_until": "2026-05-01T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T03:44:21.988Z",
      "x_nadsec_last_seen": "2026-03-30T03:46:29.822Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    },
    {
      "created": "2026-03-30T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--a787b73c-0f97-43ba-b238-2d8815d3fc1a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.71.208.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:05:03.000Z",
      "valid_until": "2026-05-01T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T03:20:55.087Z",
      "x_nadsec_last_seen": "2026-03-30T03:23:00.338Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-30T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--dc110ba1-851b-4da2-9974-8505722a56ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.209.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:05:03.000Z",
      "valid_until": "2026-05-01T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T03:11:03.343Z",
      "x_nadsec_last_seen": "2026-03-30T03:13:08.115Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-30T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--5151c88e-fde9-4fc1-8fac-7de6d835fdb1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.241.70.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:05:03.000Z",
      "valid_until": "2026-05-01T04:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T03:13:38.221Z",
      "x_nadsec_last_seen": "2026-03-30T03:15:44.478Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-30T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--006ac6d7-d206-45a7-9291-9846d9b7e022",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.60.243.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:05:03.000Z",
      "valid_until": "2026-05-01T04:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T03:59:54.329Z",
      "x_nadsec_last_seen": "2026-03-30T04:09:49.125Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-30T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--f1381559-e52b-4710-b0c5-d53912475ca6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:05:03.000Z",
      "valid_until": "2026-05-01T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T03:30:36.430Z",
      "x_nadsec_last_seen": "2026-03-30T03:30:36.430Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-30T04:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9c936ead-5f5b-4243-8e59-43b128148cba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T04:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:05:03.000Z",
      "valid_until": "2026-05-01T04:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T03:23:18.963Z",
      "x_nadsec_last_seen": "2026-03-30T03:23:18.963Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-30T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=30; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--5492494a-5bd2-424a-a525-8468c3d05633",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.248.63.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:05:03.000Z",
      "valid_until": "2026-05-01T05:05:01.000Z",
      "x_nadsec_event_count": 31,
      "x_nadsec_first_seen": "2026-03-30T04:05:00.710Z",
      "x_nadsec_last_seen": "2026-03-30T04:07:49.354Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-30T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--298c9895-4d5a-420f-9731-dcee96b62c85",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:05:03.000Z",
      "valid_until": "2026-05-01T05:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-30T04:08:25.832Z",
      "x_nadsec_last_seen": "2026-03-30T04:08:26.644Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-30T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=ZA; asn=327750; asn_org=JENNY-INTERNET",
      "id": "indicator--c2fc0c94-7e3e-4c8a-9ca9-32bd16b790ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.126.208.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:05:03.000Z",
      "valid_until": "2026-05-01T05:05:01.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-03-30T04:30:11.458Z",
      "x_nadsec_last_seen": "2026-03-30T04:32:57.734Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZA"
      ],
      "x_nadsec_asns": [
        "327750"
      ],
      "x_nadsec_orgs": [
        "JENNY-INTERNET"
      ]
    },
    {
      "created": "2026-03-30T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=4796; asn_org=Institute of Technology Bandung",
      "id": "indicator--a2359985-b761-456f-ba0b-b1bb6cdde12d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.205.0.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:05:03.000Z",
      "valid_until": "2026-05-01T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-30T04:44:37.169Z",
      "x_nadsec_last_seen": "2026-03-30T04:44:40.630Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4796"
      ],
      "x_nadsec_orgs": [
        "Institute of Technology Bandung"
      ]
    },
    {
      "created": "2026-03-30T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e1e58ee0-3f81-429c-8e7b-589d7c8f278b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:05:03.000Z",
      "valid_until": "2026-05-01T05:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T04:36:06.769Z",
      "x_nadsec_last_seen": "2026-03-30T21:04:15.167Z",
      "x_nadsec_ports": [
        "135",
        "1883"
      ],
      "x_nadsec_services": [
        "epmapper",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-30T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--f0b26935-32e4-413e-930e-034c39369952",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.63.203.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:05:03.000Z",
      "valid_until": "2026-05-01T05:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-30T04:44:31.431Z",
      "x_nadsec_last_seen": "2026-03-30T04:44:31.778Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-30T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=17639; asn_org=Converge ICT Solutions Inc.",
      "id": "indicator--afac38ff-dfa2-4404-adc9-1f9c103b083e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.49.56.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:05:03.000Z",
      "valid_until": "2026-05-01T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T04:50:11.645Z",
      "x_nadsec_last_seen": "2026-03-30T04:52:16.045Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "17639"
      ],
      "x_nadsec_orgs": [
        "Converge ICT Solutions Inc."
      ]
    },
    {
      "created": "2026-03-30T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14061; asn_org=DigitalOcean, LLC; user(top)=c**n",
      "id": "indicator--97c107e8-688f-4da3-a4d8-6b137a5df46b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.55.194.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:05:03.000Z",
      "valid_until": "2026-05-01T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T04:57:32.580Z",
      "x_nadsec_last_seen": "2026-03-30T04:57:32.580Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "c**n"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-30T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24309; asn_org=Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA",
      "id": "indicator--28b51de5-8d39-4cd3-ba12-6b72290cb9a8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.207.245.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:05:03.000Z",
      "valid_until": "2026-05-01T05:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T04:42:15.141Z",
      "x_nadsec_last_seen": "2026-03-30T04:44:20.823Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24309"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA"
      ]
    },
    {
      "created": "2026-03-30T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--b2e2f245-36ab-46c3-aaef-b85ad2833001",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:05:03.000Z",
      "valid_until": "2026-05-01T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T04:34:14.736Z",
      "x_nadsec_last_seen": "2026-03-30T04:34:14.736Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-30T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--743c51f8-5cde-4cf9-94dc-1404699abcf0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:05:03.000Z",
      "valid_until": "2026-05-01T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T04:23:51.889Z",
      "x_nadsec_last_seen": "2026-03-30T04:23:51.889Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-30T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--d3390ac3-7167-45e8-9b59-14d7a1c25957",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:05:03.000Z",
      "valid_until": "2026-05-01T05:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T04:19:44.272Z",
      "x_nadsec_last_seen": "2026-03-30T04:19:44.272Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-30T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9f3e13f6-3587-4f5b-a7d1-0c2cce809fda",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.2.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T06:05:03.000Z",
      "valid_until": "2026-05-01T06:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-30T06:04:31.138Z",
      "x_nadsec_last_seen": "2026-03-30T06:06:45.912Z",
      "x_nadsec_ports": [
        "21",
        "81",
        "135",
        "445",
        "1433",
        "1883",
        "3306",
        "27017"
      ],
      "x_nadsec_services": [
        "epmapper",
        "ftpd",
        "httpd",
        "mongod",
        "mqttd",
        "mssqld",
        "mysqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-30T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--95922197-b292-4928-aed2-9c2e3b495108",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.88.16.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T06:05:03.000Z",
      "valid_until": "2026-05-01T06:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-30T05:37:58.538Z",
      "x_nadsec_last_seen": "2026-03-30T05:37:58.593Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-30T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--a5260646-6319-4083-82e1-6bee1eb585de",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.113.154.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T06:05:03.000Z",
      "valid_until": "2026-05-01T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T05:48:03.315Z",
      "x_nadsec_last_seen": "2026-03-30T05:50:08.512Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-30T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=mirrorc; ports=45621; cc=SC; asn=210006; asn_org=Shereverov Marat Ahmedovich",
      "id": "indicator--a5374ba4-0c5a-44de-a954-46d103a10583",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.87.249.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T06:05:03.000Z",
      "valid_until": "2026-05-01T06:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-30T05:14:26.168Z",
      "x_nadsec_last_seen": "2026-03-31T03:06:35.822Z",
      "x_nadsec_ports": [
        "42",
        "33031",
        "43245",
        "45621"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "210006"
      ],
      "x_nadsec_orgs": [
        "Shereverov Marat Ahmedovich"
      ]
    },
    {
      "created": "2026-03-30T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--d80d57ac-f837-4057-a8ab-9223054f3151",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T06:05:03.000Z",
      "valid_until": "2026-05-01T06:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T05:31:38.762Z",
      "x_nadsec_last_seen": "2026-03-30T05:31:38.762Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-30T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--36e2293e-9d85-4dd9-9898-e6f07faef940",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.208.126.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T06:05:03.000Z",
      "valid_until": "2026-05-01T06:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T05:14:40.753Z",
      "x_nadsec_last_seen": "2026-03-30T05:16:47.450Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-30T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=9121; asn_org=Turk Telekom",
      "id": "indicator--a8d41972-383d-42a6-992b-9a3c1f680f7c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.9.191.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T06:05:03.000Z",
      "valid_until": "2026-05-01T06:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T05:29:52.227Z",
      "x_nadsec_last_seen": "2026-03-30T05:36:56.687Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "9121"
      ],
      "x_nadsec_orgs": [
        "Turk Telekom"
      ]
    },
    {
      "created": "2026-03-30T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--2b808a2a-6955-4093-8045-c1f669609d83",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T07:05:03.000Z",
      "valid_until": "2026-05-01T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T06:46:10.789Z",
      "x_nadsec_last_seen": "2026-03-30T06:46:10.789Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-30T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14987; asn_org=Rethem Hosting LLC",
      "id": "indicator--8e71ffee-5471-4ccf-8929-0a64e3c22567",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T07:05:03.000Z",
      "valid_until": "2026-05-01T07:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T06:46:25.552Z",
      "x_nadsec_last_seen": "2026-03-30T06:46:25.552Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14987"
      ],
      "x_nadsec_orgs": [
        "Rethem Hosting LLC"
      ]
    },
    {
      "created": "2026-03-30T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=44; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--7d02abb2-78f4-4d6f-b9f8-b413f88cba36",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.160.221.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T07:05:03.000Z",
      "valid_until": "2026-05-01T07:05:01.000Z",
      "x_nadsec_event_count": 44,
      "x_nadsec_first_seen": "2026-03-30T06:39:06.601Z",
      "x_nadsec_last_seen": "2026-03-30T06:41:02.178Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-30T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PE; asn=12252; asn_org=America Movil Peru S.A.C.",
      "id": "indicator--54aa4603-cfa0-43eb-bd64-9e66dd3b79da",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.116.60.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T07:05:03.000Z",
      "valid_until": "2026-05-01T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T06:32:05.466Z",
      "x_nadsec_last_seen": "2026-03-30T06:36:21.728Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "12252"
      ],
      "x_nadsec_orgs": [
        "America Movil Peru S.A.C."
      ]
    },
    {
      "created": "2026-03-30T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--49dd85ea-94eb-4dbc-be0b-1e1832de3174",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.102.117.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T07:05:03.000Z",
      "valid_until": "2026-05-01T07:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-30T06:09:56.001Z",
      "x_nadsec_last_seen": "2026-03-30T06:09:56.460Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-30T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e411e6d3-f402-425f-9888-3fbfca5097eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T07:05:03.000Z",
      "valid_until": "2026-05-01T07:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-30T06:24:02.261Z",
      "x_nadsec_last_seen": "2026-03-30T06:24:03.476Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-30T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=KE; asn=36914; asn_org=Kenya Education Network",
      "id": "indicator--54d83fa3-de87-4c31-b7e6-523e84689280",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.89.98.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T07:05:03.000Z",
      "valid_until": "2026-05-01T07:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T06:19:54.932Z",
      "x_nadsec_last_seen": "2026-03-30T06:22:03.084Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "36914"
      ],
      "x_nadsec_orgs": [
        "Kenya Education Network"
      ]
    },
    {
      "created": "2026-03-30T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=13; services=mysqld; ports=3306; cc=MM; asn=136474; asn_org=Marga Global Telecom Limited",
      "id": "indicator--3ee5ff9d-dd40-453d-8073-f21d5fac2aa5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.156.32.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T07:05:03.000Z",
      "valid_until": "2026-05-01T07:05:01.000Z",
      "x_nadsec_event_count": 13,
      "x_nadsec_first_seen": "2026-03-30T06:42:23.230Z",
      "x_nadsec_last_seen": "2026-03-30T06:42:24.263Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "MM"
      ],
      "x_nadsec_asns": [
        "136474"
      ],
      "x_nadsec_orgs": [
        "Marga Global Telecom Limited"
      ]
    },
    {
      "created": "2026-03-30T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=70; services=mysqld; ports=3306; cc=CN; asn=4134; asn_org=Chinanet; user(top)=r**t",
      "id": "indicator--420350ba-21b9-4aa3-916c-9cbf367d0aba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.97.218.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T08:05:04.000Z",
      "valid_until": "2026-05-01T08:05:01.000Z",
      "x_nadsec_event_count": 70,
      "x_nadsec_first_seen": "2026-03-30T07:57:27.602Z",
      "x_nadsec_last_seen": "2026-03-30T07:59:36.304Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-30T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=KH; asn=38600; asn_org=SMART AXIATA Co., Ltd.",
      "id": "indicator--697cce24-05ba-4e07-aa81-4993024d0623",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.56.3.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T08:05:04.000Z",
      "valid_until": "2026-05-01T08:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-30T07:43:24.522Z",
      "x_nadsec_last_seen": "2026-03-30T07:43:24.615Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KH"
      ],
      "x_nadsec_asns": [
        "38600"
      ],
      "x_nadsec_orgs": [
        "SMART AXIATA Co., Ltd."
      ]
    },
    {
      "created": "2026-03-30T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=17426; asn_org=Primesoftex Ltd",
      "id": "indicator--f1ae04ed-3a0a-4943-acd3-f7d70560fbc0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.115.96.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T08:05:04.000Z",
      "valid_until": "2026-05-01T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T07:39:06.013Z",
      "x_nadsec_last_seen": "2026-03-30T07:41:10.876Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "17426"
      ],
      "x_nadsec_orgs": [
        "Primesoftex Ltd"
      ]
    },
    {
      "created": "2026-03-30T08:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=KG; asn=12997; asn_org=OJSC Kyrgyztelecom",
      "id": "indicator--033edbb1-5a65-42ed-be2e-b783036ca929",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T08:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.113.17.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T08:05:04.000Z",
      "valid_until": "2026-05-01T08:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T07:58:12.514Z",
      "x_nadsec_last_seen": "2026-03-30T08:00:19.554Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KG"
      ],
      "x_nadsec_asns": [
        "12997"
      ],
      "x_nadsec_orgs": [
        "OJSC Kyrgyztelecom"
      ]
    },
    {
      "created": "2026-03-30T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=45773; asn_org=PERN AS Content Servie Provider, Islamabad, Pakistan",
      "id": "indicator--22a8052e-ff89-483a-87e4-39b96913e5c5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.52.153.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T09:05:04.000Z",
      "valid_until": "2026-05-01T09:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T08:35:25.305Z",
      "x_nadsec_last_seen": "2026-03-30T08:35:30.658Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "45773"
      ],
      "x_nadsec_orgs": [
        "PERN AS Content Servie Provider, Islamabad, Pakistan"
      ]
    },
    {
      "created": "2026-03-30T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=9299; asn_org=Philippine Long Distance Telephone Company",
      "id": "indicator--7af51894-a7ad-4be4-b51e-943fc1d33db9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.105.76.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T09:05:04.000Z",
      "valid_until": "2026-05-01T09:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T08:10:38.571Z",
      "x_nadsec_last_seen": "2026-03-30T08:12:43.321Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "9299"
      ],
      "x_nadsec_orgs": [
        "Philippine Long Distance Telephone Company"
      ]
    },
    {
      "created": "2026-03-30T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--8cd54ffa-f4e6-4179-9bbc-455a371f0f5e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T09:05:04.000Z",
      "valid_until": "2026-05-01T09:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T08:26:47.955Z",
      "x_nadsec_last_seen": "2026-03-30T08:26:47.955Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-30T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=IT; asn=12874; asn_org=Fastweb",
      "id": "indicator--a2c5669b-cec7-406f-bc64-504cdb1cfb16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '151.0.135.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T09:05:04.000Z",
      "valid_until": "2026-05-01T09:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T09:04:24.327Z",
      "x_nadsec_last_seen": "2026-03-30T09:06:30.706Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "12874"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-03-30T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=17451; asn_org=BIZNET NETWORKS",
      "id": "indicator--da8f70c7-3c8e-4f30-ad81-0983a8f1f7d5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.253.191.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T09:05:04.000Z",
      "valid_until": "2026-05-01T09:05:02.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T08:47:09.721Z",
      "x_nadsec_last_seen": "2026-03-30T08:49:13.981Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17451"
      ],
      "x_nadsec_orgs": [
        "BIZNET NETWORKS"
      ]
    },
    {
      "created": "2026-03-30T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CL; asn=14259; asn_org=Gtd Internet S.A.; user(top)=**",
      "id": "indicator--d96c08c3-02b1-4237-8437-82ea4c96ca5d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.238.213.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T09:05:04.000Z",
      "valid_until": "2026-05-01T09:05:02.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T08:50:44.849Z",
      "x_nadsec_last_seen": "2026-03-30T08:50:44.849Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CL"
      ],
      "x_nadsec_asns": [
        "14259"
      ],
      "x_nadsec_orgs": [
        "Gtd Internet S.A."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-30T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--59f384ea-d33b-4561-a6bf-7a4fc7db4ddf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.114.85.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T09:05:04.000Z",
      "valid_until": "2026-05-01T09:05:02.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T08:47:31.497Z",
      "x_nadsec_last_seen": "2026-03-30T08:54:12.085Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-30T09:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=8402; asn_org=PVimpelCom",
      "id": "indicator--afe9bdda-e22a-4c64-81e3-1a3c2782441d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T09:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.27.133.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T09:05:04.000Z",
      "valid_until": "2026-05-01T09:05:02.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-30T09:03:00.862Z",
      "x_nadsec_last_seen": "2026-03-30T09:38:19.111Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8402"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-03-30T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--1e8ba9be-6a40-4b99-a525-94f14717cec3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.33.76.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T10:05:03.000Z",
      "valid_until": "2026-05-01T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T09:26:21.194Z",
      "x_nadsec_last_seen": "2026-03-30T09:28:25.855Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-30T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--ab164e4c-0160-4159-b2c6-eb06fff43ba2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.230.208.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T10:05:03.000Z",
      "valid_until": "2026-05-01T10:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T09:38:34.309Z",
      "x_nadsec_last_seen": "2026-03-30T09:38:34.309Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-30T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--d728544f-64d8-4216-9b70-8007aa233bc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.188.193.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T10:05:03.000Z",
      "valid_until": "2026-05-01T10:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-30T09:36:30.034Z",
      "x_nadsec_last_seen": "2026-03-30T09:38:35.542Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "22884"
      ],
      "x_nadsec_orgs": [
        "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
      ]
    },
    {
      "created": "2026-03-30T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--73e5f5c2-fe73-4caf-855c-00d1930c52ef",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.202.86.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T10:05:03.000Z",
      "valid_until": "2026-05-01T10:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T09:21:53.755Z",
      "x_nadsec_last_seen": "2026-03-30T09:24:00.494Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-30T10:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=ftpd; ports=21; cc=AU; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--ce9acd48-bb0c-48d6-8d6d-c8e6594255e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T10:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '209.38.92.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T10:05:03.000Z",
      "valid_until": "2026-05-01T10:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-30T09:41:44.883Z",
      "x_nadsec_last_seen": "2026-03-30T09:41:45.090Z",
      "x_nadsec_ports": [
        "21",
        "445",
        "1433",
        "1723"
      ],
      "x_nadsec_services": [
        "ftpd",
        "smbd",
        "mssqld",
        "pptpd"
      ],
      "x_nadsec_countries": [
        "AU"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-30T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=138089; asn_org=PT.Global Media Data Prima",
      "id": "indicator--78f696d6-87f0-4b5a-a54d-c876a6e15eed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.20.244.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T11:05:05.000Z",
      "valid_until": "2026-05-01T11:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-30T10:30:42.905Z",
      "x_nadsec_last_seen": "2026-03-30T10:37:03.649Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "138089"
      ],
      "x_nadsec_orgs": [
        "PT.Global Media Data Prima"
      ]
    },
    {
      "created": "2026-03-30T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=138089; asn_org=PT.Global Media Data Prima",
      "id": "indicator--02f75585-e5ff-40aa-b95d-df8dd534d414",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.20.244.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T11:05:05.000Z",
      "valid_until": "2026-05-01T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T10:34:57.831Z",
      "x_nadsec_last_seen": "2026-03-30T10:34:57.831Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "138089"
      ],
      "x_nadsec_orgs": [
        "PT.Global Media Data Prima"
      ]
    },
    {
      "created": "2026-03-30T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=138089; asn_org=PT.Global Media Data Prima",
      "id": "indicator--3d83f3e9-1aad-4ec3-8287-8c1db5763615",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.20.244.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T11:05:05.000Z",
      "valid_until": "2026-05-01T11:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T10:34:57.951Z",
      "x_nadsec_last_seen": "2026-03-30T10:34:57.951Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "138089"
      ],
      "x_nadsec_orgs": [
        "PT.Global Media Data Prima"
      ]
    },
    {
      "created": "2026-03-30T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31133; asn_org=PJSC MegaFon",
      "id": "indicator--e96b562e-94d4-49b1-afe8-693216a30b16",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.176.230.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T11:05:05.000Z",
      "valid_until": "2026-05-01T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T10:23:49.838Z",
      "x_nadsec_last_seen": "2026-03-30T10:25:56.813Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31133"
      ],
      "x_nadsec_orgs": [
        "PJSC MegaFon"
      ]
    },
    {
      "created": "2026-03-30T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--96f80691-1a48-45de-9df2-b9b5dcae5fad",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.181.125.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T11:05:05.000Z",
      "valid_until": "2026-05-01T11:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T10:34:45.171Z",
      "x_nadsec_last_seen": "2026-03-30T10:41:38.179Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-30T11:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IL; asn=8551; asn_org=Bezeq International Ltd.",
      "id": "indicator--a3d460ad-b179-403b-96c1-004edf015021",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T11:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.219.1.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T11:05:05.000Z",
      "valid_until": "2026-05-01T11:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T11:01:11.099Z",
      "x_nadsec_last_seen": "2026-03-30T11:03:18.658Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IL"
      ],
      "x_nadsec_asns": [
        "8551"
      ],
      "x_nadsec_orgs": [
        "Bezeq International Ltd."
      ]
    },
    {
      "created": "2026-03-30T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--4a13c201-37f9-4948-a670-f2807bd94819",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.90.98.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:05:03.000Z",
      "valid_until": "2026-05-01T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T11:50:18.518Z",
      "x_nadsec_last_seen": "2026-03-30T11:52:26.189Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-30T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--76a9fb15-ab01-4ad8-8aaf-e4e7941c5883",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.116.178.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:05:03.000Z",
      "valid_until": "2026-05-01T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T11:29:17.524Z",
      "x_nadsec_last_seen": "2026-03-30T11:31:22.271Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-30T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=15; services=epmapper; ports=135; cc=JP; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--b8a6823d-73c0-4d52-9b0f-d53e1d12a5af",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.202.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:05:03.000Z",
      "valid_until": "2026-05-01T12:05:01.000Z",
      "x_nadsec_event_count": 15,
      "x_nadsec_first_seen": "2026-03-30T11:15:41.855Z",
      "x_nadsec_last_seen": "2026-03-30T11:37:01.801Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "JP"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-30T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=51669; asn_org=Home Computer Networks ltd.",
      "id": "indicator--9ff7a660-d35a-443e-9d80-a61d926b1e38",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.120.176.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:05:03.000Z",
      "valid_until": "2026-05-01T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T11:18:24.775Z",
      "x_nadsec_last_seen": "2026-03-30T11:20:31.231Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "51669"
      ],
      "x_nadsec_orgs": [
        "Home Computer Networks ltd."
      ]
    },
    {
      "created": "2026-03-30T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--07ec2da2-7568-4df3-b464-3e8192d781e2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.211.20.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:05:03.000Z",
      "valid_until": "2026-05-01T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T11:56:11.724Z",
      "x_nadsec_last_seen": "2026-03-30T11:58:19.202Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-30T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--b0c29e69-5070-4358-ac47-9088e798fca0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '186.57.108.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:05:03.000Z",
      "valid_until": "2026-05-01T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T12:02:04.662Z",
      "x_nadsec_last_seen": "2026-03-30T12:04:12.410Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-30T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TR; asn=34984; asn_org=Superonline Iletisim Hizmetleri A.S.",
      "id": "indicator--2f28efec-1607-41c8-8c78-7d488c45d062",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.14.105.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:05:03.000Z",
      "valid_until": "2026-05-01T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T11:08:05.626Z",
      "x_nadsec_last_seen": "2026-03-30T11:10:12.165Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "34984"
      ],
      "x_nadsec_orgs": [
        "Superonline Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-30T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3002; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--02122243-8b70-4c2f-810b-5c3c3295c5ba",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.60.165.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:05:03.000Z",
      "valid_until": "2026-05-01T12:05:01.000Z",
      "x_nadsec_event_count": 3002,
      "x_nadsec_first_seen": "2026-03-30T11:12:56.501Z",
      "x_nadsec_last_seen": "2026-03-30T11:59:36.741Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-30T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--28701139-e8dc-4bd4-be58-27fc66f3a690",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '8.138.154.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:05:03.000Z",
      "valid_until": "2026-05-01T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T11:47:42.062Z",
      "x_nadsec_last_seen": "2026-03-30T11:47:42.062Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "37963"
      ],
      "x_nadsec_orgs": [
        "Hangzhou Alibaba Advertising Co.,Ltd."
      ]
    },
    {
      "created": "2026-03-30T12:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=47524; asn_org=Turksat Uydu Haberlesme ve Kablo TV Isletme A.S.",
      "id": "indicator--30e6e3fd-2e2c-422e-804f-dafef23e2fcb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T12:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.54.130.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T12:05:03.000Z",
      "valid_until": "2026-05-01T12:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T11:16:26.129Z",
      "x_nadsec_last_seen": "2026-03-30T11:23:44.201Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "47524"
      ],
      "x_nadsec_orgs": [
        "Turksat Uydu Haberlesme ve Kablo TV Isletme A.S."
      ]
    },
    {
      "created": "2026-03-30T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=134329; asn_org=Shree rajrajeshwar communication pvt. ltd.",
      "id": "indicator--f3fd30e2-b5e6-41ef-827f-c447dcd7c80a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.62.16.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:05:04.000Z",
      "valid_until": "2026-05-01T13:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T12:37:16.132Z",
      "x_nadsec_last_seen": "2026-03-30T12:39:23.995Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "134329"
      ],
      "x_nadsec_orgs": [
        "Shree rajrajeshwar communication pvt. ltd."
      ]
    },
    {
      "created": "2026-03-30T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=9905; asn_org=Linknet ASN",
      "id": "indicator--fe4dd6c9-29b9-4755-8e38-ac2dcb3e7576",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.0.28.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:05:04.000Z",
      "valid_until": "2026-05-01T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T12:35:32.293Z",
      "x_nadsec_last_seen": "2026-03-30T12:40:40.520Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9905"
      ],
      "x_nadsec_orgs": [
        "Linknet ASN"
      ]
    },
    {
      "created": "2026-03-30T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CO; asn=14080; asn_org=Telmex Colombia S.A.",
      "id": "indicator--a999fc52-b46b-4885-8634-e79d34969bc3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.145.43.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:05:04.000Z",
      "valid_until": "2026-05-01T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T13:01:21.051Z",
      "x_nadsec_last_seen": "2026-03-30T13:08:15.616Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CO"
      ],
      "x_nadsec_asns": [
        "14080"
      ],
      "x_nadsec_orgs": [
        "Telmex Colombia S.A."
      ]
    },
    {
      "created": "2026-03-30T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--9fe40dc0-1eef-40ba-b4cf-e7737cadc621",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:05:04.000Z",
      "valid_until": "2026-05-01T13:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T12:31:41.349Z",
      "x_nadsec_last_seen": "2026-03-30T12:31:41.349Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-30T13:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--154c5cf2-d870-4f10-a729-13f76966e19f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T13:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.175.81.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:05:04.000Z",
      "valid_until": "2026-05-01T13:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T12:33:13.523Z",
      "x_nadsec_last_seen": "2026-03-30T12:42:56.868Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-30T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--dd9d5c03-ba6c-4a39-85b0-11da3e7425a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.233.112.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:05:03.000Z",
      "valid_until": "2026-05-01T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-30T13:26:30.140Z",
      "x_nadsec_last_seen": "2026-03-30T13:26:30.912Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-30T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A; user(top)=**",
      "id": "indicator--e96b3baa-ae14-4b26-b1ba-b919167e2522",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.75.152.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:05:03.000Z",
      "valid_until": "2026-05-01T14:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T13:50:32.206Z",
      "x_nadsec_last_seen": "2026-03-30T13:50:32.206Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "27699"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-30T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ET; asn=24757; asn_org=Ethiopian Telecommunication Corporation",
      "id": "indicator--896df6f6-ad03-4fee-bc48-701ac60b7b93",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '196.189.130.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:05:03.000Z",
      "valid_until": "2026-05-01T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T13:34:23.971Z",
      "x_nadsec_last_seen": "2026-03-30T13:41:36.450Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ET"
      ],
      "x_nadsec_asns": [
        "24757"
      ],
      "x_nadsec_orgs": [
        "Ethiopian Telecommunication Corporation"
      ]
    },
    {
      "created": "2026-03-30T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--bf1b9def-ff0c-4015-9477-2d81adea6427",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:05:03.000Z",
      "valid_until": "2026-05-01T14:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-30T13:35:12.276Z",
      "x_nadsec_last_seen": "2026-03-30T13:35:22.436Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-30T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NZ; asn=4771; asn_org=Spark New Zealand Trading Ltd.",
      "id": "indicator--8740d3b4-23d0-484c-84e3-3bec255abd1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '219.89.81.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:05:03.000Z",
      "valid_until": "2026-05-01T14:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T13:05:35.650Z",
      "x_nadsec_last_seen": "2026-03-30T13:07:38.982Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NZ"
      ],
      "x_nadsec_asns": [
        "4771"
      ],
      "x_nadsec_orgs": [
        "Spark New Zealand Trading Ltd."
      ]
    },
    {
      "created": "2026-03-30T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=11232; asn_org=Midcontinent Communications",
      "id": "indicator--622683ea-2cc3-4923-ae7c-6f598c51c7a3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '24.220.59.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:05:03.000Z",
      "valid_until": "2026-05-01T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T14:01:17.197Z",
      "x_nadsec_last_seen": "2026-03-30T14:08:01.072Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "11232"
      ],
      "x_nadsec_orgs": [
        "Midcontinent Communications"
      ]
    },
    {
      "created": "2026-03-30T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=IN; asn=131269; asn_org=Atria Convergence Technologies Ltd.",
      "id": "indicator--1be6a17f-7f51-4257-9859-c40d8f423e3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.206.113.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:05:03.000Z",
      "valid_until": "2026-05-01T14:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T13:37:20.420Z",
      "x_nadsec_last_seen": "2026-03-30T13:44:00.181Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "131269"
      ],
      "x_nadsec_orgs": [
        "Atria Convergence Technologies Ltd."
      ]
    },
    {
      "created": "2026-03-30T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=RU; asn=8732; asn_org=JSC Comcor",
      "id": "indicator--2e912811-23a2-49f7-8a61-03f10f59e1ac",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.79.4.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T14:05:03.000Z",
      "valid_until": "2026-05-01T14:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-30T13:27:20.563Z",
      "x_nadsec_last_seen": "2026-03-30T13:28:51.711Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8732"
      ],
      "x_nadsec_orgs": [
        "JSC Comcor"
      ]
    },
    {
      "created": "2026-03-30T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--4acf1b05-d270-4a8b-b3b7-c77fb75f1b1d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.89.34.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T15:05:03.000Z",
      "valid_until": "2026-05-01T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T14:15:42.835Z",
      "x_nadsec_last_seen": "2026-03-30T14:17:52.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-30T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=US; asn=7018; asn_org=AT&T Enterprises, LLC",
      "id": "indicator--41d15914-e07d-441f-b748-eac16eaeae1e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '12.39.250.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T15:05:03.000Z",
      "valid_until": "2026-05-01T15:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-30T14:20:35.474Z",
      "x_nadsec_last_seen": "2026-03-30T15:08:19.810Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "7018"
      ],
      "x_nadsec_orgs": [
        "AT&T Enterprises, LLC"
      ]
    },
    {
      "created": "2026-03-30T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SA; asn=25019; asn_org=Saudi Telecom Company JSC",
      "id": "indicator--2c8e138d-62e6-4d34-a230-cbe0c5fce39b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.88.128.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T15:05:03.000Z",
      "valid_until": "2026-05-01T15:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-30T14:21:00.541Z",
      "x_nadsec_last_seen": "2026-03-30T18:24:16.573Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "25019"
      ],
      "x_nadsec_orgs": [
        "Saudi Telecom Company JSC"
      ]
    },
    {
      "created": "2026-03-30T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--8edb3fcf-613f-4bdb-98ce-badbae6182d6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '219.159.253.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T15:05:03.000Z",
      "valid_until": "2026-05-01T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-30T14:57:27.338Z",
      "x_nadsec_last_seen": "2026-03-30T14:57:30.769Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-30T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=GB; asn=20738; asn_org=Heart Internet limited",
      "id": "indicator--31846280-4d44-4538-8436-b8352446afc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.32.228.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T15:05:03.000Z",
      "valid_until": "2026-05-01T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T14:30:05.429Z",
      "x_nadsec_last_seen": "2026-03-31T23:40:48.859Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld",
        "smbd"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "20738"
      ],
      "x_nadsec_orgs": [
        "Heart Internet limited"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-30T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=epmapper; ports=135; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ed50e458-a0a4-4e90-a430-6d22daec7bfc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.188.189.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T15:05:03.000Z",
      "valid_until": "2026-05-01T15:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-30T15:00:15.544Z",
      "x_nadsec_last_seen": "2026-03-30T15:00:25.749Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-30T15:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12695; asn_org=LLC Digital Network",
      "id": "indicator--d7e2c034-3f29-4bef-bfb4-c49f4b0a7d89",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T15:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.137.162.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T15:05:03.000Z",
      "valid_until": "2026-05-01T15:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T14:09:35.280Z",
      "x_nadsec_last_seen": "2026-03-30T14:11:41.967Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12695"
      ],
      "x_nadsec_orgs": [
        "LLC Digital Network"
      ]
    },
    {
      "created": "2026-03-30T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=NG; asn=29465; asn_org=MTN NIGERIA Communication limited",
      "id": "indicator--d301621f-2d6b-4519-bf2e-64a3fde1c777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.91.78.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T16:05:04.000Z",
      "valid_until": "2026-05-01T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T15:11:14.768Z",
      "x_nadsec_last_seen": "2026-03-30T15:13:22.299Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "NG"
      ],
      "x_nadsec_asns": [
        "29465"
      ],
      "x_nadsec_orgs": [
        "MTN NIGERIA Communication limited"
      ]
    },
    {
      "created": "2026-03-30T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--98b16f58-20ff-4899-91d4-bc700580912e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.209.221.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T16:05:04.000Z",
      "valid_until": "2026-05-01T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T15:43:15.838Z",
      "x_nadsec_last_seen": "2026-03-30T15:43:15.838Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-30T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--a225bb30-5ad5-497b-acd2-0578dd14cece",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.187.158.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T16:05:04.000Z",
      "valid_until": "2026-05-01T16:05:01.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-03-30T15:44:21.583Z",
      "x_nadsec_last_seen": "2026-03-30T15:45:17.151Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-30T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--fc2b8bf5-ab3d-45b0-bcb9-f6513cc8f525",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.50.239.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T16:05:04.000Z",
      "valid_until": "2026-05-01T16:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-30T15:59:25.175Z",
      "x_nadsec_last_seen": "2026-03-30T15:59:26.491Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-30T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=31200; asn_org=Novotelecom Ltd",
      "id": "indicator--8545a3ab-c15d-44cc-a44e-2c9067e956ce",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.128.110.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T16:05:04.000Z",
      "valid_until": "2026-05-01T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T15:59:44.375Z",
      "x_nadsec_last_seen": "2026-03-30T16:01:52.320Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "31200"
      ],
      "x_nadsec_orgs": [
        "Novotelecom Ltd"
      ]
    },
    {
      "created": "2026-03-30T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--3aea24de-a976-4ad5-911f-9b945779d49d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '90.189.208.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T16:05:04.000Z",
      "valid_until": "2026-05-01T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T15:11:46.203Z",
      "x_nadsec_last_seen": "2026-03-30T15:20:11.252Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-30T16:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--ffe0761e-b2b8-432f-be0d-96e07e8e711b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T16:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.80.4.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T16:05:04.000Z",
      "valid_until": "2026-05-01T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T15:22:41.667Z",
      "x_nadsec_last_seen": "2026-03-30T15:22:41.667Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-30T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=34; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a9810498-80c8-41f7-92a0-7b8c2a0bab84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.248.58.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T17:05:03.000Z",
      "valid_until": "2026-05-01T17:05:01.000Z",
      "x_nadsec_event_count": 34,
      "x_nadsec_first_seen": "2026-03-30T16:50:28.860Z",
      "x_nadsec_last_seen": "2026-03-30T16:51:26.752Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-30T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--21a5d24b-cdaf-4e86-9691-51ed7a073554",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.177.243.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T17:05:03.000Z",
      "valid_until": "2026-05-01T17:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T16:16:57.098Z",
      "x_nadsec_last_seen": "2026-03-30T16:19:01.946Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-30T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--64947df5-cb32-4e13-a069-8991e9486466",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T17:05:03.000Z",
      "valid_until": "2026-05-01T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T16:36:21.649Z",
      "x_nadsec_last_seen": "2026-03-30T16:36:21.649Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-30T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--02fc0be3-ffd6-4223-b311-4fece1f5a769",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.222.65.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T17:05:03.000Z",
      "valid_until": "2026-05-01T17:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-30T16:46:51.594Z",
      "x_nadsec_last_seen": "2026-03-30T16:48:55.970Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-30T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--84673f42-25ad-45c5-9549-a9bea7437bfd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.81.131.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T17:05:03.000Z",
      "valid_until": "2026-05-01T17:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T16:43:42.102Z",
      "x_nadsec_last_seen": "2026-03-30T16:43:42.102Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-30T17:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--6cae5282-0009-4f2c-a34e-4106870c42f6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T17:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.75.26.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T17:05:03.000Z",
      "valid_until": "2026-05-01T17:05:01.000Z",
      "x_nadsec_event_count": 7,
      "x_nadsec_first_seen": "2026-03-30T16:25:16.322Z",
      "x_nadsec_last_seen": "2026-03-30T17:05:22.230Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-30T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=BR; asn=28343; asn_org=UNIFIQUE TELECOMUNICACOES SA",
      "id": "indicator--969fa267-eca7-48d8-b3db-100a8923a496",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.231.25.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T18:05:03.000Z",
      "valid_until": "2026-05-01T18:05:01.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-13T16:16:35.927Z",
      "x_nadsec_last_seen": "2026-03-30T17:58:22.716Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "28343"
      ],
      "x_nadsec_orgs": [
        "UNIFIQUE TELECOMUNICACOES SA"
      ]
    },
    {
      "created": "2026-03-30T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=SC; asn=141159; asn_org=IncomparableHKNetwork Co., Limited",
      "id": "indicator--cfaf4381-4aff-40ef-bf5a-57efbd87aafa",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.205.16.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T18:05:03.000Z",
      "valid_until": "2026-05-01T18:05:01.000Z",
      "x_nadsec_event_count": 9,
      "x_nadsec_first_seen": "2026-03-25T03:23:00.219Z",
      "x_nadsec_last_seen": "2026-03-30T17:55:46.314Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SC"
      ],
      "x_nadsec_asns": [
        "141159"
      ],
      "x_nadsec_orgs": [
        "IncomparableHKNetwork Co., Limited"
      ]
    },
    {
      "created": "2026-03-30T18:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RU; asn=12768; asn_org=JSC ER-Telecom Holding; user(top)=**",
      "id": "indicator--95d29599-5886-42ff-82d3-249dbde19bee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T18:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.146.234.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T18:05:03.000Z",
      "valid_until": "2026-05-01T18:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T17:50:37.807Z",
      "x_nadsec_last_seen": "2026-03-30T17:50:37.807Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12768"
      ],
      "x_nadsec_orgs": [
        "JSC ER-Telecom Holding"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-30T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=138871; asn_org=PT. Trans Indonesia Superkoridor",
      "id": "indicator--0db51919-1164-4922-a1b1-c78bb570cb15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.175.48.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T19:05:04.000Z",
      "valid_until": "2026-05-01T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T18:08:48.928Z",
      "x_nadsec_last_seen": "2026-03-30T18:10:53.202Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "138871"
      ],
      "x_nadsec_orgs": [
        "PT. Trans Indonesia Superkoridor"
      ]
    },
    {
      "created": "2026-03-30T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=151576; asn_org=PT Mahawira Nusantara Grup",
      "id": "indicator--3b0a0d92-03bd-4f47-8b57-2502dcef097b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.76.108.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T19:05:04.000Z",
      "valid_until": "2026-05-01T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T18:28:43.464Z",
      "x_nadsec_last_seen": "2026-03-30T18:28:47.682Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "151576"
      ],
      "x_nadsec_orgs": [
        "PT Mahawira Nusantara Grup"
      ]
    },
    {
      "created": "2026-03-30T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--3a4fb440-329d-4d1a-aaf4-11376b7bfdf1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.128.242.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T19:05:04.000Z",
      "valid_until": "2026-05-01T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T18:48:56.654Z",
      "x_nadsec_last_seen": "2026-03-30T18:51:01.955Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-30T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--020b42e6-0149-4615-96d6-01cc8eadd6f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '201.108.184.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T19:05:04.000Z",
      "valid_until": "2026-05-01T19:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T18:55:24.637Z",
      "x_nadsec_last_seen": "2026-03-30T18:57:29.968Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-30T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--c271a05d-3bb9-4f16-be52-a0a48a63323a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T19:05:04.000Z",
      "valid_until": "2026-05-01T19:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T18:36:11.924Z",
      "x_nadsec_last_seen": "2026-03-30T18:36:11.924Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-30T20:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135756; asn_org=VPS Broadband And Telecommunications Pvt Ltd",
      "id": "indicator--ed329407-60f4-4fee-9f2e-2512f1226a0f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T20:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.74.169.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T20:05:04.000Z",
      "valid_until": "2026-05-01T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T19:35:02.800Z",
      "x_nadsec_last_seen": "2026-03-30T19:37:07.878Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135756"
      ],
      "x_nadsec_orgs": [
        "VPS Broadband And Telecommunications Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-30T20:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=SA; asn=35753; asn_org=Etihad Salam Telecom CJSC",
      "id": "indicator--e0ce6d91-2dbb-42ce-8efd-7701c1cd3171",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T20:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '149.232.66.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T20:05:04.000Z",
      "valid_until": "2026-05-01T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-30T19:11:01.240Z",
      "x_nadsec_last_seen": "2026-03-30T19:11:01.293Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "SA"
      ],
      "x_nadsec_asns": [
        "35753"
      ],
      "x_nadsec_orgs": [
        "Etihad Salam Telecom CJSC"
      ]
    },
    {
      "created": "2026-03-30T20:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=pptpd; ports=1723; cc=IN; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--0b3cab83-bd36-4bb3-a636-e53c701b214e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T20:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.159.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T20:05:04.000Z",
      "valid_until": "2026-05-01T20:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T19:11:40.720Z",
      "x_nadsec_last_seen": "2026-03-30T19:12:09.563Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-30T20:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=httpd; ports=81; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--128ecc76-3253-4ae5-b3c7-38d11b1062e0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T20:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T20:05:04.000Z",
      "valid_until": "2026-05-01T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T19:15:00.620Z",
      "x_nadsec_last_seen": "2026-03-30T19:15:00.620Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-30T20:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--0cc25d64-e498-465d-8058-7ead53f5e0eb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T20:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T20:05:04.000Z",
      "valid_until": "2026-05-01T20:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-30T20:02:58.252Z",
      "x_nadsec_last_seen": "2026-03-30T20:03:08.586Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-30T20:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--43dcf991-0216-485d-b1c0-fe3a6892f966",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T20:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T20:05:04.000Z",
      "valid_until": "2026-05-01T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T19:06:38.187Z",
      "x_nadsec_last_seen": "2026-03-30T19:06:38.187Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-30T20:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--5ea437c2-2406-4a9f-ad6d-a81d0d421475",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T20:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T20:05:04.000Z",
      "valid_until": "2026-05-01T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T19:34:39.087Z",
      "x_nadsec_last_seen": "2026-03-30T19:34:39.087Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-30T20:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=FR; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--47950095-a5a3-46cd-990a-c2798194f0d9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T20:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T20:05:04.000Z",
      "valid_until": "2026-05-01T20:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T19:34:39.435Z",
      "x_nadsec_last_seen": "2026-03-30T19:34:39.435Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-30T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--7463378f-a2ce-42af-8be8-5f652675b214",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.238.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T21:05:03.000Z",
      "valid_until": "2026-05-01T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T20:25:37.360Z",
      "x_nadsec_last_seen": "2026-03-30T20:25:37.360Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-30T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=ftpd; ports=21; cc=BR; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4cafa6cf-c4c6-4b1b-8b97-8999b5251847",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.199.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T21:05:03.000Z",
      "valid_until": "2026-05-01T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T20:09:16.191Z",
      "x_nadsec_last_seen": "2026-03-30T20:09:36.674Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-30T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--9cf3bcff-802b-41f5-b356-def4f13658f0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.127.224.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T21:05:03.000Z",
      "valid_until": "2026-05-01T21:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-30T20:08:35.682Z",
      "x_nadsec_last_seen": "2026-03-30T20:08:45.882Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-30T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--d49df734-6ba2-4df9-9cb4-9509f9f7219f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.210.249.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T21:05:03.000Z",
      "valid_until": "2026-05-01T21:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T20:14:13.346Z",
      "x_nadsec_last_seen": "2026-03-30T20:16:18.100Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-30T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--698b5656-c1e3-4ad2-a689-fec8b7ed59fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T21:05:03.000Z",
      "valid_until": "2026-05-01T21:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-30T21:04:12.252Z",
      "x_nadsec_last_seen": "2026-03-30T21:04:13.002Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-30T21:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--2000f64e-b9c2-4ce8-b228-57c5bbb69a9e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T21:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T21:05:03.000Z",
      "valid_until": "2026-05-01T21:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T20:51:16.033Z",
      "x_nadsec_last_seen": "2026-03-30T20:51:16.033Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-30T22:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=VN; asn=45903; asn_org=CMC Telecom Infrastructure Company",
      "id": "indicator--fe4d2fb0-3691-479b-bced-0a5626a9e65c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T22:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.99.13.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T22:05:04.000Z",
      "valid_until": "2026-05-01T22:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T21:35:03.759Z",
      "x_nadsec_last_seen": "2026-03-30T21:41:38.661Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45903"
      ],
      "x_nadsec_orgs": [
        "CMC Telecom Infrastructure Company"
      ]
    },
    {
      "created": "2026-03-30T22:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=17995; asn_org=PT iForte Global Internet",
      "id": "indicator--17107a49-51b0-4bb6-9b6c-d8ce5cc84288",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T22:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.169.252.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T22:05:04.000Z",
      "valid_until": "2026-05-01T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T22:04:09.831Z",
      "x_nadsec_last_seen": "2026-03-30T22:06:14.412Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "17995"
      ],
      "x_nadsec_orgs": [
        "PT iForte Global Internet"
      ]
    },
    {
      "created": "2026-03-30T22:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IT; asn=1267; asn_org=Wind Tre S.p.A.",
      "id": "indicator--2a3fffd0-62d5-4eea-9e75-2c6fdbf82f57",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T22:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '151.69.244.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T22:05:04.000Z",
      "valid_until": "2026-05-01T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-30T21:09:36.756Z",
      "x_nadsec_last_seen": "2026-03-30T21:09:36.830Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "1267"
      ],
      "x_nadsec_orgs": [
        "Wind Tre S.p.A."
      ]
    },
    {
      "created": "2026-03-30T22:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TH; asn=131445; asn_org=Advance Wireless Network",
      "id": "indicator--210ee17f-d3f3-47a3-b54d-b4048444b911",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T22:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.232.236.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T22:05:04.000Z",
      "valid_until": "2026-05-01T22:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T22:03:08.357Z",
      "x_nadsec_last_seen": "2026-03-30T22:09:43.656Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "131445"
      ],
      "x_nadsec_orgs": [
        "Advance Wireless Network"
      ]
    },
    {
      "created": "2026-03-30T22:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=28812; asn_org=PJSC Bashinformsvyaz",
      "id": "indicator--dda79cd3-cd90-4868-a702-a6cf788d932e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T22:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.8.169.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T22:05:04.000Z",
      "valid_until": "2026-05-01T22:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T21:57:15.781Z",
      "x_nadsec_last_seen": "2026-03-30T22:03:09.969Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "28812"
      ],
      "x_nadsec_orgs": [
        "PJSC Bashinformsvyaz"
      ]
    },
    {
      "created": "2026-03-30T22:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ES; asn=12430; asn_org=Vodafone Spain",
      "id": "indicator--98829c28-37bc-4a87-aceb-3029704895a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T22:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.26.235.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T22:05:04.000Z",
      "valid_until": "2026-05-01T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-30T21:59:44.936Z",
      "x_nadsec_last_seen": "2026-03-30T21:59:45.243Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "12430"
      ],
      "x_nadsec_orgs": [
        "Vodafone Spain"
      ]
    },
    {
      "created": "2026-03-30T22:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--90e9b4d8-94b5-4fe4-a2ab-614b2b7a2f1b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T22:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.180.159.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T22:05:04.000Z",
      "valid_until": "2026-05-01T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T21:57:53.034Z",
      "x_nadsec_last_seen": "2026-03-30T21:57:53.034Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-30T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=141898; asn_org=PT Milenial Inti Telekomunikasi",
      "id": "indicator--cea7a2ac-89cc-4089-97c6-1ace5974f31f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.164.13.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T23:05:04.000Z",
      "valid_until": "2026-05-01T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T22:57:37.998Z",
      "x_nadsec_last_seen": "2026-03-30T22:59:42.216Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "141898"
      ],
      "x_nadsec_orgs": [
        "PT Milenial Inti Telekomunikasi"
      ]
    },
    {
      "created": "2026-03-30T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VE; asn=11562; asn_org=Net Uno, C.A.",
      "id": "indicator--69dde4fd-3f1f-40a0-ba8e-fc09bc2d9c15",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '190.6.52.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T23:05:04.000Z",
      "valid_until": "2026-05-01T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T22:05:37.984Z",
      "x_nadsec_last_seen": "2026-03-30T22:07:43.786Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VE"
      ],
      "x_nadsec_asns": [
        "11562"
      ],
      "x_nadsec_orgs": [
        "Net Uno, C.A."
      ]
    },
    {
      "created": "2026-03-30T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--022e46c9-5d64-43cc-b512-48bc881a7289",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.29.23.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T23:05:04.000Z",
      "valid_until": "2026-05-01T23:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T22:59:29.121Z",
      "x_nadsec_last_seen": "2026-03-30T22:59:29.121Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-30T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--f71f1702-6875-4c54-a776-3632c4fef98a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.77.175.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T23:05:04.000Z",
      "valid_until": "2026-05-01T23:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-26T05:48:48.854Z",
      "x_nadsec_last_seen": "2026-03-30T22:36:44.295Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-30T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--23fab13f-50a8-4153-9ae0-d719cf5ace0b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.83.49.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T23:05:04.000Z",
      "valid_until": "2026-05-01T23:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-30T23:04:09.201Z",
      "x_nadsec_last_seen": "2026-03-30T23:10:38.173Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-30T23:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=35645; asn_org=Limited Liability Company VLADINFO",
      "id": "indicator--a24262ec-0b79-4535-9f51-5ee4906378e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-30T23:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.66.140.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T23:05:04.000Z",
      "valid_until": "2026-05-01T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T22:08:21.503Z",
      "x_nadsec_last_seen": "2026-03-30T22:10:28.165Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "35645"
      ],
      "x_nadsec_orgs": [
        "Limited Liability Company VLADINFO"
      ]
    },
    {
      "created": "2026-03-31T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--fa376987-d286-46aa-acf8-1bedff75c24c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.226.179.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T00:05:03.000Z",
      "valid_until": "2026-05-02T00:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-30T23:41:33.313Z",
      "x_nadsec_last_seen": "2026-03-30T23:41:40.894Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-31T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a778002a-b9cd-4578-8c3e-32ce33461cc6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.128.156.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T00:05:03.000Z",
      "valid_until": "2026-05-02T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T23:29:04.779Z",
      "x_nadsec_last_seen": "2026-03-30T23:29:04.779Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-31T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=26615; asn_org=TIM SA",
      "id": "indicator--f7991d3e-36fa-4d96-a156-dc192e2fb66b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.40.184.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T00:05:03.000Z",
      "valid_until": "2026-05-02T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T23:46:54.289Z",
      "x_nadsec_last_seen": "2026-03-30T23:47:01.425Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "26615"
      ],
      "x_nadsec_orgs": [
        "TIM SA"
      ]
    },
    {
      "created": "2026-03-31T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9d9b7268-3bee-4fab-9a07-46204917c044",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.81.219.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T00:05:03.000Z",
      "valid_until": "2026-05-02T00:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-30T23:25:29.750Z",
      "x_nadsec_last_seen": "2026-03-30T23:25:29.750Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-31T00:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ES; asn=3352; asn_org=Telefonica De Espana S.a.u.",
      "id": "indicator--75940784-dd2d-441a-a7e5-5187a65cf562",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T00:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.41.135.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T00:05:03.000Z",
      "valid_until": "2026-05-02T00:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-30T23:54:06.676Z",
      "x_nadsec_last_seen": "2026-03-30T23:56:12.843Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ES"
      ],
      "x_nadsec_asns": [
        "3352"
      ],
      "x_nadsec_orgs": [
        "Telefonica De Espana S.a.u."
      ]
    },
    {
      "created": "2026-03-31T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--bbafbd18-f68f-4f7d-85df-53f5861fce62",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '100.53.194.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T01:05:03.000Z",
      "valid_until": "2026-05-02T01:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T00:58:53.312Z",
      "x_nadsec_last_seen": "2026-03-31T00:58:53.312Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-31T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--bcf52ebb-27ab-4fcb-9e7b-23e9283c7123",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.136.29.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T01:05:03.000Z",
      "valid_until": "2026-05-02T01:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T00:36:24.921Z",
      "x_nadsec_last_seen": "2026-03-31T00:36:25.150Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-31T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--56bd2568-65eb-4737-ab73-bb26894a0871",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.86.104.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T01:05:03.000Z",
      "valid_until": "2026-05-02T01:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T00:59:22.863Z",
      "x_nadsec_last_seen": "2026-03-31T00:59:23.562Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-31T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DZ; asn=36947; asn_org=Telecom Algeria",
      "id": "indicator--9b34ba00-bbb8-4f13-9220-e4c5dfa4a369",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '154.242.169.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T01:05:03.000Z",
      "valid_until": "2026-05-02T01:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T00:51:08.127Z",
      "x_nadsec_last_seen": "2026-03-31T00:53:14.312Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DZ"
      ],
      "x_nadsec_asns": [
        "36947"
      ],
      "x_nadsec_orgs": [
        "Telecom Algeria"
      ]
    },
    {
      "created": "2026-03-31T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=smbd; ports=445; cc=HK; asn=9465; asn_org=AGOTOZ PTE. LTD.",
      "id": "indicator--fb4e9eb8-982e-49bd-b84e-54cddc1097df",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T01:05:03.000Z",
      "valid_until": "2026-05-02T01:05:00.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-31T00:13:29.328Z",
      "x_nadsec_last_seen": "2026-03-31T00:14:09.592Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "HK"
      ],
      "x_nadsec_asns": [
        "9465"
      ],
      "x_nadsec_orgs": [
        "AGOTOZ PTE. LTD."
      ]
    },
    {
      "created": "2026-03-31T01:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=GE; asn=34797; asn_org=System Net Ltd",
      "id": "indicator--f777c8b1-551d-4615-bfca-2fa1fb4d8f4a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T01:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.212.34.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T01:05:03.000Z",
      "valid_until": "2026-05-02T01:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T00:51:43.539Z",
      "x_nadsec_last_seen": "2026-03-31T00:53:50.047Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "GE"
      ],
      "x_nadsec_asns": [
        "34797"
      ],
      "x_nadsec_orgs": [
        "System Net Ltd"
      ]
    },
    {
      "created": "2026-03-31T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ZW; asn=329006; asn_org=DZL1-AS",
      "id": "indicator--538780e7-2bec-417d-804f-df495c8f1766",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.217.48.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:05:03.000Z",
      "valid_until": "2026-05-02T02:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-31T01:58:30.380Z",
      "x_nadsec_last_seen": "2026-03-31T01:59:14.635Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ZW"
      ],
      "x_nadsec_asns": [
        "329006"
      ],
      "x_nadsec_orgs": [
        "DZL1-AS"
      ]
    },
    {
      "created": "2026-03-31T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--d82fb726-bd7e-4a66-9485-63e2c81536a1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.210.91.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:05:03.000Z",
      "valid_until": "2026-05-02T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T01:59:19.010Z",
      "x_nadsec_last_seen": "2026-03-31T02:05:22.638Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24186"
      ],
      "x_nadsec_orgs": [
        "RailTel Corporation of India Ltd"
      ]
    },
    {
      "created": "2026-03-31T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=17; services=smbd; ports=445; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--fbc91243-5624-400e-806f-41777914d2fe",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.30.119.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:05:03.000Z",
      "valid_until": "2026-05-02T02:05:00.000Z",
      "x_nadsec_event_count": 23,
      "x_nadsec_first_seen": "2026-03-31T01:59:18.573Z",
      "x_nadsec_last_seen": "2026-03-31T02:05:24.740Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24186"
      ],
      "x_nadsec_orgs": [
        "RailTel Corporation of India Ltd"
      ]
    },
    {
      "created": "2026-03-31T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=24; services=smbd; ports=445; cc=IN; asn=9498; asn_org=BHARTI Airtel Ltd.",
      "id": "indicator--bb02f1ff-b705-4f79-bf2c-9e61057f832d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.185.24.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:05:03.000Z",
      "valid_until": "2026-05-02T02:05:00.000Z",
      "x_nadsec_event_count": 28,
      "x_nadsec_first_seen": "2026-03-31T01:58:47.643Z",
      "x_nadsec_last_seen": "2026-03-31T02:05:24.214Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9498"
      ],
      "x_nadsec_orgs": [
        "BHARTI Airtel Ltd."
      ]
    },
    {
      "created": "2026-03-31T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--99cca7d6-ff51-42c6-983d-55eff46e2371",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.86.113.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:05:03.000Z",
      "valid_until": "2026-05-02T02:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T01:18:27.730Z",
      "x_nadsec_last_seen": "2026-03-31T01:18:28.081Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-31T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=BR; asn=267560; asn_org=PC CONNECT TELECOMUNICACOES LTDA",
      "id": "indicator--8393e6cb-4add-4a69-87b9-757e6a6f9e24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.191.219.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:05:03.000Z",
      "valid_until": "2026-05-02T02:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T01:48:18.994Z",
      "x_nadsec_last_seen": "2026-03-31T01:48:18.994Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "267560"
      ],
      "x_nadsec_orgs": [
        "PC CONNECT TELECOMUNICACOES LTDA"
      ]
    },
    {
      "created": "2026-03-31T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=16735; asn_org=ALGAR TELECOM SA",
      "id": "indicator--21aa769c-0270-4abc-8e03-c8766a293cd3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.112.119.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:05:03.000Z",
      "valid_until": "2026-05-02T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T01:34:45.099Z",
      "x_nadsec_last_seen": "2026-03-31T01:36:52.093Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "16735"
      ],
      "x_nadsec_orgs": [
        "ALGAR TELECOM SA"
      ]
    },
    {
      "created": "2026-03-31T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--42d01540-3e2e-42d5-83a6-8c7ab9737ec5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.88.155.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:05:03.000Z",
      "valid_until": "2026-05-02T02:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-31T01:12:38.955Z",
      "x_nadsec_last_seen": "2026-03-31T01:16:49.016Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-31T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=16509; asn_org=Amazon.com, Inc.",
      "id": "indicator--d9bd0aa4-4532-45ef-904d-e09d9d44399f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.15.207.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:05:03.000Z",
      "valid_until": "2026-05-02T02:05:00.000Z",
      "x_nadsec_event_count": 16,
      "x_nadsec_first_seen": "2026-03-31T02:02:07.720Z",
      "x_nadsec_last_seen": "2026-03-31T04:02:58.838Z",
      "x_nadsec_ports": [
        "445",
        "1433",
        "21"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld",
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "16509"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-31T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=ftpd; ports=21; cc=BE; asn=396982; asn_org=Google LLC; user(top)=a*******s; pass(top)=a********@",
      "id": "indicator--e83786e5-2a03-40aa-9353-8c0826c64b7d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.38.249.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:05:03.000Z",
      "valid_until": "2026-05-02T02:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T01:05:40.524Z",
      "x_nadsec_last_seen": "2026-03-31T01:05:41.042Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "a*******s"
      ],
      "x_nadsec_passwords_attempted": [
        "a********@"
      ]
    },
    {
      "created": "2026-03-31T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MK; asn=6821; asn_org=Makedonski Telekom AD-Skopje",
      "id": "indicator--bc15da62-630a-435e-8a52-97c08210d0cb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.162.152.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:05:03.000Z",
      "valid_until": "2026-05-02T02:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T01:37:17.850Z",
      "x_nadsec_last_seen": "2026-03-31T01:39:24.178Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MK"
      ],
      "x_nadsec_asns": [
        "6821"
      ],
      "x_nadsec_orgs": [
        "Makedonski Telekom AD-Skopje"
      ]
    },
    {
      "created": "2026-03-31T02:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--5094474f-8aed-47a1-96aa-65f310315e5f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T02:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:05:03.000Z",
      "valid_until": "2026-05-02T02:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T01:32:15.166Z",
      "x_nadsec_last_seen": "2026-03-31T01:32:15.940Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-31T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=FR; asn=25540; asn_org=Alphalink SASU",
      "id": "indicator--3bfd7de0-1d83-4d63-b02e-1d33ad651649",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.93.20.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T03:05:03.000Z",
      "valid_until": "2026-05-02T03:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-31T02:30:29.481Z",
      "x_nadsec_last_seen": "2026-03-31T02:37:36.419Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "FR"
      ],
      "x_nadsec_asns": [
        "25540"
      ],
      "x_nadsec_orgs": [
        "Alphalink SASU"
      ]
    },
    {
      "created": "2026-03-31T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=TR; asn=42868; asn_org=Niobe Bilisim Ltd. Sti.; user(top)=**",
      "id": "indicator--87d823a5-b579-4168-a182-b7132cb882cd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.87.252.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T03:05:03.000Z",
      "valid_until": "2026-05-02T03:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T02:10:24.468Z",
      "x_nadsec_last_seen": "2026-03-31T02:10:24.468Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "42868"
      ],
      "x_nadsec_orgs": [
        "Niobe Bilisim Ltd. Sti."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-31T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=398722; asn_org=Censys, Inc.",
      "id": "indicator--8339f25d-0574-4407-8b7c-54a226a5259c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T03:05:03.000Z",
      "valid_until": "2026-05-02T03:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T03:02:42.628Z",
      "x_nadsec_last_seen": "2026-03-31T16:50:45.597Z",
      "x_nadsec_ports": [
        "21",
        "1883"
      ],
      "x_nadsec_services": [
        "ftpd",
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398722"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-31T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--8661bdd4-1dfc-45eb-b11c-9366cc551127",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.168.6.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T03:05:03.000Z",
      "valid_until": "2026-05-02T03:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T02:22:45.830Z",
      "x_nadsec_last_seen": "2026-03-31T02:22:45.830Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-31T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited",
      "id": "indicator--6a312fc2-ec33-4fe1-adff-7e7222037b34",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.206.122.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T03:05:03.000Z",
      "valid_until": "2026-05-02T03:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T02:55:57.434Z",
      "x_nadsec_last_seen": "2026-03-31T02:58:01.898Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "45758"
      ],
      "x_nadsec_orgs": [
        "Triple T Broadband Public Company Limited"
      ]
    },
    {
      "created": "2026-03-31T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--13e4a5e9-83c3-4036-8200-64148e577f8f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T03:05:03.000Z",
      "valid_until": "2026-05-02T03:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T02:44:26.333Z",
      "x_nadsec_last_seen": "2026-03-31T02:44:26.333Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-31T03:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=49551; asn_org=Teleseti Ltd",
      "id": "indicator--a16cc361-4205-4271-ba2a-d0b0aa89b005",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T03:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.214.223.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T03:05:03.000Z",
      "valid_until": "2026-05-02T03:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T02:37:21.452Z",
      "x_nadsec_last_seen": "2026-03-31T02:39:28.118Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "49551"
      ],
      "x_nadsec_orgs": [
        "Teleseti Ltd"
      ]
    },
    {
      "created": "2026-03-31T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=135223; asn_org=Netway Internet Pvt Ltd",
      "id": "indicator--b7734e8e-6e29-4e33-91a0-edef25d78e7a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.255.235.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:05:02.000Z",
      "valid_until": "2026-05-02T04:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T03:36:34.892Z",
      "x_nadsec_last_seen": "2026-03-31T03:36:39.914Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "135223"
      ],
      "x_nadsec_orgs": [
        "Netway Internet Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-31T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=581; services=smbd; ports=445; cc=TJ; asn=24722; asn_org=LLC Babilon-T",
      "id": "indicator--e32b13f6-6546-4d08-8ea0-0adfaad63211",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.74.69.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:05:02.000Z",
      "valid_until": "2026-05-02T04:05:00.000Z",
      "x_nadsec_event_count": 3147,
      "x_nadsec_first_seen": "2026-03-31T03:40:09.507Z",
      "x_nadsec_last_seen": "2026-03-31T05:02:46.755Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TJ"
      ],
      "x_nadsec_asns": [
        "24722"
      ],
      "x_nadsec_orgs": [
        "LLC Babilon-T"
      ]
    },
    {
      "created": "2026-03-31T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=PE; asn=27843; asn_org=WIN EMPRESAS S.A.C.; user(top)=**",
      "id": "indicator--faec446f-e73e-4e65-92b0-77ff9ebafd65",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.233.146.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:05:02.000Z",
      "valid_until": "2026-05-02T04:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T03:10:12.144Z",
      "x_nadsec_last_seen": "2026-03-31T03:10:12.144Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "PE"
      ],
      "x_nadsec_asns": [
        "27843"
      ],
      "x_nadsec_orgs": [
        "WIN EMPRESAS S.A.C."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-31T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bda9930d-ce57-4546-8160-64bbf5e685e3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.81.0.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:05:02.000Z",
      "valid_until": "2026-05-02T04:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T03:53:27.579Z",
      "x_nadsec_last_seen": "2026-03-31T03:53:27.579Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-31T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--9fbf4d67-61e6-4dd1-beef-fe1d99f77347",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.117.44.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:05:02.000Z",
      "valid_until": "2026-05-02T04:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T03:38:49.961Z",
      "x_nadsec_last_seen": "2026-03-31T03:40:54.933Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-31T04:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=RU; asn=44265; asn_org=OOO Smoltelecom",
      "id": "indicator--8b696dae-4b40-4417-a946-3b7b69f3b002",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T04:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.241.116.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:05:02.000Z",
      "valid_until": "2026-05-02T04:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T04:04:07.550Z",
      "x_nadsec_last_seen": "2026-03-31T04:06:14.119Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "44265"
      ],
      "x_nadsec_orgs": [
        "OOO Smoltelecom"
      ]
    },
    {
      "created": "2026-03-31T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=63526; asn_org=Systems Solutions & development Technologies Limited",
      "id": "indicator--7f4f9d7b-197f-44d5-928d-e2b8b0a4d351",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.106.239.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T05:05:03.000Z",
      "valid_until": "2026-05-02T05:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T04:25:16.351Z",
      "x_nadsec_last_seen": "2026-03-31T04:27:21.134Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "63526"
      ],
      "x_nadsec_orgs": [
        "Systems Solutions & development Technologies Limited"
      ]
    },
    {
      "created": "2026-03-31T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BD; asn=140664; asn_org=Cogent Broadband",
      "id": "indicator--8608f0bb-c96b-4b55-bde1-db8451121187",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.151.119.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T05:05:03.000Z",
      "valid_until": "2026-05-02T05:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T04:36:50.001Z",
      "x_nadsec_last_seen": "2026-03-31T04:38:54.806Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "140664"
      ],
      "x_nadsec_orgs": [
        "Cogent Broadband"
      ]
    },
    {
      "created": "2026-03-31T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IT; asn=30722; asn_org=Fastweb",
      "id": "indicator--b2a62e5b-2cf3-46af-863b-c4265cd214dd",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.115.166.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T05:05:03.000Z",
      "valid_until": "2026-05-02T05:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T04:56:27.112Z",
      "x_nadsec_last_seen": "2026-03-31T04:58:33.397Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "30722"
      ],
      "x_nadsec_orgs": [
        "Fastweb"
      ]
    },
    {
      "created": "2026-03-31T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--73dc8510-a202-411e-8e44-1c3bdb00fb78",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.119.185.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T05:05:03.000Z",
      "valid_until": "2026-05-02T05:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T04:17:45.317Z",
      "x_nadsec_last_seen": "2026-03-31T04:17:45.556Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-31T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--b66bb15d-8773-46bc-a6e7-2d9b3644a9e7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.134.231.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T05:05:03.000Z",
      "valid_until": "2026-05-02T05:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T05:00:42.306Z",
      "x_nadsec_last_seen": "2026-03-31T05:02:48.069Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-31T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=NL; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--9f3103c2-077d-4e28-825c-6585258e32b0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.166.104.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T05:05:03.000Z",
      "valid_until": "2026-05-02T05:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T04:11:57.761Z",
      "x_nadsec_last_seen": "2026-03-31T04:11:57.761Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "NL"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-31T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=TH; asn=4750; asn_org=CS LOXINFO PUBLIC COMPANY LIMITED",
      "id": "indicator--2eb09eea-b737-4dc4-b735-5488c8bf7ce4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.183.155.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T05:05:03.000Z",
      "valid_until": "2026-05-02T05:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T04:44:50.080Z",
      "x_nadsec_last_seen": "2026-03-31T04:46:54.544Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "4750"
      ],
      "x_nadsec_orgs": [
        "CS LOXINFO PUBLIC COMPANY LIMITED"
      ]
    },
    {
      "created": "2026-03-31T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=mssqld; ports=1433; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--042a75f2-6fab-45d3-956d-01edfb56f7c2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.33.102.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T05:05:03.000Z",
      "valid_until": "2026-05-02T05:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-31T04:24:39.440Z",
      "x_nadsec_last_seen": "2026-03-31T04:24:42.806Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-31T05:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--2bbcb2f0-27ba-46e6-9caf-869f800010c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T05:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.33.13.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T05:05:03.000Z",
      "valid_until": "2026-05-02T05:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T04:19:19.920Z",
      "x_nadsec_last_seen": "2026-03-31T04:19:19.920Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-31T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=70; services=mysqld; ports=3306; cc=IN; asn=132335; asn_org=LEAPSWITCH NETWORKS PRIVATE LIMITED; user(top)=r**t",
      "id": "indicator--27852f18-505c-411f-b330-46fc191be61a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.156.20.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:05:03.000Z",
      "valid_until": "2026-05-02T06:05:00.000Z",
      "x_nadsec_event_count": 70,
      "x_nadsec_first_seen": "2026-03-31T05:08:01.092Z",
      "x_nadsec_last_seen": "2026-03-31T05:08:55.452Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "132335"
      ],
      "x_nadsec_orgs": [
        "LEAPSWITCH NETWORKS PRIVATE LIMITED"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-31T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=epmapper; ports=135; cc=PL; asn=60968; asn_org=Benefit Systems SA",
      "id": "indicator--3e89c77b-3441-4418-a324-380412fe5292",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.232.242.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:05:03.000Z",
      "valid_until": "2026-05-02T06:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T05:33:57.174Z",
      "x_nadsec_last_seen": "2026-03-31T05:33:59.511Z",
      "x_nadsec_ports": [
        "445",
        "135"
      ],
      "x_nadsec_services": [
        "smbd",
        "epmapper"
      ],
      "x_nadsec_countries": [
        "PL"
      ],
      "x_nadsec_asns": [
        "60968"
      ],
      "x_nadsec_orgs": [
        "Benefit Systems SA"
      ]
    },
    {
      "created": "2026-03-31T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=46; services=smbd; ports=445; cc=TW; asn=7482; asn_org=Asia Pacific On-line Service Inc.",
      "id": "indicator--a66473b0-1801-4b68-9d68-f6a8fcb5dca0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '218.187.131.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:05:03.000Z",
      "valid_until": "2026-05-02T06:05:00.000Z",
      "x_nadsec_event_count": 3158,
      "x_nadsec_first_seen": "2026-03-31T05:50:02.819Z",
      "x_nadsec_last_seen": "2026-03-31T08:31:43.952Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "7482"
      ],
      "x_nadsec_orgs": [
        "Asia Pacific On-line Service Inc."
      ]
    },
    {
      "created": "2026-03-31T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=XK; asn=21246; asn_org=IPKO Telecommunications LLC",
      "id": "indicator--76698301-11c5-4b26-aaf7-7d6a18012be7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.99.149.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:05:03.000Z",
      "valid_until": "2026-05-02T06:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-31T05:28:07.053Z",
      "x_nadsec_last_seen": "2026-03-31T05:35:16.175Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "XK"
      ],
      "x_nadsec_asns": [
        "21246"
      ],
      "x_nadsec_orgs": [
        "IPKO Telecommunications LLC"
      ]
    },
    {
      "created": "2026-03-31T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--bc2688e9-d246-4a70-9ee5-c4e5f20ff156",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:05:03.000Z",
      "valid_until": "2026-05-02T06:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T05:55:57.273Z",
      "x_nadsec_last_seen": "2026-03-31T05:55:57.273Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-31T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=10439; asn_org=CariNet, Inc.",
      "id": "indicator--cdc2b746-51e3-4453-bbe6-9f667db7c070",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:05:03.000Z",
      "valid_until": "2026-05-02T06:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T05:24:46.945Z",
      "x_nadsec_last_seen": "2026-03-31T05:24:46.945Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "10439"
      ],
      "x_nadsec_orgs": [
        "CariNet, Inc."
      ]
    },
    {
      "created": "2026-03-31T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=ftpd; ports=21; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--00472424-0caf-4e31-a89b-8d60fe90e65b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:05:03.000Z",
      "valid_until": "2026-05-02T06:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T05:19:08.721Z",
      "x_nadsec_last_seen": "2026-03-31T05:19:08.721Z",
      "x_nadsec_ports": [
        "21"
      ],
      "x_nadsec_services": [
        "ftpd"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-31T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=CA; asn=209334; asn_org=Modat B.V.",
      "id": "indicator--4c48a457-5f3e-4398-95fb-cc450942836f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:05:03.000Z",
      "valid_until": "2026-05-02T06:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T05:19:11.683Z",
      "x_nadsec_last_seen": "2026-03-31T05:19:11.683Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "209334"
      ],
      "x_nadsec_orgs": [
        "Modat B.V."
      ]
    },
    {
      "created": "2026-03-31T06:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--7443e06b-e7f3-4625-b910-7546620ba1fb",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T06:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.103.192.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T06:05:03.000Z",
      "valid_until": "2026-05-02T06:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T05:49:03.382Z",
      "x_nadsec_last_seen": "2026-03-31T05:51:10.706Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-31T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=63969; asn_org=Race Online Limited",
      "id": "indicator--aa28e903-a431-480a-b47c-12fe3a3d02b1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.54.36.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:05:03.000Z",
      "valid_until": "2026-05-02T07:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-31T06:33:32.808Z",
      "x_nadsec_last_seen": "2026-03-31T06:39:54.041Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "63969"
      ],
      "x_nadsec_orgs": [
        "Race Online Limited"
      ]
    },
    {
      "created": "2026-03-31T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--4838bb14-a919-4e37-bb82-1aada14fecc5",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.231.13.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:05:03.000Z",
      "valid_until": "2026-05-02T07:05:00.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-31T06:54:42.184Z",
      "x_nadsec_last_seen": "2026-03-31T07:21:53.338Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-31T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--8ca4338c-9b0a-4955-9848-b5741db740c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.185.79.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:05:03.000Z",
      "valid_until": "2026-05-02T07:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T06:19:06.518Z",
      "x_nadsec_last_seen": "2026-03-31T06:19:06.802Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-31T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TH; asn=4618; asn_org=Internet Thailand Company Limited",
      "id": "indicator--e9a4b813-c7e2-44f8-b765-a34b8208a459",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.150.168.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:05:03.000Z",
      "valid_until": "2026-05-02T07:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-31T06:43:05.827Z",
      "x_nadsec_last_seen": "2026-03-31T06:43:09.922Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TH"
      ],
      "x_nadsec_asns": [
        "4618"
      ],
      "x_nadsec_orgs": [
        "Internet Thailand Company Limited"
      ]
    },
    {
      "created": "2026-03-31T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited",
      "id": "indicator--a9569a1b-fad6-40cd-be67-49956c5294fc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.48.16.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:05:03.000Z",
      "valid_until": "2026-05-02T07:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T06:42:16.014Z",
      "x_nadsec_last_seen": "2026-03-31T06:44:22.079Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PK"
      ],
      "x_nadsec_asns": [
        "17557"
      ],
      "x_nadsec_orgs": [
        "Pakistan Telecommunication Company Limited"
      ]
    },
    {
      "created": "2026-03-31T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--0ac47fc9-3613-4617-865c-29ff8b5428e9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:05:03.000Z",
      "valid_until": "2026-05-02T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T06:09:06.069Z",
      "x_nadsec_last_seen": "2026-03-31T06:09:06.069Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-31T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--45bf1fe4-b63f-47fd-aa5b-d07a32f139db",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:05:03.000Z",
      "valid_until": "2026-05-02T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T07:03:19.399Z",
      "x_nadsec_last_seen": "2026-03-31T07:03:19.399Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-31T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=pptpd; ports=1723; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--89e15fbb-4907-47a9-84e5-91fbf4ac0a84",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:05:03.000Z",
      "valid_until": "2026-05-02T07:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T06:32:30.919Z",
      "x_nadsec_last_seen": "2026-03-31T06:32:30.919Z",
      "x_nadsec_ports": [
        "1723"
      ],
      "x_nadsec_services": [
        "pptpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-31T07:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=IQ; asn=48407; asn_org=TigrisNet",
      "id": "indicator--01961c45-c9ec-408f-a827-cd12be5be9dc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T07:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '93.94.53.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T07:05:03.000Z",
      "valid_until": "2026-05-02T07:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-24T16:13:34.644Z",
      "x_nadsec_last_seen": "2026-03-31T06:38:46.497Z",
      "x_nadsec_ports": [
        "445",
        "1433"
      ],
      "x_nadsec_services": [
        "smbd",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "IQ"
      ],
      "x_nadsec_asns": [
        "48407"
      ],
      "x_nadsec_orgs": [
        "TigrisNet"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-31T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=BD; asn=136141; asn_org=Mohammad Kamrul Hasan ta SK Traders",
      "id": "indicator--6ac310e1-f36d-4e1f-824f-e565af383497",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.13.192.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:05:09.000Z",
      "valid_until": "2026-05-02T08:05:06.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-31T07:09:23.456Z",
      "x_nadsec_last_seen": "2026-03-31T07:15:53.015Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BD"
      ],
      "x_nadsec_asns": [
        "136141"
      ],
      "x_nadsec_orgs": [
        "Mohammad Kamrul Hasan ta SK Traders"
      ]
    },
    {
      "created": "2026-03-31T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=56272; asn_org=Pulse Telesystems Pvt Ltd",
      "id": "indicator--087ccdc5-acb5-4043-af2d-a99c915a3d8c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.3.228.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:05:09.000Z",
      "valid_until": "2026-05-02T08:05:06.000Z",
      "x_nadsec_event_count": 8,
      "x_nadsec_first_seen": "2026-03-31T07:34:08.949Z",
      "x_nadsec_last_seen": "2026-03-31T08:28:04.509Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "56272"
      ],
      "x_nadsec_orgs": [
        "Pulse Telesystems Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-31T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=4800; asn_org=PT Aplikanusa Lintasarta",
      "id": "indicator--4f27814c-34a2-48f2-80af-7c62e4eb4f41",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.8.194.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:05:09.000Z",
      "valid_until": "2026-05-02T08:05:06.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-13T07:39:45.418Z",
      "x_nadsec_last_seen": "2026-03-31T07:37:16.664Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "4800"
      ],
      "x_nadsec_orgs": [
        "PT Aplikanusa Lintasarta"
      ]
    },
    {
      "created": "2026-03-31T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--5242c369-5db7-4724-8298-9a498b578899",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.29.83.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:05:09.000Z",
      "valid_until": "2026-05-02T08:05:06.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-31T08:01:41.217Z",
      "x_nadsec_last_seen": "2026-03-31T08:08:24.792Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "9808"
      ],
      "x_nadsec_orgs": [
        "China Mobile Communications Group Co., Ltd."
      ]
    },
    {
      "created": "2026-03-31T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--8ac88c6a-8cf5-496b-bd6f-d44ed05b4827",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.184.82.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:05:09.000Z",
      "valid_until": "2026-05-02T08:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T07:16:06.074Z",
      "x_nadsec_last_seen": "2026-03-31T07:18:10.947Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-31T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=18403; asn_org=FPT Telecom Company",
      "id": "indicator--01e8ed6b-41a4-4ade-93b4-529c9997ea7b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.81.8.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:05:09.000Z",
      "valid_until": "2026-05-02T08:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T07:30:02.218Z",
      "x_nadsec_last_seen": "2026-03-31T07:32:07.500Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "18403"
      ],
      "x_nadsec_orgs": [
        "FPT Telecom Company"
      ]
    },
    {
      "created": "2026-03-31T08:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--f44a7b0a-f104-4db6-93dc-485947819c3c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T08:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.126.240.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:05:09.000Z",
      "valid_until": "2026-05-02T08:05:06.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T07:21:03.440Z",
      "x_nadsec_last_seen": "2026-03-31T07:23:11.052Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-31T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd",
      "id": "indicator--e4359f98-91de-4142-a60d-38ef658ffe68",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.246.42.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T09:05:03.000Z",
      "valid_until": "2026-05-02T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T08:10:45.829Z",
      "x_nadsec_last_seen": "2026-03-31T08:12:50.658Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24186"
      ],
      "x_nadsec_orgs": [
        "RailTel Corporation of India Ltd"
      ]
    },
    {
      "created": "2026-03-31T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--ade7fa58-ad22-4c72-888a-733746357af2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.24.178.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T09:05:03.000Z",
      "valid_until": "2026-05-02T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T08:11:29.920Z",
      "x_nadsec_last_seen": "2026-03-31T08:11:34.691Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-31T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TR; asn=12735; asn_org=TurkNet Iletisim Hizmetleri A.S.",
      "id": "indicator--74662a68-61b1-40d3-884e-cb0801340005",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.146.72.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T09:05:03.000Z",
      "valid_until": "2026-05-02T09:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-31T08:49:02.208Z",
      "x_nadsec_last_seen": "2026-03-31T08:55:59.748Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TR"
      ],
      "x_nadsec_asns": [
        "12735"
      ],
      "x_nadsec_orgs": [
        "TurkNet Iletisim Hizmetleri A.S."
      ]
    },
    {
      "created": "2026-03-31T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--f27b6179-e676-49d3-8c75-eb681d4ae55f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.223.116.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T09:05:03.000Z",
      "valid_until": "2026-05-02T09:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-31T08:10:53.793Z",
      "x_nadsec_last_seen": "2026-03-31T08:17:20.100Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-31T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--dd441391-aa5e-4c81-aac8-0cbf482822b6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.10.42.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T09:05:03.000Z",
      "valid_until": "2026-05-02T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T09:00:34.526Z",
      "x_nadsec_last_seen": "2026-03-31T09:02:40.885Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-31T09:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--9731e3f8-49e2-4cf5-9b12-2f4e4e22b716",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T09:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.37.245.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T09:05:03.000Z",
      "valid_until": "2026-05-02T09:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T08:36:35.900Z",
      "x_nadsec_last_seen": "2026-03-31T08:44:13.761Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-31T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=LK; asn=9329; asn_org=Sri Lanka Telecom Internet",
      "id": "indicator--fe526806-b91b-4da1-8560-92e43df86a02",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '124.43.21.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T10:05:04.000Z",
      "valid_until": "2026-05-02T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T09:43:21.665Z",
      "x_nadsec_last_seen": "2026-03-31T09:45:27.760Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "LK"
      ],
      "x_nadsec_asns": [
        "9329"
      ],
      "x_nadsec_orgs": [
        "Sri Lanka Telecom Internet"
      ]
    },
    {
      "created": "2026-03-31T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=MX; asn=8151; asn_org=UNINET",
      "id": "indicator--bd085c67-09c5-4559-a216-8fcead13feb4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.149.56.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T10:05:04.000Z",
      "valid_until": "2026-05-02T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T09:11:32.362Z",
      "x_nadsec_last_seen": "2026-03-31T09:13:37.396Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "MX"
      ],
      "x_nadsec_asns": [
        "8151"
      ],
      "x_nadsec_orgs": [
        "UNINET"
      ]
    },
    {
      "created": "2026-03-31T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--fda10dbb-8d7f-4bf7-968c-a086839e155d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.98.153.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T10:05:04.000Z",
      "valid_until": "2026-05-02T10:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T09:41:55.291Z",
      "x_nadsec_last_seen": "2026-03-31T09:41:55.291Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-31T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=PH; asn=4775; asn_org=Globe Telecoms",
      "id": "indicator--ee62a5a3-d29a-4c06-8ca8-2be93e993ee4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.127.18.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T10:05:04.000Z",
      "valid_until": "2026-05-02T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T09:08:23.356Z",
      "x_nadsec_last_seen": "2026-03-31T09:10:28.839Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "PH"
      ],
      "x_nadsec_asns": [
        "4775"
      ],
      "x_nadsec_orgs": [
        "Globe Telecoms"
      ]
    },
    {
      "created": "2026-03-31T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--5699be60-86cf-4e12-9cdd-49d7a2f25b1c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.38.133.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T10:05:04.000Z",
      "valid_until": "2026-05-02T10:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T09:59:09.910Z",
      "x_nadsec_last_seen": "2026-03-31T10:01:16.316Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-31T10:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=US; asn=398324; asn_org=Censys, Inc.",
      "id": "indicator--7d58cc5c-9793-4181-96af-69ccfbd8bf0d",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T10:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T10:05:04.000Z",
      "valid_until": "2026-05-02T10:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T09:15:40.555Z",
      "x_nadsec_last_seen": "2026-03-31T09:15:40.965Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "398324"
      ],
      "x_nadsec_orgs": [
        "Censys, Inc."
      ]
    },
    {
      "created": "2026-03-31T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=9583; asn_org=Sify Limited",
      "id": "indicator--1802cedd-1b5f-4cbf-b0f7-be57b058b0ed",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.7.53.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T12:05:04.000Z",
      "valid_until": "2026-05-02T12:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T11:34:07.842Z",
      "x_nadsec_last_seen": "2026-03-31T11:36:12.608Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "9583"
      ],
      "x_nadsec_orgs": [
        "Sify Limited"
      ]
    },
    {
      "created": "2026-03-31T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--f588182d-d02b-42fc-a334-4446be7ecf75",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.53.132.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T12:05:04.000Z",
      "valid_until": "2026-05-02T12:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-31T11:42:22.233Z",
      "x_nadsec_last_seen": "2026-03-31T13:03:18.501Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-31T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--3089ff16-c361-4e16-bf22-60b583437de0",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.38.141.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T12:05:04.000Z",
      "valid_until": "2026-05-02T12:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-31T11:37:26.787Z",
      "x_nadsec_last_seen": "2026-03-31T13:03:20.230Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-31T12:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=14618; asn_org=Amazon.com, Inc.; user(top)=**",
      "id": "indicator--698cb7df-7692-4836-a064-9bbd0a228101",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T12:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.4.241.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T12:05:04.000Z",
      "valid_until": "2026-05-02T12:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T11:47:36.864Z",
      "x_nadsec_last_seen": "2026-03-31T11:47:36.864Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-31T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--7934b6c9-1b9c-4ab9-9bef-ce89d93c003c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '100.51.6.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T13:05:03.000Z",
      "valid_until": "2026-05-02T13:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T12:11:37.644Z",
      "x_nadsec_last_seen": "2026-03-31T12:11:37.644Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-31T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=SG; asn=152194; asn_org=CTG Server Limited; user(top)=**",
      "id": "indicator--29aaec2f-9488-4c68-97f9-46a78f4460c6",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.122.169.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T13:05:03.000Z",
      "valid_until": "2026-05-02T13:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T12:59:35.135Z",
      "x_nadsec_last_seen": "2026-03-31T12:59:35.135Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "SG"
      ],
      "x_nadsec_asns": [
        "152194"
      ],
      "x_nadsec_orgs": [
        "CTG Server Limited"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-31T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=22927; asn_org=Telefonica de Argentina",
      "id": "indicator--9487336b-8f31-4ef8-a4c4-0d117425b625",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.36.53.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T13:05:03.000Z",
      "valid_until": "2026-05-02T13:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-31T12:54:13.603Z",
      "x_nadsec_last_seen": "2026-03-31T13:01:33.034Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "22927"
      ],
      "x_nadsec_orgs": [
        "Telefonica de Argentina"
      ]
    },
    {
      "created": "2026-03-31T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=BR; asn=271071; asn_org=NAVEGAI SERVICOS DE TELECOMUNICACOES E INFORMATICA",
      "id": "indicator--ce8a4121-a2f9-405b-bafc-1ad4913c73f1",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.48.94.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T13:05:03.000Z",
      "valid_until": "2026-05-02T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T12:19:43.165Z",
      "x_nadsec_last_seen": "2026-03-31T12:21:49.733Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "271071"
      ],
      "x_nadsec_orgs": [
        "NAVEGAI SERVICOS DE TELECOMUNICACOES E INFORMATICA"
      ]
    },
    {
      "created": "2026-03-31T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--32f03be1-d8cb-4caa-8eff-010a49ce69f8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.178.83.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T13:05:03.000Z",
      "valid_until": "2026-05-02T13:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T12:36:53.411Z",
      "x_nadsec_last_seen": "2026-03-31T12:38:57.922Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "24560"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd., Telemedia Services"
      ]
    },
    {
      "created": "2026-03-31T13:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--ecd39e37-abb6-4d68-8a69-15e8bae892ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T13:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.50.143.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T13:05:03.000Z",
      "valid_until": "2026-05-02T13:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-31T12:16:09.790Z",
      "x_nadsec_last_seen": "2026-03-31T12:25:17.398Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-03-31T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=263478; asn_org=DUFIBRANET TELECOM LTDA",
      "id": "indicator--1c393663-1b84-466f-85e3-304abad90868",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.204.82.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:05:03.000Z",
      "valid_until": "2026-05-02T14:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T13:19:01.902Z",
      "x_nadsec_last_seen": "2026-03-31T13:21:07.174Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "263478"
      ],
      "x_nadsec_orgs": [
        "DUFIBRANET TELECOM LTDA"
      ]
    },
    {
      "created": "2026-03-31T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=45899; asn_org=VNPT Corp",
      "id": "indicator--3104f03c-5dad-49a6-8ae4-67fd83bdb8b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.165.191.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:05:03.000Z",
      "valid_until": "2026-05-02T14:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T13:20:43.704Z",
      "x_nadsec_last_seen": "2026-03-31T13:22:49.896Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "45899"
      ],
      "x_nadsec_orgs": [
        "VNPT Corp"
      ]
    },
    {
      "created": "2026-03-31T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=24955; asn_org=JSC Ufanet",
      "id": "indicator--5ebb4b48-be8e-4a31-8169-df2af2bfad55",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '145.255.26.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:05:03.000Z",
      "valid_until": "2026-05-02T14:05:00.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-31T13:07:59.305Z",
      "x_nadsec_last_seen": "2026-03-31T13:17:30.127Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "24955"
      ],
      "x_nadsec_orgs": [
        "JSC Ufanet"
      ]
    },
    {
      "created": "2026-03-31T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=AR; asn=27747; asn_org=Telecentro S.A.",
      "id": "indicator--d766a410-f188-42a9-aa52-2725f9f4ea8b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '181.44.190.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:05:03.000Z",
      "valid_until": "2026-05-02T14:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T13:36:46.059Z",
      "x_nadsec_last_seen": "2026-03-31T13:38:53.654Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "AR"
      ],
      "x_nadsec_asns": [
        "27747"
      ],
      "x_nadsec_orgs": [
        "Telecentro S.A."
      ]
    },
    {
      "created": "2026-03-31T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=BR; asn=10429; asn_org=TELEFONICA BRASIL S.A",
      "id": "indicator--d972c8d4-1328-45ac-a4a0-0d705d030cb7",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '189.44.13.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:05:03.000Z",
      "valid_until": "2026-05-02T14:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T13:19:02.293Z",
      "x_nadsec_last_seen": "2026-03-31T13:21:08.887Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "BR"
      ],
      "x_nadsec_asns": [
        "10429"
      ],
      "x_nadsec_orgs": [
        "TELEFONICA BRASIL S.A"
      ]
    },
    {
      "created": "2026-03-31T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--8e1621ab-427d-4879-ab4d-b3740a32e4cc",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:05:03.000Z",
      "valid_until": "2026-05-02T14:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T13:52:16.751Z",
      "x_nadsec_last_seen": "2026-03-31T13:52:16.751Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-31T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=epmapper; ports=135; cc=US; asn=213412; asn_org=ONYPHE SAS",
      "id": "indicator--078326bb-4688-4a71-9716-4ad5821b62cf",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:05:03.000Z",
      "valid_until": "2026-05-02T14:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T13:52:17.062Z",
      "x_nadsec_last_seen": "2026-03-31T13:52:17.062Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "213412"
      ],
      "x_nadsec_orgs": [
        "ONYPHE SAS"
      ]
    },
    {
      "created": "2026-03-31T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--ac96d8aa-c112-41a0-9e77-65f6f5718008",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.105.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:05:03.000Z",
      "valid_until": "2026-05-02T14:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T13:10:32.779Z",
      "x_nadsec_last_seen": "2026-03-31T13:10:42.920Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-31T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=httpd; ports=81; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--a513abf8-89d8-49cf-988e-cbed1afa1f39",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.146.90.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:05:03.000Z",
      "valid_until": "2026-05-02T14:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T13:35:49.963Z",
      "x_nadsec_last_seen": "2026-03-31T13:35:50.428Z",
      "x_nadsec_ports": [
        "81"
      ],
      "x_nadsec_services": [
        "httpd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-31T14:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=RU; asn=25490; asn_org=Rostelecom",
      "id": "indicator--86924d43-6fca-4570-b554-ef19a3228fde",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T14:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.239.108.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:05:03.000Z",
      "valid_until": "2026-05-02T14:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T13:16:44.605Z",
      "x_nadsec_last_seen": "2026-03-31T13:16:45.067Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "25490"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-31T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=133684; asn_org=Sun Broadband And Data Services Pvt Ltd",
      "id": "indicator--0e160a3d-f87f-4116-95d5-3cb45ffabe0e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.46.241.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T15:05:02.000Z",
      "valid_until": "2026-05-02T15:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T14:51:36.887Z",
      "x_nadsec_last_seen": "2026-03-31T14:53:42.411Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133684"
      ],
      "x_nadsec_orgs": [
        "Sun Broadband And Data Services Pvt Ltd"
      ]
    },
    {
      "created": "2026-03-31T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IN; asn=45609; asn_org=Bharti Airtel Ltd. AS for GPRS Service",
      "id": "indicator--91044ff5-c17c-45a2-9682-3b4619d7b712",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.195.37.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T15:05:02.000Z",
      "valid_until": "2026-05-02T15:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T14:19:26.744Z",
      "x_nadsec_last_seen": "2026-03-31T14:21:31.801Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "45609"
      ],
      "x_nadsec_orgs": [
        "Bharti Airtel Ltd. AS for GPRS Service"
      ]
    },
    {
      "created": "2026-03-31T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=VN; asn=7552; asn_org=Viettel Group",
      "id": "indicator--6f1f3740-dc1d-43c5-9c00-5f2160ebf11b",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.4.32.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T15:05:02.000Z",
      "valid_until": "2026-05-02T15:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T14:44:52.322Z",
      "x_nadsec_last_seen": "2026-03-31T14:46:57.201Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "VN"
      ],
      "x_nadsec_asns": [
        "7552"
      ],
      "x_nadsec_orgs": [
        "Viettel Group"
      ]
    },
    {
      "created": "2026-03-31T15:05:02.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=EG; asn=8452; asn_org=TE Data",
      "id": "indicator--935ec4f1-4cdd-472f-a706-21f07818f280",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T15:05:02.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.236.188.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T15:05:02.000Z",
      "valid_until": "2026-05-02T15:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T14:26:46.783Z",
      "x_nadsec_last_seen": "2026-03-31T14:28:53.859Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "EG"
      ],
      "x_nadsec_asns": [
        "8452"
      ],
      "x_nadsec_orgs": [
        "TE Data"
      ]
    },
    {
      "created": "2026-03-31T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=IN; asn=133234; asn_org=PLUSNET COMMUNICATION PVT. LTD.",
      "id": "indicator--54cc846c-858c-4f0e-aaec-27d6163814b2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.231.6.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T16:05:05.000Z",
      "valid_until": "2026-05-02T16:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-31T15:17:32.817Z",
      "x_nadsec_last_seen": "2026-03-31T15:18:19.374Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IN"
      ],
      "x_nadsec_asns": [
        "133234"
      ],
      "x_nadsec_orgs": [
        "PLUSNET COMMUNICATION PVT. LTD."
      ]
    },
    {
      "created": "2026-03-31T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mongod; ports=27017; cc=CA; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--bed349a3-57da-4d20-be53-2d7cc45c15a4",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.22.233.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T16:05:05.000Z",
      "valid_until": "2026-05-02T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T15:17:36.947Z",
      "x_nadsec_last_seen": "2026-03-31T15:17:36.947Z",
      "x_nadsec_ports": [
        "27017"
      ],
      "x_nadsec_services": [
        "mongod"
      ],
      "x_nadsec_countries": [
        "CA"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-31T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=IT; asn=44092; asn_org=HAL Service SpA",
      "id": "indicator--67d144c9-4335-49c8-8c22-f1eea1366307",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.23.9.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T16:05:05.000Z",
      "valid_until": "2026-05-02T16:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T15:08:10.675Z",
      "x_nadsec_last_seen": "2026-03-31T15:08:17.910Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "IT"
      ],
      "x_nadsec_asns": [
        "44092"
      ],
      "x_nadsec_orgs": [
        "HAL Service SpA"
      ]
    },
    {
      "created": "2026-03-31T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=39; services=mqttd; ports=1883; cc=US; asn=63949; asn_org=Akamai Connected Cloud",
      "id": "indicator--f80557e5-5373-4175-8c67-0dc0a65eb381",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.33.54.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T16:05:05.000Z",
      "valid_until": "2026-05-02T16:05:01.000Z",
      "x_nadsec_event_count": 39,
      "x_nadsec_first_seen": "2026-03-31T15:18:12.159Z",
      "x_nadsec_last_seen": "2026-03-31T15:18:31.191Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "63949"
      ],
      "x_nadsec_orgs": [
        "Akamai Connected Cloud"
      ]
    },
    {
      "created": "2026-03-31T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=US; asn=14061; asn_org=DigitalOcean, LLC",
      "id": "indicator--a136694b-9745-4e3c-af4b-3446b47d9888",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '68.183.172.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T16:05:05.000Z",
      "valid_until": "2026-05-02T16:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T15:10:16.652Z",
      "x_nadsec_last_seen": "2026-03-31T15:10:16.652Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14061"
      ],
      "x_nadsec_orgs": [
        "DigitalOcean, LLC"
      ]
    },
    {
      "created": "2026-03-31T16:05:05.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=RU; asn=8402; asn_org=PVimpelCom",
      "id": "indicator--b93b722b-636b-4899-b603-752e0bc7a9ee",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T16:05:05.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.27.92.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T16:05:05.000Z",
      "valid_until": "2026-05-02T16:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-31T15:16:31.553Z",
      "x_nadsec_last_seen": "2026-03-31T15:24:11.353Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "8402"
      ],
      "x_nadsec_orgs": [
        "PVimpelCom"
      ]
    },
    {
      "created": "2026-03-31T18:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=12389; asn_org=Rostelecom",
      "id": "indicator--c29bc0aa-c080-4a9d-8ace-fc13c141eb24",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T18:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.60.123.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T18:05:09.000Z",
      "valid_until": "2026-05-02T18:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T18:01:21.520Z",
      "x_nadsec_last_seen": "2026-03-31T18:02:46.211Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "12389"
      ],
      "x_nadsec_orgs": [
        "Rostelecom"
      ]
    },
    {
      "created": "2026-03-31T18:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=US; asn=8075; asn_org=Microsoft Corporation",
      "id": "indicator--b7e4b1b6-b07c-4211-b6e9-aa2ac8078671",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T18:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.106.186.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T18:05:09.000Z",
      "valid_until": "2026-05-02T18:05:07.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T17:49:52.918Z",
      "x_nadsec_last_seen": "2026-03-31T17:49:52.918Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "8075"
      ],
      "x_nadsec_orgs": [
        "Microsoft Corporation"
      ]
    },
    {
      "created": "2026-03-31T18:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=RU; asn=50187; asn_org=BaikalWestCom",
      "id": "indicator--3dc0c127-e809-4604-81dd-dd12a6d46b9a",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T18:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.183.147.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T18:05:09.000Z",
      "valid_until": "2026-05-02T18:05:07.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T17:16:51.284Z",
      "x_nadsec_last_seen": "2026-03-31T17:18:58.387Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "RU"
      ],
      "x_nadsec_asns": [
        "50187"
      ],
      "x_nadsec_orgs": [
        "BaikalWestCom"
      ]
    },
    {
      "created": "2026-03-31T18:05:09.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=RO; asn=204428; asn_org=SS-Net",
      "id": "indicator--04fde8eb-8666-4d63-b035-acbb9605ebca",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T18:05:09.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T18:05:09.000Z",
      "valid_until": "2026-05-02T18:05:07.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-31T16:06:58.740Z",
      "x_nadsec_last_seen": "2026-03-31T17:14:35.537Z",
      "x_nadsec_ports": [
        "81",
        "1433",
        "27017"
      ],
      "x_nadsec_services": [
        "httpd",
        "mongod",
        "mssqld"
      ],
      "x_nadsec_countries": [
        "RO"
      ],
      "x_nadsec_asns": [
        "204428"
      ],
      "x_nadsec_orgs": [
        "SS-Net"
      ]
    },
    {
      "created": "2026-03-31T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=ID; asn=9905; asn_org=Linknet ASN",
      "id": "indicator--3f395b80-5e84-43d1-b58a-9c4b9295dbf8",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.255.62.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T19:05:04.000Z",
      "valid_until": "2026-05-02T19:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T19:00:47.393Z",
      "x_nadsec_last_seen": "2026-03-31T19:02:53.042Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "9905"
      ],
      "x_nadsec_orgs": [
        "Linknet ASN"
      ]
    },
    {
      "created": "2026-03-31T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=US; asn=396982; asn_org=Google LLC",
      "id": "indicator--e8fb6719-e83c-41f0-a243-47a432d87563",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T19:05:04.000Z",
      "valid_until": "2026-05-02T19:05:00.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-31T18:15:00.153Z",
      "x_nadsec_last_seen": "2026-03-31T18:15:01.228Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-31T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=DO; asn=6400; asn_org=Compania Dominicana de Telefonos S. A.",
      "id": "indicator--cc316e68-228e-4051-83ef-d05a38e95c4c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '200.88.156.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T19:05:04.000Z",
      "valid_until": "2026-05-02T19:05:00.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T18:55:19.119Z",
      "x_nadsec_last_seen": "2026-03-31T18:57:24.967Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "DO"
      ],
      "x_nadsec_asns": [
        "6400"
      ],
      "x_nadsec_orgs": [
        "Compania Dominicana de Telefonos S. A."
      ]
    },
    {
      "created": "2026-03-31T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=mssqld; ports=1433; cc=NP; asn=17501; asn_org=WorldLink Communications Pvt Ltd; user(top)=**",
      "id": "indicator--0b406edc-f69f-482e-b7c5-4f3873b0d937",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.79.49.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T19:05:04.000Z",
      "valid_until": "2026-05-02T19:05:00.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T18:38:43.475Z",
      "x_nadsec_last_seen": "2026-03-31T18:38:44.195Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "NP"
      ],
      "x_nadsec_asns": [
        "17501"
      ],
      "x_nadsec_orgs": [
        "WorldLink Communications Pvt Ltd"
      ],
      "x_nadsec_usernames_attempted": [
        "",
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-31T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC; user(top)=r**t",
      "id": "indicator--87975762-9637-44fb-aa5b-58fa31a5c7b3",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.62.134.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T19:05:04.000Z",
      "valid_until": "2026-05-02T19:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T18:23:12.770Z",
      "x_nadsec_last_seen": "2026-03-31T18:23:12.770Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ],
      "x_nadsec_usernames_attempted": [
        "r**t"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-31T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mysqld; ports=3306; cc=BE; asn=396982; asn_org=Google LLC",
      "id": "indicator--75382bbe-9641-4534-ac71-c40af6f37d7f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.62.248.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T19:05:04.000Z",
      "valid_until": "2026-05-02T19:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T18:23:12.107Z",
      "x_nadsec_last_seen": "2026-03-31T18:23:12.107Z",
      "x_nadsec_ports": [
        "3306"
      ],
      "x_nadsec_services": [
        "mysqld"
      ],
      "x_nadsec_countries": [
        "BE"
      ],
      "x_nadsec_asns": [
        "396982"
      ],
      "x_nadsec_orgs": [
        "Google LLC"
      ]
    },
    {
      "created": "2026-03-31T19:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mssqld; ports=1433; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; user(top)=**",
      "id": "indicator--b1cf90d5-308b-43e6-9312-125de1a0e40f",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T19:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.210.30.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T19:05:04.000Z",
      "valid_until": "2026-05-02T19:05:00.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T18:44:13.438Z",
      "x_nadsec_last_seen": "2026-03-31T18:44:13.438Z",
      "x_nadsec_ports": [
        "1433"
      ],
      "x_nadsec_services": [
        "mssqld"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4837"
      ],
      "x_nadsec_orgs": [
        "CHINA UNICOM China169 Backbone"
      ],
      "x_nadsec_usernames_attempted": [
        "**"
      ],
      "x_nadsec_passwords_attempted": [
        ""
      ]
    },
    {
      "created": "2026-03-31T22:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=KE; asn=329029; asn_org=MyManga-AS",
      "id": "indicator--7c0240fb-b0d1-4379-ba17-062e5b325568",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T22:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '102.215.32.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T22:05:04.000Z",
      "valid_until": "2026-05-02T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T21:56:08.963Z",
      "x_nadsec_last_seen": "2026-03-31T22:03:15.222Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "KE"
      ],
      "x_nadsec_asns": [
        "329029"
      ],
      "x_nadsec_orgs": [
        "MyManga-AS"
      ]
    },
    {
      "created": "2026-03-31T22:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=2; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--770ad526-8d8b-489e-b2e0-c03617869f9c",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T22:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.136.190.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T22:05:04.000Z",
      "valid_until": "2026-05-02T22:05:01.000Z",
      "x_nadsec_event_count": 2,
      "x_nadsec_first_seen": "2026-03-31T21:37:59.727Z",
      "x_nadsec_last_seen": "2026-03-31T21:37:59.792Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-31T22:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=ID; asn=23951; asn_org=PT JEMBATAN CITRA NUSANTARA",
      "id": "indicator--8493f3f9-070a-4968-8761-35923b401104",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T22:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.20.59.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T22:05:04.000Z",
      "valid_until": "2026-05-02T22:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T21:56:54.000Z",
      "x_nadsec_last_seen": "2026-03-31T21:58:58.296Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "23951"
      ],
      "x_nadsec_orgs": [
        "PT JEMBATAN CITRA NUSANTARA"
      ]
    },
    {
      "created": "2026-03-31T22:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=mqttd; ports=1883; cc=CN; asn=4134; asn_org=Chinanet",
      "id": "indicator--6839ffc5-52e5-4a77-81c6-7181011f9310",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T22:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.245.84.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T22:05:04.000Z",
      "valid_until": "2026-05-02T22:05:01.000Z",
      "x_nadsec_event_count": 1,
      "x_nadsec_first_seen": "2026-03-31T21:12:28.242Z",
      "x_nadsec_last_seen": "2026-03-31T21:12:28.242Z",
      "x_nadsec_ports": [
        "1883"
      ],
      "x_nadsec_services": [
        "mqttd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4134"
      ],
      "x_nadsec_orgs": [
        "Chinanet"
      ]
    },
    {
      "created": "2026-03-31T22:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=20; services=mirrorc; ports=42773; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--c2a2eef6-c628-49a3-b1e5-a9592345eab2",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T22:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.128.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T22:05:04.000Z",
      "valid_until": "2026-05-02T22:05:01.000Z",
      "x_nadsec_event_count": 20,
      "x_nadsec_first_seen": "2026-03-31T22:02:19.164Z",
      "x_nadsec_last_seen": "2026-03-31T22:02:26.120Z",
      "x_nadsec_ports": [
        "42",
        "35263",
        "38281",
        "38641",
        "38801",
        "42459",
        "42773",
        "42845",
        "43623",
        "44409"
      ],
      "x_nadsec_services": [
        "mirrorc",
        "mirrord"
      ],
      "x_nadsec_countries": [
        "GB"
      ],
      "x_nadsec_asns": [
        "135377"
      ],
      "x_nadsec_orgs": [
        "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
      ]
    },
    {
      "created": "2026-03-31T22:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=TN; asn=327934; asn_org=Tunisie-Telecom",
      "id": "indicator--ab412d36-5d9f-46da-b6f1-58442c797fa9",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T22:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '197.11.83.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T22:05:04.000Z",
      "valid_until": "2026-05-02T22:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-31T21:59:19.004Z",
      "x_nadsec_last_seen": "2026-03-31T22:00:03.256Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TN"
      ],
      "x_nadsec_asns": [
        "327934"
      ],
      "x_nadsec_orgs": [
        "Tunisie-Telecom"
      ]
    },
    {
      "created": "2026-03-31T22:05:04.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=3; services=smbd; ports=445; cc=UG; asn=37273; asn_org=BCS",
      "id": "indicator--d44415a5-17ce-4c7e-8fda-44a0cbf40177",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T22:05:04.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '41.84.193.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T22:05:04.000Z",
      "valid_until": "2026-05-02T22:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-31T22:01:07.740Z",
      "x_nadsec_last_seen": "2026-03-31T22:03:13.401Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "UG"
      ],
      "x_nadsec_asns": [
        "37273"
      ],
      "x_nadsec_orgs": [
        "BCS"
      ]
    },
    {
      "created": "2026-03-31T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=1; services=smbd; ports=445; cc=TW; asn=3462; asn_org=Data Communication Business Group",
      "id": "indicator--5a94ffcd-9dbd-42a2-ab29-dc1c69faf862",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.36.147.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T23:05:03.000Z",
      "valid_until": "2026-05-02T23:05:01.000Z",
      "x_nadsec_event_count": 3,
      "x_nadsec_first_seen": "2026-03-31T23:01:48.138Z",
      "x_nadsec_last_seen": "2026-03-31T23:06:05.962Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "TW"
      ],
      "x_nadsec_asns": [
        "3462"
      ],
      "x_nadsec_orgs": [
        "Data Communication Business Group"
      ]
    },
    {
      "created": "2026-03-31T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=6; services=epmapper; ports=135; cc=US; asn=14618; asn_org=Amazon.com, Inc.",
      "id": "indicator--322e4c32-95bb-4b61-986a-5895b9edfc3e",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.97.26.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T23:05:03.000Z",
      "valid_until": "2026-05-02T23:05:01.000Z",
      "x_nadsec_event_count": 6,
      "x_nadsec_first_seen": "2026-03-31T22:18:46.362Z",
      "x_nadsec_last_seen": "2026-03-31T22:19:33.670Z",
      "x_nadsec_ports": [
        "135"
      ],
      "x_nadsec_services": [
        "epmapper"
      ],
      "x_nadsec_countries": [
        "US"
      ],
      "x_nadsec_asns": [
        "14618"
      ],
      "x_nadsec_orgs": [
        "Amazon.com, Inc."
      ]
    },
    {
      "created": "2026-03-31T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=5; services=smbd; ports=445; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia",
      "id": "indicator--1e6eafef-a05b-4da3-93e6-ab9ea00a9777",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.254.104.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T23:05:03.000Z",
      "valid_until": "2026-05-02T23:05:01.000Z",
      "x_nadsec_event_count": 5,
      "x_nadsec_first_seen": "2026-03-31T22:29:34.311Z",
      "x_nadsec_last_seen": "2026-03-31T22:36:15.657Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "ID"
      ],
      "x_nadsec_asns": [
        "7713"
      ],
      "x_nadsec_orgs": [
        "PT Telekomunikasi Indonesia"
      ]
    },
    {
      "created": "2026-03-31T23:05:03.000Z",
      "description": "Attacker IP \u2022 Dionaea / seen in Dionaea honeypot logs; events=4; services=smbd; ports=445; cc=CN; asn=4812; asn_org=China Telecom Group",
      "id": "indicator--1553309f-b248-483f-9771-53508abd6440",
      "labels": [
        "bruteforce"
      ],
      "modified": "2026-03-31T23:05:03.000Z",
      "name": "OTX pulse_name=Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.37.220.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T23:05:03.000Z",
      "valid_until": "2026-05-02T23:05:01.000Z",
      "x_nadsec_event_count": 4,
      "x_nadsec_first_seen": "2026-03-31T22:16:15.000Z",
      "x_nadsec_last_seen": "2026-03-31T22:18:21.215Z",
      "x_nadsec_ports": [
        "445"
      ],
      "x_nadsec_services": [
        "smbd"
      ],
      "x_nadsec_countries": [
        "CN"
      ],
      "x_nadsec_asns": [
        "4812"
      ],
      "x_nadsec_orgs": [
        "China Telecom Group"
      ]
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "enriched_at": "2026-03-31T23:56:39Z",
    "enricher": "enrich_stix_dionaea.py",
    "month": "2026-03",
    "es_host": "http://127.0.0.1:64298",
    "ip_count": 6426,
    "hash_count": 0,
    "enriched_count": 6272
  },
  "x_mitre_attack": {
    "techniques": {
      "T1021.002": {
        "name": "Remote Services: SMB/Windows Admin Shares",
        "tactic": "Lateral Movement",
        "ip_count": 4609,
        "sample_services": []
      },
      "T1190": {
        "name": "Exploit Public-Facing Application",
        "tactic": "Initial Access",
        "ip_count": 991,
        "sample_services": []
      },
      "T1110": {
        "name": "Brute Force",
        "tactic": "Credential Access",
        "ip_count": 415,
        "sample_services": []
      },
      "T1133": {
        "name": "External Remote Services",
        "tactic": "Initial Access",
        "ip_count": 290,
        "sample_services": []
      }
    },
    "tactic_summary": {
      "Lateral Movement": 4609,
      "Initial Access": 1281,
      "Credential Access": 415
    },
    "technique_count": 4,
    "primary_tactics": [
      "Lateral Movement",
      "Initial Access",
      "Credential Access"
    ]
  },
  "x_nadsec_threat_summary": {
    "total_ips": 6272,
    "scored_ips": 6272,
    "threat_distribution": {
      "critical": 557,
      "high": 454,
      "medium": 564,
      "low": 1137,
      "minimal": 3560,
      "unknown": 0
    },
    "avg_threat_score": 28.0,
    "max_threat_score": 100,
    "top_threats": [
      {
        "ip": "85.11.183.19",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "204.76.203.215",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "45.91.64.6",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "193.32.162.28",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "18.116.101.220",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "37.60.241.154",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.11.183.27",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "176.65.149.31",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "18.218.118.203",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.11.183.25",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "80.66.83.43",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.11.183.23",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "3.131.220.121",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "3.130.168.2",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.11.183.21",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "16.58.56.214",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "176.120.22.240",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "115.231.78.11",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "3.129.187.38",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "3.132.26.232",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      }
    ]
  }
}